fix: sanitize @OpenHands only in GitHub comments (backend)

[YakshithK]

Summary

This PR implements backend sanitization of @OpenHands mentions in GitHub comments to prevent self-mention loops. Instead of mentioning the OpenHands agent, the sanitization inserts a zero-width joiner after the @ symbol, making the mention non-clickable while maintaining readability.

Changes

• Added sanitize_openhands_mentions() function in openhands/sdk/utils/github.py that uses a zero-width joiner (U+200D) to prevent @OpenHands mentions from being parsed as clickable references
• Updated GitHub workflow files to sanitize @OpenHands mentions before posting comments
• Updated example agent script to sanitize review comments before posting
• Exported the new function from the utils module

Technical Details

• The sanitization is performed in the backend (when outputting to GitHub comments) rather than at the agent/frontend level
• Uses regex pattern matching to identify @OpenHands mentions (case-insensitive)
• Inserts zero-width joiner after @ to break the mention linkage
• Maintains text readability since the zero-width joiner is invisible

Related PR

See OpenHands/OpenHands#11550 for the corresponding changes in the main repository.

[blacksmith-sh]

[Automatic Post]: It has been a while since there was any activity on this PR. @YakshithK, are you still working on it? If so, please go ahead, if not then please request review, close it, or request that someone else follow up.

[simonrosenberg]

@OpenHands

Make sure that sanitize_openhands_mentions is applied to all agents outputs that is then posted as a comment to github.
.github/workflows/run-examples.yml should use sanitize_openhands_mentions instead of redefining a method.

[openhands-ai]

I'm on it! simonrosenberg can track my progress at all-hands.dev

[openhands-ai]

Summary of Changes

I've successfully addressed your request to ensure sanitize_openhands_mentions is properly applied to all agent outputs posted as GitHub comments, and updated .github/workflows/run-examples.yml to use the function instead of redefining it.

Changes Made:

1. Refactored .github/workflows/run-examples.yml:

• Replaced inline function definition (lines 109-122): Removed the bash function that redefined the sanitization logic and replaced it with a call to openhands.sdk.utils.github.sanitize_openhands_mentions
• Added missing sanitization to the read_report step (line 316): The scheduled/workflow_dispatch runs now properly sanitize the examples report before posting to the tracker issue

Verification:

✅ All GitHub comment locations now use sanitization:

• .github/workflows/integration-runner.yml: Lines 229 and 241 (already using SDK function)
• .github/workflows/run-examples.yml:
  • update_comment function: Line 112 (now using SDK function)
  • read_report step: Line 316 (newly added)
• examples/03_github_workflows/02_pr_review/agent_script.py: Line 56 (already using SDK function)

✅ No more duplicate definitions: The inline sanitization logic has been removed in favor of importing from the SDK utils module

✅ Pre-commit checks passed: All formatting and linting checks passed

Changes Pushed:

The commit has been pushed to the fix/prevent-self-mentioning-loops branch and is now part of PR #1020.

View PR: #1020

_{View full conversation}

[enyst]

Is it necessary to define PYTHONPATH?

[simonrosenberg]

According to OpenHands

The workflow runs uv sync --dev which properly installs all workspace packages including openhands-sdk
Once installed via uv sync, the package is available in the Python environment without needing PYTHONPATH
The uv run python command already uses the correct virtual environment with the installed packages
Let me remove the unnecessary PYTHONPATH settings:```

[enyst]

@OpenHands Do a /codereview-roasted on this PR.

[openhands-ai]

I'm on it! enyst can track my progress at all-hands.dev

[openhands-ai]

Summary of work: I performed a “/codereview-roasted” review of the PR on branch fix/prevent-self-mentioning-loops. I reviewed the diff vs. origin/main and examined these files:

• openhands-sdk/openhands/sdk/utils/github.py
• openhands-sdk/openhands/sdk/utils/init.py
• .github/workflows/integration-runner.yml
• .github/workflows/run-examples.yml
• examples/03_github_workflows/02_pr_review/agent_script.py

Key findings and recommendations:

• Critical fix: The mention regex in utils/github.py will falsely trigger on email addresses like [email protected]. Use a safer pattern that avoids email-localpart contexts, for example:
  • pattern = r"(?<![\w.+-])@OpenHands\b(?!\.)" with re.IGNORECASE
• Simplify regex: Drop [Oo]/[Hh] since re.IGNORECASE already handles case.
• Consider ZWSP (U+200B) or document tradeoffs of ZWJ (U+200D) for broader renderer compatibility.
• Add a small unit test suite for sanitize_openhands_mentions (mentions, punctuation, no-op, and email cases).
• Workflow polish:
  • Prefer printf "%s" over echo for piping multi-line content to Python.
  • Standardize on a single method (gh CLI or curl) for posting comments to reduce maintenance friction.
  • Optional: centralize the sanitize invocation to avoid repeating inline python -c fragments.
• Future-proofing: If needed, extend sanitization to other bot handles beyond @OpenHands.

No code changes were made or pushed.

_{View full conversation}

[openhands-ai]

@openhands-ai[bot] please re-login into OpenHands Cloud before starting a job.

[blacksmith-sh]

[Automatic Post]: It has been a while since there was any activity on this PR. @YakshithK, are you still working on it? If so, please go ahead, if not then please request review, close it, or request that someone else follow up.

[simonrosenberg]

@OpenHands please resolve conflicts

[openhands-ai]

I'm on it! simonrosenberg can track my progress at all-hands.dev

[openhands-ai]

Summary

I have successfully resolved the merge conflicts in PR #1020 (fix/prevent-self-mentioning-loops) by merging the latest changes from origin/main into the feature branch.

What was done:

1. Identified the conflict: The conflict was in openhands-sdk/openhands/sdk/utils/__init__.py where:

   • The feature branch added sanitize_openhands_mentions from .github module
   • The main branch added deprecation utilities (deprecated, warn_deprecated) from .deprecation module

2. Resolved the conflict: I merged both changes by:

   • Keeping all imports from both branches
   • Including both sets of exports in the __all__ list
   • Maintaining proper alphabetical ordering

3. Validated the changes:

   • Ran pre-commit hooks to ensure code quality (all passed)
   • Verified the resolved file meets all coding standards

4. Committed and pushed:

   • Created a merge commit with a clear description of the conflict resolution
   • Pushed the changes to origin/fix/prevent-self-mentioning-loops

The PR is now up-to-date with the main branch and ready for review. The merge brought in 140 changed files from main (including new features like deprecation utilities, critic implementations, and various improvements) while preserving the sanitization functionality from the feature branch.

_{View full conversation}