chore: remove redundant automationSdk version — derive from agentServer (#1333)

The automationSdk version was always intended to equal agentServer.
Having a separate field creates a maintenance foothole where the two
values can silently drift. Remove automationSdk from defaults.json and
have all consumers (check-sdk-version-sync, dev-with-automation,
agent-canvas CLI --version output) read versions.agentServer directly.
The sync check still catches any mismatch between the released
openhands-automation package and the expected SDK version.

Co-authored-by: openhands <openhands@all-hands.dev>

AGENTS.md

@@ -512,7 +512,7 @@ When adding code that needs a new string, decide up front which rule it falls un
   - `/api/*`, `/sockets`, etc. → agent server (:18000)
   - `/*` (default) → frontend server (:3001), either Vite or static depending on launcher mode
   - Environment variables: `PORT` (ingress port, default: 8000), `OH_AUTOMATION_GIT_REF` (git ref, overrides default version), `OH_AUTOMATION_VERSION` (default: `1.0.0a3`), `AUTOMATION_LOCAL_API_KEY` (optional, use a fixed key; default: persisted generated key), `OH_AUTOMATION_API_KEY_PATH` (override the persisted default key path)
-  - `scripts/check-sdk-version-sync.mjs` checks the released `openhands-automation` package against `versions.automationSdk` in `config/defaults.json`; that value may intentionally lag `versions.agentServer` while automation has not yet published a matching release.
+  - `scripts/check-sdk-version-sync.mjs` checks the released `openhands-automation` package against `versions.agentServer` in `config/defaults.json`; these must always match — if the automation package's SDK dependencies differ from `agentServer`, the check fails.
   - Access points: `http://localhost:8000/` (main UI), `http://localhost:8000/api/automation/docs` (API docs)
   - Security: `AUTOMATION_LOCAL_API_KEY` defaults to a generated key persisted across restarts because static frontend builds bake it into `VITE_AUTOMATION_API_KEY`. Set the env var explicitly to rotate or pin it. The cipher key (`OH_SECRET_KEY`) is persisted at `~/.openhands/agent-canvas/secret-key.txt` (same file used by `docker/entrypoint.sh`); both modes share the same key automatically when using the same `~/.openhands` directory.
 - `scripts/ingress.mjs` is a standalone HTTP reverse proxy that can be used independently to route traffic to multiple backends based on URL path prefix.

bin/agent-canvas.mjs

@@ -37,7 +37,6 @@ if (args.includes("--info")) {
 Default stack versions:
   agent-server:    ${defaults.versions.agentServer}
   automation:      ${defaults.versions.automation}
-  automation-sdk:  ${defaults.versions.automationSdk}
 
 Compatibility:
   agent-server:    >= ${defaults.compatibility.minimumAgentServer}

config/defaults.json

@@ -4,8 +4,7 @@
   "versions": {
     "agentServer": "1.28.1",
     "agentCanvas": "1.0.0-rc.11",
-    "automation": "1.0.0a9",
-    "automationSdk": "1.28.1"
+    "automation": "1.0.0a9"
   },
 
   "compatibility": {

scripts/check-sdk-version-sync.mjs

@@ -12,8 +12,8 @@
  *
  * This script checks the RELEASED PyPI version of openhands-automation (as specified
  * by versions.automation in config/defaults.json), not the main branch.
- * versions.automationSdk records the SDK dependency version for that
- * released automation package and may intentionally lag versions.agentServer.
+ * The expected SDK dependency version is versions.agentServer — the two must
+ * always match, so this script catches any drift.
  *
  * This script is run in CI to catch version drift between projects.
  *
@@ -57,8 +57,7 @@ Verifies that the released openhands-automation package on PyPI uses the
 SDK version expected for that automation release.
 
 The automation version is read from config/defaults.json (versions.automation).
-The expected SDK dependency version is read from versions.automationSdk,
-falling back to versions.agentServer for older configs.
+The expected SDK dependency version is read from versions.agentServer.
 
 Usage:
   node scripts/check-sdk-version-sync.mjs [options]
@@ -148,8 +147,8 @@ try {
   SHARED_DEFAULTS = JSON.parse(
     readFileSync(join(projectRoot, "config", "defaults.json"), "utf-8"),
   );
-  if (!SHARED_DEFAULTS.versions?.agentServer || !SHARED_DEFAULTS.versions?.automationSdk) {
-    throw new Error("missing required fields: versions.agentServer, versions.automationSdk");
+  if (!SHARED_DEFAULTS.versions?.agentServer) {
+    throw new Error("missing required field: versions.agentServer");
   }
 } catch (err) {
   console.error(`${colors.red}Failed to load config/defaults.json: ${err.message}${colors.reset}`);
@@ -157,13 +156,6 @@ try {
   process.exit(1);
 }
 
-/**
- * Read the default agent-server SDK version from config/defaults.json.
- */
-function getDefaultAgentServerVersion() {
-  return { version: SHARED_DEFAULTS.versions.agentServer, source: "config/defaults.json" };
-}
-
 /**
  * Read the expected automation SDK dependency version from environment
  * or config/defaults.json.
@@ -176,8 +168,8 @@ function getExpectedVersion() {
   }
 
   return {
-    version: SHARED_DEFAULTS.versions.automationSdk,
-    source: "config/defaults.json (versions.automationSdk)",
+    version: SHARED_DEFAULTS.versions.agentServer,
+    source: "config/defaults.json (versions.agentServer)",
   };
 }
 
@@ -316,13 +308,6 @@ async function main() {
       `Expected automation SDK version: ${colors.green}${expectedVersion}${colors.reset} (from ${versionSource})`,
     );
 
-    const { version: agentServerVersion } = getDefaultAgentServerVersion();
-    if (!versionsEqual(agentServerVersion, expectedVersion)) {
-      console.log(
-        `${colors.yellow}Note:${colors.reset} DEFAULT_AGENT_SERVER_VERSION is ${agentServerVersion}; automation release dependencies may lag while a compatible automation package is pending.`,
-      );
-    }
-
     // Get automation version from env var or config/defaults.json
     const { version: automationVersion, source: automationSource } = getAutomationVersion();
     console.log(
@@ -413,13 +398,10 @@ async function main() {
       console.log("");
       console.log("To fix, update one of the following:");
       console.log(
-        `  1. Update versions.automationSdk in config/defaults.json to match the automation release`,
+        `  1. Release a new version of ${AUTOMATION_PACKAGE_NAME} with SDK dependencies pinned to ${expectedVersion}`,
       );
       console.log(
-        `  2. Release a new version of ${AUTOMATION_PACKAGE_NAME} with SDK dependencies pinned to ${expectedVersion}`,
-      );
-      console.log(
-        `  3. Update versions.automation in config/defaults.json to a newer release`,
+        `  2. Update versions.automation in config/defaults.json to a newer release`,
       );
       console.log("");
       process.exit(1);

scripts/dev-with-automation.mjs

@@ -81,9 +81,7 @@ const SHARED_DEFAULTS = JSON.parse(
 const DEFAULT_AUTOMATION_REPO = "https://github.com/OpenHands/automation";
 const DEFAULT_AUTOMATION_PACKAGE = SHARED_DEFAULTS.packages.automation;
 const DEFAULT_AUTOMATION_VERSION = SHARED_DEFAULTS.versions.automation;
-// SDK version used by DEFAULT_AUTOMATION_VERSION. This can intentionally lag
-// the agent-server version while automation releases catch up.
-const DEFAULT_AUTOMATION_SDK_VERSION = SHARED_DEFAULTS.versions.automationSdk;
+const DEFAULT_AUTOMATION_SDK_VERSION = SHARED_DEFAULTS.versions.agentServer;
 const DEFAULT_BACKEND_PORT = SHARED_DEFAULTS.ports.agentServer;
 const DEFAULT_AUTOMATION_PORT = SHARED_DEFAULTS.ports.automation;