golive: ship agent-built apps to your own cloud

npx skills add mikehasa/golive-skill --skill golive

Your agent writes a working tool in minutes, then hits the wall: production. Hosting, database, env vars, domain, email, payments — each one means touching a real account, and few people let an agent loose in theirs. golive (mikehasa/golive-skill, MIT, 1,088 stars checked September 29) turns that last mile into a controlled pipeline: the agent works through detect, plan, approve, apply and verify, and every resource lands in accounts you already own — Vercel, Supabase, whatever you choose. There is no GoLive account, no hosted backend, no telemetry.

The order it works in

The SKILL.md imposes a hard sequence (I read it in full): detect scans the project — framework, services in use, env var names it expects — and refuses to write server secrets to the host until findings like a client-exposed secret are fixed in code; plan lists every resource it would create or change, in plain language, marking which steps write; nothing touches a provider until you approve; apply executes the approved plan; verify grades each outcome pass, fail, warning or skipped — and skipped does not count: things it cannot confirm (env var values, whether an email truly landed) get listed as unverified rather than glossed over. Each run leaves a GOLIVE_REPORT.md; golive status later re-checks your resources for drift read-only, and golive teardown removes only resources it can prove it created, asking again before deleting.

What it constrains

• Approval before any write: no provider writes until the human approves the plan; the first production deploy needs a separate --confirm-live, DNS changes --confirm-dns, deletions --confirm-destroy, and a changed plan voids earlier approvals.
• Secrets stay out of context: credentials, .env and vendor login files must never be read into the conversation — referenced by name only; keys live in the local plaintext file ~/.config/golive/credentials (permission-restricted, not Keychain).
• Humans hand over credentials: you connect accounts in the browser and submit tokens yourself; the agent may at most open a local input dialog and is forbidden from inspecting credential files or imitating OS authorization prompts.
• “Done” requires a passing check: a handoff closes only on a passing check, and manual or skipped items must be named as unverified by golive in the final summary.
• Updates never cross an approval: the bundle is verified before each run, and it will never update itself between a plan and its apply — a changed release means a new plan and a new approval.

Who it’s for

Personal projects, small apps and staging environments: the alpha has verified Vercel + Supabase and Netlify + Neon end to end, plus Cloudflare, GoDaddy and Porkbun DNS, Resend email, Stripe test-mode payments and Supabase Auth. You need Node.js 20+, and installation has been checked for Codex and Claude Code only:

npx skills add https://github.com/mikehasa/golive-skill --skill golive --global

If you would rather self-host everything and skip Vercel entirely, Instatic is the closer fit; golive serves people happy to use managed cloud who just don’t want to click through consoles. The honest boundaries are printed in the README: this is 0.1.0-alpha.7, complex cloud architecture is not its strength; it can only constrain its own flow — an agent that already holds your cloud credentials can still bypass it — and credentials sit in a plaintext file. Treat it as a launch assistant with approvals, records and verification, not a full handover.