NG Projects - Tambayan

Project Name	Display Name	GitHub Repo	Maintainers	Status	GH Token	Agent API	Created	Actions
Loading projects...

Time	Project	Action	User	Details
Loading history...

Project Name *

URL path: /ng/project-name/

Display Name *

Description

Hosting *

Tambayan sandbox Runs on this server at /ng/{name}/, with its Postgres database and files here. GitHub or Azure Repos. CM Enhance sandbox Runs on CargoMind Enhance, with its database and files there. Deployed through its webhook. GitHub. Self-hosted Runs on its own infrastructure and domain, with its own database and storage. GitHub or Azure Repos.

Repository

Paste owner/repo, or Create it on GitHub from the project name: private, seeded with the platform reference and starter files. Or an Azure Repos URL (https://dev.azure.com/{org}/{project}/_git/{repo}), for a Tambayan sandbox or a self-hosted project.

GitHub Token (optional) How do I create one?

An Azure DevOps personal access token (User settings → Personal access tokens) with Code: Read & write. Agents clone and push with it, and open pull requests with az repos pr create (it is their AZURE_DEVOPS_EXT_PAT).

Empty: the provisioning token clones the project and GH_PAT stays empty in .env. Set a fine-grained token for this repository only when developers need to push: deploys clone with it and it goes into .env as GH_PAT. Clear it and save to go back to the provisioning token.

Environment Variables (.env)

Type a key and value, or paste KEY=value lines. An existing key gets its value replaced. Values stay hidden. Save Project, then Deploy to write the .env file. Edit as text

Database Template (SQL)

Runs as the project's own database user in the {project}_ng schema on every deploy, so keep it re-runnable (IF NOT EXISTS). Placeholders: {project}, {schema}. Leave empty for no database.

Maintainers

Users with the project-maintainer role. Maintainers can deploy, pull, edit files and download the .env of their projects.

Allow sign-in (SSO)

Lets this project see who is signed in here, through the injected identity(req). While it is off, the platform removes the session cookie before the request reaches the project, so its code cannot read or replay anyone's login. Off for new projects. Takes effect on Save, no deploy needed.

One token per project repo. A classic ghp_ token with repo scope opens every repository its account can reach; a fine-grained token opens only the repo you pick.

Open the generator
github.com/settings/personal-access-tokens/new
Name it and set an expiration.
When it expires, pushes and deploys fail at the same moment with a clone error. Paste a new token here to fix it.
Resource owner: the account or organisation that owns the repo.
For an organisation repo, the org must allow fine-grained tokens or the repo will not be listed.
Repository access → Only select repositories →

Repository permissions: exactly these three.

Permission	Access	Used for
Contents	Read and write	Clone, pull, push, branches, and the clone on every deploy
Pull requests	Read and write	Opening, updating and merging PRs
Metadata	Read-only	Required; GitHub adds it automatically

Do not add Workflows, Secrets, Administration or any Account permission. Nothing here needs them.

Generate token, copy the github_pat_… value and paste it into GitHub Token. GitHub shows it once.
Save Project, then Deploy, and check the log says Repository cloned successfully.

NG Projects - Tambayan

Repository provisioning

Projects

Recent Activity

NG Projects - Tambayan

Repository provisioning

Projects

Recent Activity

Add Project

Agent API key

Create a fine-grained GitHub token

Delete Project

Project Terminal

New file

Import projects