mirror of
https://github.com/nightly-labs/openbot.git
synced 2026-11-15 15:21:41 +08:00
GitHub needs the Administration permission to create a repository, and OpenBotGit did not ask for it (#4998). The manifest now asks for administration: write. An installation token is not limited to what its user can do. The Worker now requests bot tokens with the granted permissions of the installation, without administration, so a user with push access cannot get admin access through openbotgit[bot]. Creation uses the user token. When an installation has not granted the permission, the GitHub MCP proxy adds an explanation to the create_repository error for the agent. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>