Synopsis
Description
Grants<email> access to the named protected branch in the named project. No prompts and no TUI - same operation as pressing g on a branch row that reads no access in capy users, but scriptable for CI.
Run it inside a Capy project: Capy reads the organization from keep.lock in the working directory, then authenticates with your cached session. If that session can’t be refreshed, the command falls back to the interactive browser OAuth flow rather than failing straight away.
The user must already be a member of the org - this adds a grant, it doesn’t invite. A grant only means something on a protected branch; org-wide branches need no grant. <project> and <branch> must match the project and branch names exactly, while <email> matches case-insensitively.
capy grant-branch is disabled in local-only mode, which has no organization, team, or server.
Example
Failure modes
Any other service error - for example, your role isn’t allowed to grant on that project - is printed as a raw error object rather than a tidy message. All exits are non-zero on failure, suitable for CI.
See also
capy revoke-branch- the inversecapy users- interactive equivalent- Protected branches - the concept