@calm-artist-7206 doing this because it was an edge case in PAT_TOKEN scope 😛

@calm-artist-7206 oh and https://github.com/OpenHands/software-agent-sdk/pull/2844/changes to remove some unnecessary PAT_TOKENs 😅

Is the separation done, in other words, can I enable now workflows that run on random prompts? I think of it this way: the worst that the agent can do is what a jailbroken LLM can do, and that means the damage at the extent allowed by the access it has. Let's say • LLM key goes poof, to the max budget, used for... dunno, crypto? 😅 • the github PAT accesses everything it can, even read only, and clones the private repos and discussions for fun somewhere on the internet. • or if it has write to infra stuff, well, y'know.

But if we manage to fully separate, if stuff accessible on OpenHands public repos is completely limited for OpenHands public repos, then we're in a very different and more secure place. At least the boundary is well understood and we can look at it.