CI / checks (push) Skipped
CI / checks (pull_request) Successful in 1m14s
Answering "is the workspace where the agent runs, or what it works on?" — it is what it works on, and conflating the two is dangerous rather than merely untidy. The agent commits its workspace with git add -A and pushes it, so anything inside the clone reaches the project repository. A .env placed there would publish the LiteLLM, Matrix and Gitea tokens as a side effect of the agent working correctly: silently, once, and probably unnoticed. Startup now refuses both that and a state store inside the clone, and .env.example documents the intended layout. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>