github/OpenHands
1
0
Fork 0
mirror of https://github.com/OpenHands/OpenHands.git synced 2026-10-07 16:08:23 +08:00
Code Issues Packages Projects Releases Wiki Activity
7,690 Commits 1,487 Branches 181 Tags
66394db18a3443dfe048c0109ed3a1818de2038e
Commit Graph
108 Commits
Author SHA1 Message Date
Hiep Le 66394db18a fix: translate English-copied keys and guard against untranslated values (#1305) 2026-06-11 17:28:49 +00:00
Hiep Le 10f622a430 chore: remove one-off migration codemods, demo recorder, and unused beep asset (#1232) 2026-06-10 20:30:08 +07:00
FraterCCCLXIIICursoropenhandsTim O'FarrellRohit MalhotrachuckbutkusHiep Lehieptl
 		dcf469855a UI polish: drawer tabs, empty states, and browser chrome (#1288) 
* chore: bump version to 1.0.0-beta.1

* chore: publish beta and rc versions as 'latest' dist-tag

* chore: bump version to 1.0.0-beta.2

* fix: use X-Session-API-Key for local automation auth in prompts and RUNTIME_SERVICES (#999)

Fixes #980

The agent prompt in recommended-automations-launcher and the
RUNTIME_SERVICES block in agent-server-adapter both advertised
X-API-Key as the auth header for the local automation backend.
The automation service (openhands-automation) does not accept
X-API-Key — it accepts Authorization: Bearer and X-Session-API-Key.

X-Session-API-Key is the established local convention: the agent
server uses it, the frontend automation API client uses it (with an
explicit comment that both backends share the same header), and
auth.py describes it as matching that convention. Update both call
sites and the corresponding test assertion to use X-Session-API-Key.

Co-authored-by: openhands <openhands@all-hands.dev>

* feat: reuse mock-LLM E2E tests for Docker image validation (#992)

* feat: reuse mock-LLM E2E tests for Docker image validation

Add a Docker-specific Playwright config (playwright.mock-llm-docker.config.ts)
that runs the exact same test specs and helpers against the agent-canvas Docker
image instead of the npm build path (bin/agent-canvas.mjs + uvx).

Key changes:

- Split MOCK_LLM_BASE_URL into two constants in mock-llm-helpers.ts:
  - MOCK_LLM_BASE_URL: always host-local, used by tests for admin API
  - MOCK_LLM_AGENT_URL: env-overridable, used when configuring the LLM
    profile (the URL the agent-server uses for inference). Defaults to
    MOCK_LLM_BASE_URL for backward compatibility with the npm path.

- New playwright.mock-llm-docker.config.ts:
  - Starts the mock LLM server on the host (same as npm path)
  - Runs the Docker container with --network host (Linux CI)
  - Points to the same testDir (tests/e2e/mock-llm/) and specs
  - Separate output dirs to avoid collision with npm path results

- New CI workflow (.github/workflows/mock-llm-docker-e2e.yml):
  - Builds the Docker image from current code (or uses a pre-built image)
  - Runs the same specs against the container
  - Posts PR comment with differentiated report title

- render-mock-llm-report.mjs: accept --title flag for Docker vs npm reports
- npm run test:e2e:mock-llm:docker script added
- .gitignore updated for docker test output dirs

The npm path (test:e2e:mock-llm) is fully backward-compatible — no env var
override needed since MOCK_LLM_AGENT_URL defaults to MOCK_LLM_BASE_URL.

Co-authored-by: openhands <openhands@all-hands.dev>

* refactor: chain Docker E2E off existing Docker CI via workflow_run

Instead of rebuilding the Docker image in the E2E workflow (duplicating
~10-15 min of Docker build time), use workflow_run to trigger automatically
after the existing 'Docker' workflow completes successfully.

The workflow now:
- Triggers on: workflow_run (Docker completed) + workflow_dispatch (manual)
- Derives the image tag from the Docker build's commit SHA
  (ghcr.io/openhands/agent-canvas:sha-<short>-amd64)
- Pulls the already-built image from GHCR — no rebuild needed
- Checks out code at the same SHA as the Docker build
- Extracts PR number from workflow_run.pull_requests[] for comments

Removed: Docker build steps, Buildx setup, build-arg resolution.
All image building stays in docker.yml where it belongs.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: replace flaky 1s timeout with polling for Active badge assertion

The 'Active badge' check in step 2 used a hardcoded 1-second
waitForTimeout before reloading. On a loaded CI runner the profile
activation mutation may not persist in time, causing the reload to
show stale state. This is a pre-existing flake (identical test code
passed on the first push and failed on the second).

Replace with expect.poll() that retries the reload+check cycle with
increasing intervals (1s, 2s, 3s) up to 15 seconds total.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: add pull_request trigger for Docker E2E (workflow_run bootstrap)

workflow_run only fires when the workflow file exists on the default
branch (main). Since mock-llm-docker-e2e.yml is new and only on the
PR branch, GitHub doesn't recognize it as a workflow_run listener yet.

Add pull_request trigger (gated by 'e2e-tests' label, skip forks) that
polls the Docker workflow via gh API until it completes for the PR's
head SHA, then pulls the already-built image from GHCR and runs tests.

After merge, workflow_run takes over as the primary automatic trigger.
The pull_request path remains as a fallback for label-gated runs.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: add FILE_STORE, AUTOMATION_BASE_URL, AUTOMATION_WORKSPACE_BASE to Docker entrypoint

The Docker entrypoint was missing several environment variables that the npm
path (dev-with-automation.mjs) sets for the automation backend:

- FILE_STORE=local — without this, the automation backend may fall back to
  cloud storage (S3/GCS) which fails without credentials, causing tarball-
  based presets (preset/prompt, preset/plugin) to silently error
- LOCAL_STORAGE_PATH — where to store files on the local filesystem
- AUTOMATION_BASE_URL — publicly-reachable base URL for callback URLs
- AUTOMATION_WORKSPACE_BASE — where automation runs unpack tarballs

This explains the Docker E2E failure: the agent's curl to create an automation
via /api/automation/v1/preset/prompt returned an error (likely 500 from missing
storage config), but the mock LLM doesn't care about terminal output and
proceeded to return the scripted final reply. The test then found 0 automations.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: exclude auth-modes spec from Docker E2E tests

The mock-llm-auth-modes.spec.ts tests npm-binary-specific --auth-required
behaviour (a second static-server instance on port 18301). The Docker image
doesn't provide this second server — it has its own auth handling. Exclude
the spec from the Docker test run via testIgnore.

Co-authored-by: openhands <openhands@all-hands.dev>

* feat: run auth-modes tests inside Docker via PUBLIC_MODE_PORT

Instead of excluding the auth-modes spec from the Docker E2E run or
spinning up a host-side static server with a duplicate build/ directory,
the Docker entrypoint now supports an optional PUBLIC_MODE_PORT env var.

When set, entrypoint.sh starts a second static-server instance from the
same baked-in frontend assets with --auth-required (no session key
injected). This tests the actual Docker image's auth gate behaviour —
not a host-side approximation.

The Playwright Docker config passes -e PUBLIC_MODE_PORT=18301 to the
container and exports MOCK_LLM_PUBLIC_MODE_URL so the auth-modes spec
can reach it. With --network host the port is accessible from the host.

Co-authored-by: openhands <openhands@all-hands.dev>

* address review feedback: drop unlabeled trigger, improve error messages, document env vars

- Drop 'unlabeled' from pull_request trigger types to avoid wasted
  workflow runs when any label is removed (the job-level if: condition
  would skip immediately anyway)
- Distinguish 'no Docker run found' vs 'didn't complete in time' in
  the polling loop's final error message
- Add comment explaining /api/automation/v1 probe returns 200 without
  auth so the readiness check won't spin for 180s
- Document FILE_STORE, LOCAL_STORAGE_PATH, AUTOMATION_BASE_URL, and
  AUTOMATION_WORKSPACE_BASE in the entrypoint header — these affect
  production deployments, not just E2E tests

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: bump version to 1.0.0-beta.3

* ci: trigger CI on rel-* branch pushes for tag protection rule (#1004)

The Release Tag ruleset requires test-and-build (ubuntu) to pass
before v* tags can be pushed, but CI previously only ran on main and
pull_request events. This caused rel-* version bump commits to fail
the tag protection check unless a workaround PR was opened.

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: bump version to 1.0.0-beta.4

* chore: auto-graduate npm dist-tag from latest to per-tier once first stable release ships (#1028)

* chore: always publish to npm with --tag latest until first stable release

All alpha/beta/rc versions now get the 'latest' dist-tag so plain
'npm install @openhands/agent-canvas' always resolves to the newest
published release. The per-tier dist-tags (alpha/beta/rc) can be
re-introduced once the first full stable version is ready to ship.

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: auto-graduate npm dist-tag when first stable release ships

At publish time, query npm for any published version without a pre-release
suffix. If none exists, all releases (alpha/beta/rc/stable) use --tag latest
so plain 'npm install' always resolves to the newest build. Once a stable
version has been published, pre-release versions revert to their own
dist-tags (alpha/beta/rc) automatically — no workflow change required.

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: bump version to 1.0.0-beta.5

* feat(mcp): render markdown links in helperText; update Slack catalog pin (#1012)

* feat(mcp): render markdown links in helperText; bump extensions to slack field-order PR commit

- Add renderHelperText() to install-server-modal.tsx that converts
  [text](url) patterns into <a> elements with target=_blank, so the
  Slack workspace-ID helper text (and any future catalog entries) can
  embed clickable docs links inline.
- Bump @openhands/extensions to commit 2d43e9c (branch
  slack-catalog-field-order-and-helper-links, PR #285) which:
    • moves SLACK_TEAM_ID before SLACK_BOT_TOKEN in the install modal
    • replaces the plain SLACK_TEAM_ID helper text with linked copy:
      'First visit [here](...#find-your-url) to get your Slack URL
       and then visit [here](...#find-your-workspace-or-org-id) to
       get your workspace ID.'
- Removes stale integrity hash from package-lock.json for the
  @openhands/extensions entry; npm install will recompute it.

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: bump @openhands/extensions to d186872 (SLACK_BOT_TOKEN helperText)

Add inline linked helperText for SLACK_BOT_TOKEN in slack.json (PR #285,
commit d186872): 'You'll need to create or update a Slack App as shown
[here](https://github.com/zencoderai/slack-mcp-server#slack-bot-setup).'
Drops the now-redundant helperLink field.

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: bump @openhands/extensions to b45d3a1 (SLACK_TEAM_ID helperText rewrite)

Update SLACK_TEAM_ID helperText to named links:
'First get your [Slack URL](...). Then use that to get your [Workspace ID](...).'

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: bump @openhands/extensions to 84a0a6e (SLACK_BOT_TOKEN named link)

Update SLACK_BOT_TOKEN helperText to:
"You'll need to create or update a [Slack App](...#slack-bot-setup)."

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: bump @openhands/extensions to e07f427 (SLACK_BOT_TOKEN helperText)

Update SLACK_BOT_TOKEN helperText to:
"You'll need to create or update a [Slack App](...) to get a Bot token"

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: bump @openhands/extensions to 5efd1b8

Sync to latest commit on slack-catalog-field-order-and-helper-links (PR #285).

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: bump @openhands/extensions to 952c759

Sync to latest commit on slack-catalog-field-order-and-helper-links (PR #285).

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: bump @openhands/extensions to f30dbfb

Sync to latest commit on slack-catalog-field-order-and-helper-links (PR #285).

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: bump @openhands/extensions to 02715f4

Sync to latest commit on slack-catalog-field-order-and-helper-links (PR #285).

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: bump @openhands/extensions to cb092c8

Sync to latest commit on slack-catalog-field-order-and-helper-links (PR #285).

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(mcp): validate URL scheme in renderHelperText; use matchAll

- Guard href against javascript:/data: XSS via /^https?:\/\//i test
- Replace exec-in-while with matchAll to drop the eslint-disable comment

Addresses review bot feedback on PR #1012.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(mcp): use double quotes for fallback href to satisfy Prettier

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: update @openhands/extensions to latest main (62594156)

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: bump version to 1.0.0-beta.6

* chore: bump version to 1.0.0-beta.7

* fix(mcp): drop duplicate renderHelperText after main merge

* chore: bump version to 1.0.0-beta.8

* docs: update README version to 1.0.0-beta.8

* fix: default LLM setup to Anthropic Claude Opus 4.8 (#1089)

* chore: bump version to 1.0.0-beta.9

* docs: update README version to 1.0.0-beta.9

* docs: update README.windows.md version to 1.0.0-beta.9

* fix(dev): align Vite dev origin with ingress and add chat footer padding

Route modules loaded from :3001 while the app opened on :8000, causing blank
screens on npm run dev. Point Vite server.origin/HMR at the ingress URL and add
bottom spacing under the archived conversation banner footer.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): polish spinners, settings empty states, and archived conversation UX

Remove grey track rings from all loading spinners so only the animated arc
remains visible. Wrap bare settings empty/error messages (SDK schema
unavailable, profile load failures, empty profiles/skills/secrets/MCP) in
the shared bordered empty-state container for visual consistency.

Canonicalize 127.0.0.1 backend URLs to localhost so health probes reach the
ingress proxy instead of Vite HMR on macOS dual-stack dev stacks, and sync
stored default-local backend host alongside the session key.

Disable conversation controls for archived sandboxes (MISSING/ERROR) with
tooltips explaining unavailability, using shared archive-status helpers.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): restore light foreground on conversation tab loading state

Use the semantic text-foreground token for the spinner and label so loading copy stays readable on the dark surface background.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): polish conversation tab loading and automations empty state

Conversation tab loading:
- Use TextShimmer on the loading label (same treatment as message sending)
  with block w-full text-center so the sweep flows across the word, not per
  character
- Keep the spinner on text-tertiary-light for readable secondary grey
- Add ConversationTabContentCrossfade to cross-fade between loading and loaded
  content (agent init and lazy tab chunks); content preloads underneath at
  opacity 0 while the overlay fades out over 350ms; reduced-motion falls back
  to an instant swap

Automations empty state:
- Add a top border above the create-instructions section to separate it from
  the hint copy

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): unify drawer empty/loading states and polish browser/files tabs

Align Changes, VS Code, and runtime waiting states with shared drawer patterns, add browser chrome bar with inactive nav when empty, and improve Files tab empty state and tree toggle icon.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): remove browser screenshot rounding and improve panel fill

Drop rounded corners on the screenshot viewer and use min-h-0 flex layout so the browser tab fills the drawer edge-to-edge and collapses correctly.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): polish protip banner, browser chrome, and tab crossfade

Hide non-functional browser nav controls, restyle the changes-tab protip with icon and muted subtext, drop Customize label colons, and fix Suspense fallback setState during render.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): move VS Code to files toolbar and refresh drawer icons

Relocate editor access from the drawer Code tab into a bordered Files toolbar button, swap tab icons to Lucide, add a terminal empty state, and update the VS Code logo asset.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): animate drawer tab label reveal and icon shifts

Use Framer Motion layout transitions so the active tab label expands in and sibling icons slide smoothly when switching drawer tabs.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): pin VS Code in drawer tab row and fix tab drag animation

Move VS Code to the drawer header, portal the overflow menu so it is not clipped, and disable tab layout animations while resizing the panel so icons only animate on click.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): shrink drawer tab icons to match standard chrome size

Use h-4 w-4 for drawer tab icons so they align with the ellipsis and other inline controls in the top row.

Co-authored-by: Cursor <cursoragent@cursor.com>

* feat(home): allow changing repo, branch, or workspace before launch

Replace static git-control-bar link chips on the home screen with the same
dropdowns used in the open-workspace and open-repository dialogs so users
can revise their selection until they send the first message.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Revert "feat(home): allow changing repo, branch, or workspace before launch"

This reverts commit 569bf18bd18dbbe2bd2eaec5747737a162079e0e.

* refactor: remove unrelated files

* refactor: remove unrelated files

* refactor: remove unrelated files

* refactor: remove unrelated files

* refactor: remove unrelated files

* refactor: vscode tab

---------

Co-authored-by: openhands <openhands@all-hands.dev>
Co-authored-by: Tim O'Farrell <tofarr@gmail.com>
Co-authored-by: Rohit Malhotra <rohitvinodmalhotra@gmail.com>
Co-authored-by: chuckbutkus <chuck@openhands.dev>
Co-authored-by: Hiep Le <69354317+hieptl@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: hieptl <hieptl.developer@gmail.com>
 2026-06-10 12:35:34 +07:00
Rohit Malhotraandopenhands b969162027 test(mock-llm): add E2E coverage for Files tab, Git control bar, and Browser tab (#1029) 
* test(mock-llm): add E2E coverage for Files tab, Git control bar, and Browser tab

Add mock-LLM E2E tests exercising conversation panel tabs and git
integration against the real agent-server:

- Files tab defaults to diff view when a workspace is attached
  (selected_workspace seeded in conversation metadata localStorage)
- Files tab defaults to file-tree view when NO workspace is attached
- Git control bar shows workspace-name pill for folder-attached
  conversations
- Browser tab renders empty state when no page has been browsed

All tests run serial in a single describe block, sharing one
conversation for the workspace-attached cases (steps 3-5) and
creating a fresh conversation for the no-attachment case (step 6).

Issue #511

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(test): reset mock LLM trajectory before each conversation creation

The mock-LLM E2E test failed because the default 2-turn trajectory
was exhausted by preceding test suites (automation, conversation).
After exhaustion every /chat/completions returns 500, so the agent
never produces REPLY_TOKEN and waitForNonUserMessageText times out.

Fix: call resetMockLLM(request) at the top of step 2 and step 6
(before each conversation creation), matching the pattern used by
mock-llm-conversation.spec.ts step 3.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(ci): report timeout instead of '0/0 passed' when test suite is killed

When the CI wrapper kills Playwright after the 5-minute deadline
(exit code 124), no results.json or marker files exist. Previously
the PR comment showed '0/0 passed' with an empty table, which was
misleading.

Now the render script accepts --exit-code from the workflow. When
exit code is 124 and no results exist, it renders a clear timeout
entry: '⏱️ (test suite timed out before completing)' with a note
pointing to workflow logs.

Both mock-llm-e2e.yml and mock-llm-docker-e2e.yml pass the exit
code through.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(test): re-seed workspace metadata in each test step

Each Playwright test() gets a fresh browser context, so localStorage
from step 2 is gone when steps 3-5 run. Extract seedWorkspaceMetadata()
helper and call it in steps 3 and 4 (which assert on workspace-dependent
UI: git control bar name pill and files tab diff-view default).

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(test): assert git control bar buttons instead of workspace name

The agent-server creates conversation worktrees inside the agent-canvas
repo, so git detection always finds the real repo ('OpenHands/agent-canvas')
and the workspace-name fallback ('my-app') never renders. Assert that
Pull/Push buttons are visible instead — these only appear when the git
control bar has successfully detected a repository.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(test): retry ensureMockLLMProfile on transient socket failures

The automation spec's step 1 intermittently fails with 'socket hang up'
on GET /api/settings because the agent-server briefly drops connections
between test suites (while processing cleanup from the previous spec's
afterAll).

Add retryOnTransient() helper that retries up to 5 times (1s delay) on
socket hang up, ECONNRESET, ECONNREFUSED, 502, and 503. Apply it to
both the GET and PATCH calls in ensureMockLLMProfile.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(static-server): handle WebSocket proxy socket errors

The static-server's proxyWebSocket function was missing error handlers
on the piped client/backend sockets. When a WebSocket connection tears
down abruptly during test cleanup (ECONNRESET, EPIPE), the unhandled
'error' event crashes the Node.js process, killing the Docker container
and causing ECONNREFUSED for all subsequent tests.

Add .on('error') handlers to both proxySocket and socket, matching the
pattern already used in ingress.mjs (lines 273-278).

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(test): make git control bar assertion work in npm and Docker

In the npm path the agent-server creates worktrees inside the host repo
so git detection finds 'OpenHands/agent-canvas' and shows Pull/Push
buttons. In the Docker path there's no git repo inside the container,
so the git control bar only shows the workspace name pill.

Use Playwright's locator.or() to assert on whichever indicator appears:
Pull button (npm) or workspace basename text (Docker). Re-add
seedWorkspaceMetadata so the Docker path has a workspace name to show.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(test): use git-init trajectory for cross-environment git detection

Instead of making the test assertion fuzzy, ensure the conversation
workspace is always a proper git repo. Register a custom trajectory
that runs 'git init && git commit' when no repo exists (Docker path)
and skips init when already inside a git worktree (npm path).

This lets the git control bar consistently show Pull/Push buttons in
both environments, making the assertion deterministic.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(test): add git remote in trajectory for Pull/Push button detection

The git control bar shows Pull/Push only when it can parse a
provider+repository from 'git remote get-url origin'. A bare git init
without a remote means the buttons never appear.

Update the trajectory to add a fake GitHub remote when bootstrapping
a new repo (Docker path). Skip when the workspace already has an
origin remote (npm path — inherits the host repo).

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(test): fix shell syntax in git bootstrap trajectory

The if/then/else joined with spaces produced invalid bash: 'then true
else' (missing semicolons). Rewrite using || operator which avoids
the issue entirely. Also increase Pull button timeout to 25s since
useLocalGitInfo polls every 10s.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(test): assert workspace pill as primary gate, soft-check Pull/Push

The useLocalGitInfo probe requires a connected bash WebSocket that may
not be available in Docker after agent completion. The workspace pill
('my-app') is the primary user-facing behavior for folder-attached
conversations and renders reliably from localStorage.

Make the workspace pill the hard assertion (primary gate). Treat
Pull/Push buttons as a soft check that logs a message instead of
failing when the git probe hasn't completed in time.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(test): increase diff toggle assertion timeout for Docker API latency

The toHaveAttribute('aria-checked', 'true') assertion had only a 5s
timeout. useHasAttachedSource depends on useActiveConversation fetching
the conversation API first — in Docker the round-trip can be slower.
Increase to 15s so the React Query response has time to arrive and
trigger the re-render that flips the toggle.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(test): configure git user in Docker trajectory for commit to work

git commit --allow-empty fails in Docker containers without user.name
and user.email configured. Add git config commands to the bootstrap
trajectory so the initial commit actually creates a HEAD ref.

Without a valid commit, useHasGitCommits returns false and the diff
toggle defaults to off — matching the design ('no commits means no
diff base') but not the test expectation.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(test): make diff toggle test environment-agnostic

In Docker, useHasGitCommits may not fire (workspace.working_dir may
be absent or the bash probe may not execute for finished conversations).
This causes the diff toggle to default to 'off' instead of 'on'.

Rather than asserting a specific default, verify:
1. Both toggle options render (diff on / diff off)
2. Clicking 'on' switches the toggle to checked state

This still exercises the full Files tab rendering pipeline and toggle
interactivity without being fragile to the git probe's environment
dependencies.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(test): add animation waits before panel/tab interactions

The right panel uses a 300ms CSS transition. Clicking the diff toggle
immediately after opening the panel causes click interception by the
animation overlay in Docker. Add explicit waits after panel open and
tab switch clicks.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(test): robust panel/tab/toggle waits + force click in step 4

- Wait for tab bar visibility (proves panel animation completed)
- Wait for diff toggle itself (not the files-tab container which may
  be 'hidden' during CSS transition)
- Use force click to bypass residual animation overlay
- Simplify into a single test.step

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(e2e): use parent toggle container instead of .or() to avoid strict mode violation

The SegmentedToggle renders both option buttons simultaneously as a
radio group. Using .or() on two always-visible elements triggers
Playwright's strict mode ('resolved to 2 elements'). Wait for the
parent radiogroup container (files-tab-diff-toggle) instead.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(e2e): wait for diff toggle instead of files-tab container in step 6

The files-tab main container reports 'hidden' during the right-panel
drawer animation. Wait for the inner diff toggle radio group (same
approach as step 4) which is visible once the tab content renders.

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: address review feedback — trim verbose comments, fix dead code

- Trim seedWorkspaceMetadata JSDoc to keep only the addInitScript timing note
- Remove self-evident 're-seed' comments in steps 3 and 4
- Trim step 1 trajectory block comment to two lines
- Remove step 2 seed rationale comment (function name is sufficient)
- Remove box-header section dividers added in this PR
- Fix unreachable throw in retryOnTransient via lastError pattern
- Tighten retryOnTransient JSDoc to just list the retried conditions

Co-authored-by: openhands <openhands@all-hands.dev>

* ci: increase Docker E2E timeout from 15 to 25 minutes

The 15-minute job timeout is too tight for PR-triggered runs that must
first wait for the Docker workflow to complete (up to ~5 min) and then
pull the image (up to ~12 min with a cold runner cache), leaving no
room for setup and test execution.

Successful PR runs already take 12-13 minutes typically. With an
unlucky cold Docker cache (observed on the 04:11 UTC run for PR 1029),
the image pull alone took 11+ minutes, causing the job to hit the
15-minute timeout before tests even started.

Increasing to 25 minutes provides sufficient headroom for:
- Docker workflow wait: ~3-5 min typical
- Docker image pull (cold cache): up to ~12 min
- Test infrastructure setup: ~2 min
- Playwright test execution: ~6-7 min

Co-authored-by: openhands <openhands@all-hands.dev>

* Apply suggestion from @malhotra5

---------

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-06-09 15:39:15 -04:00
chuckbutkusandopenhands f93cb3c9ee settings: persist app preferences and disabled_skills on the agent-server (#1191) 
* settings: persist app preferences and disabled_skills on the agent-server

The local agent-server now exposes app_preferences on the persisted
settings (OpenHands/software-agent-sdk#3539): language, sound
notifications, analytics consent, git identity, and disabled_skills are
returned on GET /api/settings under app_preferences and updated via a
new app_preferences_diff field on PATCH /api/settings.

This brings the local agent-server to parity with the cloud, which has
always accepted the same keys at the top level. Drops the localStorage
workaround that mirrored these fields in two keys
(openhands-agent-server-app-preferences and
openhands-agent-server-disabled-skills), along with the
app-preferences-store.ts module and the DISABLED_SKILLS_STORAGE_KEY
helpers it depended on.

- SettingsService.transformApiResponse reads app_preferences from the
  server response and hoists each field onto the flat Settings shape so
  consumers (settings.language, settings.disabled_skills, …) keep
  working unchanged.
- SettingsService.saveSettings routes the same set of fields through
  the new app_preferences_diff for local backends and through the
  existing app_preferences flat-spread path for cloud backends.
- New legacy-app-preferences-migration.ts runs once on first
  getSettings() after upgrade: when the server reports an
  app_preferences block AND legacy localStorage values are still
  present, it pushes them up via app_preferences_diff and clears the
  legacy keys. Pre-1.27 servers (which omit app_preferences entirely)
  cause the migration to no-op so existing data isn't dropped before
  the server can accept it.
- Updated MSW handlers to round-trip app_preferences and
  app_preferences_diff so the mock backend matches production.
- Test coverage: 5 new tests in __tests__/api/settings-service.test.ts
  for the local round-trip, the mixed diff routing, the legacy
  migration, and the pre-1.27 skip path.

Closes the localStorage workaround called out in the recent audit of
agent-canvas localStorage usage (items 3 and 4: disabled_skills and
app-preferences fields).

Depends on agent-server 1.27 / SDK PR #3539.

Co-authored-by: openhands <openhands@all-hands.dev>

* settings: read/write app preferences via misc_settings container

Follow-up to the localStorage cleanup in this PR + SDK refactor in
openhands/software-agent-sdk#3543. The agent-server now exposes
frontend-owned settings under a generic misc_settings container instead
of a top-level app_preferences field.

Wire shape changes:

  Before:                                 After:
  GET /api/settings                       GET /api/settings
    -> { app_preferences: {...} }           -> { misc_settings: { app_preferences: {...} } }

  PATCH /api/settings                     PATCH /api/settings
    body.app_preferences_diff (shallow      body.misc_settings_diff (deep-merged,
    overlay, replaces named fields)         same semantics as agent_settings_diff)

Why the rename to misc_settings: the previous name pinned the API to a
single 'frontend-owned' namespace. Adding a future category like
ui_preferences (sidebar layout / view modes) would have required either
yet another top-level field or shoehorning unrelated UI state into
AppPreferences. With misc_settings as a container, new categories drop
in as nested fields without churning the top-level shape.

Changes:

- settings-service.api.ts
  * SettingsApiResponse.app_preferences -> .misc_settings (typed)
  * SettingsUpdateRequest.app_preferences_diff -> .misc_settings_diff
  * Add MiscSettings interface
  * transformApiResponse reads response.misc_settings?.app_preferences
  * saveSettings emits { misc_settings_diff: { app_preferences } }
  * Local 'has any diffs' check tracks misc_settings_diff
  * Doc comments updated; semantics noted as deep-merge
- legacy-app-preferences-migration.ts
  * Gate on serverResponse.misc_settings, not .app_preferences
  * pushDiff callback now wraps the diff in { app_preferences: ... }
- src/mocks/settings-handlers.ts
  * GET handler returns misc_settings.app_preferences
  * PATCH handler accepts misc_settings_diff; deep-merges nested
    app_preferences into the persisted block
  * Internal mock state stores under misc_settings to match wire shape
- __tests__/api/settings-service.test.ts
  * Four tests updated to assert the new wire shape (local PATCH body,
    GET round-trip, mixed-diff routing, legacy localStorage migration)
  * Pre-1.27 detection test now keys off missing misc_settings
- AGENTS.md
  * App-preferences note rewritten for the misc_settings container,
    explains deep-merge semantics, and documents the in-flight rename
    (flat shape introduced in #3539 never shipped to users)

Cloud path is unchanged: cloud /api/v1/settings still accepts the
fields as flat top-level keys, mirrored by saveCloudSettings.

Verification:

  $ npm run typecheck
  exit 0

  $ npm test -- __tests__/api/settings-service.test.ts \
                __tests__/api/mock-settings-handlers.test.ts
  23 tests passed

  $ npm test
  3009 passed | 12 skipped | 9 todo

  $ npm run lint
  All matched files use Prettier code style!

  $ npm run build
  built in 1.50s

Co-authored-by: openhands <openhands@all-hands.dev>

* Bump agent-server default to 1.27.0

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-06-09 18:53:13 +00:00
Rohit Malhotraandopenhands 8c2cc3997d fix: GitHub MCP server works in Docker without Docker-in-Docker (#1282) 
* fix: GitHub MCP server works in Docker without Docker-in-Docker

The GitHub MCP catalog entry uses `docker run` as its transport command,
which fails inside the agent-canvas Docker container because Docker is not
available (no daemon, no CLI). This is the only MCP integration affected —
all others use `npx` or `uvx`.

Fix:
- Pre-install the `github-mcp-server` Go binary in the Docker image via a
  new multi-arch download stage (supports amd64/arm64)
- Export `getDeploymentMode()` from agent-server-adapter to expose the
  runtime services info mode ("docker", "dev:automation", etc.)
- Add `patchGitHubEntry()` in mcp-marketplace-utils.ts that rewrites the
  catalog entry from `docker run … ghcr.io/github/github-mcp-server` to
  `github-mcp-server stdio` when deployment mode is "docker"
- The patch follows the existing `patchLinearEntry` pattern: immutable
  spread, conditional on entry id, wired into `getMcpMarketplaceCatalog()`

Closes #1190

* docs: document GitHub MCP catalog patching in AGENTS.md

Co-authored-by: openhands <openhands@all-hands.dev>

* test: add E2E test for GitHub MCP install flow via marketplace UI

Exercises the full MCP page UI flow:
- Navigate to /mcp, verify GitHub marketplace card is visible
- Open install modal, verify fields (command, PAT input)
- Validate empty PAT shows error
- Fill PAT, submit with mocked /api/mcp/test success, verify installed
- Delete installed server via toggle + confirmation modal

Intercepts POST /api/mcp/test to return mock success since the real
github-mcp-server binary is not available in the test environment.

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: track github-mcp-server version in config/defaults.json

Move the hardcoded GITHUB_MCP_SERVER_VERSION=1.2.0 from the Dockerfile
default into config/defaults.json (versions.githubMcpServer) alongside
the other external dependency pins.

- Dockerfile: ARG no longer has a default; CI and local builds must
  pass it explicitly
- docker.yml: reads the version from config and passes it as a build-arg
- docker-build.mjs: reads the version from config and passes it too

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: correct GitHub MCP binary download URL and remove flaky validation test

- Fix Dockerfile: release assets use github-mcp-server_Linux_{arch}.tar.gz
  (no version in the filename), not github-mcp-server_{version}_Linux_{arch}.tar.gz
- Remove step 3 (empty PAT validation test) which relied on CSS class
  selector that doesn't work reliably in Playwright with compiled Tailwind
- Renumber remaining steps (4→3, 5→4)

Co-authored-by: openhands <openhands@all-hands.dev>

* docs: address review comments — document docker command assumption and arch fallback

- mcp-marketplace-utils.ts: explain why we match on command === 'docker'
  and what happens if upstream changes the catalog entry
- Dockerfile: document the *) arch fallback and when to update it

Co-authored-by: openhands <openhands@all-hands.dev>

* test: assert Docker-specific command patching in GitHub MCP E2E test

The test now asserts the command field value based on the deployment mode:
- Docker E2E: expects 'github-mcp-server stdio' (native binary)
- npm E2E: expects 'docker' (original catalog transport)

Uses MOCK_LLM_DOCKER_IMAGE env var presence (set only by the Docker
Playwright config) to determine which assertion to make. This ensures
the patchGitHubEntry runtime rewrite is exercised in Docker E2E.

Co-authored-by: openhands <openhands@all-hands.dev>

* test: add unit tests for patchGitHubEntry Docker command rewrite

Addresses review feedback to add unit test coverage for the runtime
catalog patching. Three new tests via getMcpMarketplaceCatalog:
- Non-Docker mode: GitHub entry keeps original 'docker run' command
- Docker mode: command rewritten to 'github-mcp-server stdio'
- Docker mode: other entries (Tavily) unaffected

Uses vi.mock to control getDeploymentMode return value.

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-06-09 14:08:40 -04:00
Rohit MalhotraopenhandsJoe Laverty
 		c39354f2b3 feat: load public skills from @openhands/extensions npm package (#1199) 
* build(deps): move @openhands/extensions to npm 0.2.0

* feat: load public skills from @openhands/extensions npm package

Public skills are now loaded from the @openhands/extensions npm package
via a standard JS module import instead of fetching them through the
agent-server (which cloned the extensions GitHub repo at runtime).

  import { SKILLS_CATALOG } from '@openhands/extensions/skills';

SkillsService maps each SkillCatalogEntry to a SkillInfo and merges the
bundled public catalog with user/project skills fetched from the
agent-server (load_public: false). If the agent-server is unreachable,
the bundled catalog is returned alone.

Changes:
- SkillsService: imports SKILLS_CATALOG from @openhands/extensions/skills,
  maps entries to SkillInfo, merges with user/project skills from
  agent-server (load_public: false).
- agent-server-adapter: hardcodes load_public_skills: false in
  buildAgentContext().
- agent-server-config: removes shouldLoadPublicSkills() and its
  VITE_LOAD_PUBLIC_SKILLS env var.
- dev-safe.mjs: removes getExtensionsRef() / DEFAULT_EXTENSIONS_REF
  and EXTENSIONS_REF injection in buildAgentServerEnv().
- Docker: removes CONFIG_EXTENSIONS_REF from config-gen stage and
  EXTENSIONS_REF from entrypoint.sh.
- .env.sample: removes VITE_LOAD_PUBLIC_SKILLS comment.
- Tests updated to match new architecture.

Depends on OpenHands/extensions#310 which adds the SKILLS_CATALOG export.

Co-authored-by: openhands <openhands@all-hands.dev>

* test: remove activated_skills assertion from preset-automation E2E

With load_public_skills: false the agent-server no longer loads public
skills at runtime, so activated_skills is always empty. The conversation
itself works (slash command sent, agent replies) — only the server-side
skill activation metadata is gone.

Co-authored-by: openhands <openhands@all-hands.dev>

* feat: pass bundled public skills via agent_context.skills for SDK-side activation

Instead of doing frontend-side trigger matching, pass the bundled
SKILLS_CATALOG entries directly in agent_context.skills at conversation
start. The SDK performs trigger matching, sets activated_skills on user
events, and injects skill content into the system prompt — the exact
same behavior as when load_public_skills was true, but without cloning
the extensions repo at runtime.

buildBundledSkills() converts each catalog entry into the SDK Skill JSON
shape with KeywordTrigger ({ type: 'keyword', keywords: [...] }) for
skills with triggers, or null for always-active skills.

Restores the activated_skills E2E assertion in the preset-automation
test since the SDK now handles activation.

Co-authored-by: openhands <openhands@all-hands.dev>

* test: add E2E tests for project/user skill loading and deletion

Add mock-llm-skills.spec.ts with three tests:
1. Project skill in workspace/.agents/skills/ triggers on matching keyword
2. User skill in ~/.openhands/skills/ triggers on matching keyword
3. Deleting a user skill removes it from subsequent conversations

Tests create ephemeral SKILL.md files with unique trigger keywords,
send messages through the real agent-server stack, and verify
activated_skills in the conversation events API.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: use explicit APIRequestContext type import for CI TS6 compatibility

Replace inline `import('@playwright/test').APIRequestContext` type
references with a proper top-level type import. Also align afterEach
fixture destructuring with other specs' pattern.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: remove node: prefix from imports to fix CI TS resolution

TypeScript 6 on CI (Node 24) has a type resolution conflict when
`node:` prefixed imports (node:path, node:fs, node:os) coexist with
`@playwright/test` types in the same file. This caused
`APIRequestContext` to be incorrectly resolved as `Page`. Use
unprefixed imports (path, fs, os) which work identically in Node.js.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: split fs helpers into separate file to fix CI TS6 type resolution

Move node built-in imports (path, fs, os) and filesystem helpers to
`utils/skill-test-helpers.ts`. The spec file now only imports from
`@playwright/test` and the two helper modules, avoiding the type
resolution conflict between node builtins and Playwright fixture types
that caused `APIRequestContext` to be incorrectly inferred as `Page`
on CI (TypeScript 6 / Node 24 / Ubuntu).

API assertion logic is now inline within each test step, using the
`request` fixture directly instead of standalone functions with
explicit `APIRequestContext` type annotations.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: use namespace imports to avoid TS6 type inference issue

Switch from named imports to namespace imports (`import * as helpers`)
with subsequent destructuring. This changes how TypeScript resolves the
imported function signatures, avoiding a Node 24 / TS6 type inference
bug where `ensureMockLLMProfile` was incorrectly resolved as expecting
`Page` instead of `APIRequestContext`.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: add typed wrapper for ensureMockLLMProfile to fix CI TS2345

Add a local `configureMockLLM` wrapper with an explicit
`APIRequestContext` type annotation. This works around a CI-specific
TypeScript 6 type inference issue where the imported
`ensureMockLLMProfile` signature is incorrectly resolved as expecting
`Page` instead of `APIRequestContext` when called from a Playwright
test body that also imports from `skill-test-helpers` (a module with
node built-in imports). The wrapper's explicit type annotation forces
correct type checking at the call site.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: inline ensureMockLLMProfile logic to fix CI TS2345

Instead of importing ensureMockLLMProfile from mock-llm-helpers (which
triggers a CI-specific TS6 type inference bug when combined with
skill-test-helpers imports), inline the same logic as a local function
with explicit APIRequestContext typing. This avoids the cross-module
type resolution issue entirely.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: resolve WORKSPACE_DIR relative to agent-server CWD, not STATE_DIR

The agent-server resolves the relative working_dir ("workspace/project")
from its own CWD (the project root), not from STATE_DIR/workspaces.
The test was writing skill files to the wrong directory so the SDK
never found them, causing activated_skills to be empty.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: create standalone git repo for project skill E2E test

The agent-server creates a git worktree for each conversation, and only
committed files appear in worktrees. The previous approach wrote skill
files to the filesystem without committing them, so the worktree never
contained them and load_project_skills found nothing.

Now the test:
1. Creates a standalone git repo (.tmp/mock-llm-skill-repos/) with the
   skill file committed
2. Creates the conversation via API with that repo as working_dir
3. The agent-server worktree includes the committed skill
4. load_project_skills discovers it in the worktree

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: add secrets_encrypted flag to skill test conversation creation

The GET /api/settings with X-Expose-Secrets: encrypted returns cipher-
encrypted secret values. The POST /api/conversations needs
secrets_encrypted: true to tell the server to decrypt them, otherwise
the request fails with HTTP 422.

Co-authored-by: openhands <openhands@all-hands.dev>

* refactor: use UI workspace selection for project skill E2E test

Instead of creating conversations via API (bypassing the frontend code),
the test now exercises the full UI flow:

1. Creates a standalone git repo with the skill committed
2. Registers the repo as a workspace via POST /api/workspaces
3. Opens the 'Open workspace' dialog in the UI
4. Selects the workspace from the dropdown
5. Types the message and submits via the chat input

This exercises the actual frontend code paths (workspace dropdown,
workspace selection form, createConversation with workingDirOverride)
that real users go through.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: add padding response for skill-analysis in deletion test

The agent-server makes a skill-analysis LLM call even when no user/project
skills are loaded, because public skills from the npm package are still
present. The deletion test only had 1 trajectory response, causing the
agent to hang waiting for the 2nd response (the actual reply).

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: simplify deletion test to not depend on specific event type

The deletion test was failing because it waited for an event with
source='agent' and event_type='message' in the events API, but the
mock LLM text reply may produce a different event type. Since
waitForNonUserMessageText already confirms the agent replied in the
UI, we just need to verify no activated_skills contains the deleted
skill name.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: mount skill test dirs into Docker container for e2e tests

The Docker E2E skills test was failing because the agent-server inside
the Docker container couldn't access skill repos and user skill files
created on the host filesystem.

Fix by:
- Adding volume mounts for skill repos (.tmp/mock-llm-skill-repos/ →
  /tmp/mock-llm-skill-repos/) and user skills (.tmp/mock-llm-user-skills/
  → /home/openhands/.openhands/skills/) to the Docker run command
- Setting env vars (MOCK_LLM_SKILL_REPOS_CONTAINER_DIR,
  MOCK_LLM_USER_SKILLS_HOST_DIR) so skill-test-helpers.ts can
  distinguish host-side vs agent-side paths
- Updating createProjectSkillRepo to return both hostDir and agentDir
  so the test registers the container-side path with the agent-server

In npm mode (no env vars set), all paths fall back to the existing
host-side values — no behavior change for the npm test path.

Co-authored-by: openhands <openhands@all-hands.dev>

* docs: document Docker skill test volume mounts in AGENTS.md

Co-authored-by: openhands <openhands@all-hands.dev>

* feat: mark newly added mock-LLM E2E tests with 🆕 badge in PR comments

The render-mock-llm-report.mjs script now accepts a --new-files flag
with a comma-separated list of spec file paths added in the PR. Tests
from those files get a 🆕 badge in the results table, and the summary
line shows the count (e.g. '🆕 2 new').

Both CI workflows (mock-llm-e2e.yml and mock-llm-docker-e2e.yml) add
a 'Detect newly added spec files' step that queries the GitHub API
for files with status=='added' matching the mock-LLM spec pattern,
avoiding shallow-clone issues with git diff.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: match Playwright basename file paths against repo-relative --new-files

Playwright's JSON reporter emits file paths relative to testDir
(e.g. 'mock-llm-skills.spec.ts') while the GitHub API returns
repo-relative paths (e.g. 'tests/e2e/mock-llm/mock-llm-skills.spec.ts').
The isNewTest() matcher now compares basenames in addition to exact/suffix
matching, so 🆕 badges render correctly.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: stabilize pagination loading-indicator test + improve new-test callout

1. Flaky test fix: the 'loads older events when scrolling up' test
   asserts that the loading-older-events indicator appears, but the
   instant mock response lets React batch isLoading true→false in one
   commit — the DOM element never materialises. Add a 300ms delay to
   older-events mock responses so the indicator renders reliably.

2. Better new-test visibility: replace the subtle inline 🆕 emoji with
   a prominent green blockquote callout above the results table that
   lists each new test with its status icon and spec file.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: address PR review — type safety, docs, test assertions

1. Define BundledSkill interface for buildBundledSkills() return type
   instead of the opaque SettingsRecord[] (review thread #1).

2. Document PUBLIC_SKILLS as an immutable build-time snapshot that is
   baked into the bundle and requires a dependency bump to update
   (review thread #2).

3. Add migration note to buildAgentContext() explaining that the former
   VITE_LOAD_PUBLIC_SKILLS env var was removed because bundled skills
   have no clone latency. load_public_skills: false is still passed to
   tell the SDK to skip its own clone (review thread #3).

4. Add structural assertions for individual skill entries in the adapter
   test: name, content, source, is_agentskills_format, and trigger
   shape (review testing gap).

5. Update stale VITE_LOAD_PUBLIC_SKILLS comments in E2E test files.

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: Joe Laverty <joe.laverty@openhands.dev>
Co-authored-by: openhands <openhands@all-hands.dev>
 2026-06-07 21:52:59 +00:00
Tim O'Farrellandopenhands cca79d096e chore: bump software-agent-sdk to 1.26.0 (#1186) 
Update agentServer version pin in config/defaults.json from 1.25.0 to 1.26.0.
This drives all four packages (openhands-agent-server, openhands-sdk,
openhands-tools, openhands-workspace) which are released in lockstep.

Also update matching test expectations and example version strings in
dev-safe.mjs, check-sdk-version-sync.mjs, and AGENTS.md.

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-06-05 11:47:43 -06:00
Tim O'Farrellandopenhands 90754e2571 feat: add daily-rotating file logger for dev scripts (closes #815) (#1181) 
* feat: add daily-rotating file logger for dev scripts (issue #815)

Add winston + winston-daily-rotate-file to write all dev-server log
output to logs/agent-canvas.YYYY-MM-DD.log alongside the existing
console output (which is unchanged).

- scripts/logger.mjs  — shared module; exports fileLog(level, msg)
  and stripAnsi(str). DailyRotateFile transport stores files in
  logs/ relative to the project root, rotates at midnight, and
  auto-deletes files older than 7 days.
- scripts/dev-with-automation.mjs — logService / logStep /
  logSuccess / logError each call fileLog as a side-channel. The
  shutdown message, startup title, checkPrerequisites uvx-error, and
  printBanner summary are also captured.
- scripts/dev-safe.mjs — spawnProcess errors, main() startup lines,
  the unexpected-exit error, and the fatal-error handler all call
  fileLog.
- logs/ was already in .gitignore.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: store log files in agent-canvas state dir, not project root

Use OH_CANVAS_SAFE_STATE_DIR (or ~/.openhands/agent-canvas as
the default) to match where all other agent-canvas runtime state
lives, e.g. ~/.openhands/agent-canvas/logs/agent-canvas.YYYY-MM-DD.log

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-06-05 10:34:30 -06:00
Tim O'Farrellandopenhands dda46c10bd feat: default EXTENSIONS_REF from pinned @openhands/extensions SHA in package.json (#1060) 
* feat: default EXTENSIONS_REF from pinned @openhands/extensions SHA in package.json

The agent-server polls the OpenHands extensions repo using EXTENSIONS_REF
(defaulting to 'main'), while the frontend bundles the MCP catalog and
automations data from a pinned commit SHA in package.json. This caused the
two to silently diverge — skills loaded at runtime were from latest main
while the UI showed catalog data from an older commit.

Fix: derive a DEFAULT_EXTENSIONS_REF from the '#<sha>' fragment in the
@openhands/extensions git URL in package.json and inject it as the agent-
server's EXTENSIONS_REF when the caller hasn't set it explicitly.

- scripts/dev-safe.mjs: getExtensionsRef() helper reads package.json at
  module init; buildAgentServerEnv() spreads EXTENSIONS_REF into the
  child-process env unless the caller already set it.

- docker/Dockerfile (config-gen stage): reads package.json alongside
  config/defaults.json and emits CONFIG_EXTENSIONS_REF=<sha> into
  defaults.env when the dependency uses a pinned git SHA.

- docker/entrypoint.sh: applies CONFIG_EXTENSIONS_REF as the default via
  EXTENSIONS_REF="${EXTENSIONS_REF:-${CONFIG_EXTENSIONS_REF:-}}".

User-supplied EXTENSIONS_REF always takes precedence in both paths.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: address review bot comments on EXTENSIONS_REF sync

- entrypoint.sh: guard EXTENSIONS_REF export so an absent CONFIG_EXTENSIONS_REF
  never sets the variable to an empty string (which would defeat the
  agent-server's own 'main' default in os.environ.get('EXTENSIONS_REF','main'))
- scripts/dev-safe.mjs: getExtensionsRef() now checks devDependencies as
  fallback when @openhands/extensions is not in dependencies
- docker/Dockerfile config-gen stage: same devDependencies fallback
- AGENTS.md: replace internal constant name DEFAULT_EXTENSIONS_REF with the
  actual env var EXTENSIONS_REF; also note the empty-string guard

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: pre-seed extensions cache when EXTENSIONS_REF is a commit SHA

The SDK's git clone --depth 1 --branch <sha> fails because --branch only
accepts branch/tag names, not raw 40-char commit SHAs (GitHub returns
'fatal: Remote branch <sha> not found').

When EXTENSIONS_REF is a commit SHA, pre-seed the public-skills cache with
a plain full git clone + checkout before starting the agent-server:

- docker/entrypoint.sh: pre-seeds after EXTENSIONS_REF is exported; is a
  no-op when the cache already exists or EXTENSIONS_REF is a branch/tag name
- scripts/dev-safe.mjs: exports preseedExtensionsCache() and
  DEFAULT_EXTENSIONS_REF; calls pre-seed in main() before spawning the
  agent-server; guards with the same SHA regex as entrypoint.sh
- scripts/dev-with-automation.mjs: imports preseedExtensionsCache and
  DEFAULT_EXTENSIONS_REF from dev-safe.mjs; calls pre-seed in
  startAgentServer() before spawnService()

The SDK's update path (fetch + git checkout) can handle SHAs once the
repo exists, so this is sufficient without any SDK changes.

Co-authored-by: openhands <openhands@all-hands.dev>

* refactor(docker): bake extensions clone into image, cp at runtime

Move the git clone for the pinned extensions SHA from the entrypoint
into a dedicated Dockerfile build stage (extensions-cache).

Why: the clone is deterministic (same SHA for a given image), so doing
it once at build time is cheaper than doing it on first container start.
It also avoids network access at runtime entirely for Docker users.

How:
- New extensions-cache stage (node:24-slim + git): reads package.json,
  clones OpenHands/extensions, checks out the pinned SHA into
  /tmp/public-skills. When the dependency is not SHA-pinned the stage
  exits early with an empty directory (graceful no-op).
- Final stage: COPY --from=extensions-cache stores the result at
  /opt/agent-canvas/extensions-cache/ — outside the
  /home/openhands/.openhands VOLUME so it is not hidden by bind-mounts.
  chown passes ownership to openhands.
- entrypoint.sh: replaces git clone + checkout with cp -r from the
  pre-baked path. The guard checks [ -d "${_ext_baked}/.git" ] so
  the block is a no-op when the stage produced an empty directory.

The npm-dev preseedExtensionsCache() path in dev-safThe npm-dev preseedExtensionsCache() path in d — that still clones over the
network on first run (build-time baking does not apply to npm dev).

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(extensions-preseed): handle existing shallow clone missing the pinned SHA

When `npm run dev` has been run previously without the PR, the agent-server
SDK creates a shallow clone of the extensions repo via:
  git clone --depth 1 --branch main

After PR #1060 is applied, `EXTENSIONS_REF` is set to the 40-char pinned
SHA. The SDK then tries `git checkout <sha>` against that shallow clone,
which fails because the specific commit is not in its shallow history.

`preseedExtensionsCache` had a blind early-return when `.git` already
existed, trusting the "SDK update path" to handle it. But the SDK's update
path also does a plain `git checkout <sha>` and cannot succeed on a shallow
clone that lacks the commit.

Fix: before returning early, verify the SHA is accessible with
  git cat-file -t <sha>
If it returns anything other than "commit", the cache is a shallow clone
that pre-dates the pinned commit. Unshallow the existing clone with
  git fetch --unshallow
so the full history is available, then checkout the SHA.

Co-authored-by: openhands <openhands@all-hands.dev>

* refactor(extensions): copy from node_modules on npm, always overwrite cache

Implement the intended architecture for extensions cache seeding:

npm path (dev-safe.mjs / dev-with-automation.mjs):
- Replace preseedExtensionsCache (git clone approach) with
  copyExtensionsToSkillsCache, which copies the already-installed
  node_modules/@openhands/extensions directly into the skills cache.
  No network call required — npm already installed the package at
  the pinned SHA.
- Always overwrite the cache (rm -rf + cpSync) so stale files from a
  prior run that used a different version are never left behind.
- Set EXTENSIONS_REF unconditionally in buildAgentServerEnv so it
  always matches the pre-seeded cache content.

Docker path (docker/entrypoint.sh):
- Always copy /opt/agent-canvas/extensions-cache into the skills cache
  (rm -rf + cp -r), removing the prior guard that skipped the copy when
  .git already existed.
- Set EXTENSIONS_REF unconditionally from CONFIG_EXTENSIONS_REF.

Both paths accept that the SDK will warn 'Using cached version' for a
raw commit SHA — that warning is the expected fallback until SDK polling
is disabled in a follow-up PR.

Note: the npm package only publishes integrations/ and automations/.
Docker's baked full clone also includes marketplaces/, plugins/, skills/.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(extensions): delete stale cache on npm startup instead of copying files

The copy-from-node_modules approach was still broken: the npm package has no
.git directory, so the SDK tried a fresh 'git clone --depth 1 --branch <sha>'
on top of the already-populated directory and got confused.

Simpler fix: just delete ~/.openhands/cache/skills/public-skills on startup.
The SDK starts with a clean slate and attempts its normal clone; for a raw SHA
ref it will warn 'Using cached version' which is the accepted fallback until
SDK polling is disabled in a follow-up PR.

- Replace copyExtensionsToSkillsCache (copy from node_modules) with
  clearExtensionsCache (delete the directory)
- Remove now-unused cpSync import
- Docker path unchanged (baked clone always copied by entrypoint.sh)

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(extensions): always delete cache; only set EXTENSIONS_REF if not in env

Three simple rules:
1. Always delete ~/.openhands/cache/skills/public-skills on startup so the
   SDK clones fresh — no conditional on DEFAULT_EXTENSIONS_REF.
2. Only inject EXTENSIONS_REF into the agent-server env when the caller has
   not already set it (restore the !process.env.EXTENSIONS_REF guard).
3. Let the agent-server SDK do its own cloning from there.

Co-authored-by: openhands <openhands@all-hands.dev>

* feat(extensions): use OH_PUBLIC_SKILLS_PATH to bypass git polling

Switch from EXTENSIONS_REF (which still went through the SDK's broken
git clone --branch <sha> path) to OH_PUBLIC_SKILLS_PATH, introduced in
software-agent-sdk PR #3513. When set, the SDK skips all git operations
and loads public skills directly from the given directory.

npm path (dev-safe.mjs / dev-with-automation.mjs):
- Add cloneExtensionsForSkillsCache(sha, cacheDir): does a targeted
  git fetch --depth=1 origin <sha> into ~/.openhands/cache/skills/public-skills.
  Reuses the existing directory when it already contains the right commit.
- buildAgentServerEnv now sets OH_PUBLIC_SKILLS_PATH (not EXTENSIONS_REF)
  pointing at that directory when DEFAULT_EXTENSIONS_REF is known and
  OH_PUBLIC_SKILLS_PATH is not already in the environment.

Docker path (docker/entrypoint.sh):
- Removes EXTENSIONS_REF export entirely.
- After copying the baked clone to the skills cache, exports
  OH_PUBLIC_SKILLS_PATH pointing at that directory.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(dev): include openhands-sdk in git-ref uvx args

When OH_AGENT_SERVER_GIT_REF is set, openhands-sdk was missing from the
--with args, so uv fell back to the released PyPI version. That version
lacks the public_skills_path parameter added to update_skills_repository
in SDK PR #3513, so the agent-server's skills_service called the old SDK
path and did a plain git clone of 'main' — overwriting the SHA-pinned
clone our cloneExtensionsForSkillsCache had just created.

Fix: add --with git+<repo>@<ref>#subdirectory=openhands-sdk alongside the
existing openhands-tools and openhands-workspace entries, matching what
the PyPI and local paths already do for openhands-sdk.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(dev): add --reinstall to git-ref uvx command

When OH_AGENT_SERVER_GIT_REF points at a branch whose version string
matches the current PyPI release (e.g. both are 1.25.0), uv silently
reuses the cached PyPI wheels and the git ref is never used.

--reinstall forces uv to build a fresh environment from the specified
git sources regardless of what is already cached. The git clone itself
is still cached in ~/.cache/uv/git-v0/, so only the first run after a
ref change pays the full network cost.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: rename OH_PUBLIC_SKILLS_PATH to PUBLIC_SKILLS_PATH

Aligns with the env var name used by the SDK PR.

Co-authored-by: openhands <openhands@all-hands.dev>

* test: update dev-safe buildAgentServerCommand tests for --reinstall and openhands-sdk

The git-ref path now adds --reinstall (so uv doesn't silently reuse cached
PyPI wheels) and includes openhands-sdk as a --with package so inter-package
APIs stay in sync. Update the two affected toEqual assertions to match.

Co-authored-by: openhands <openhands@all-hands.dev>

* refactor: use EXTENSIONS_REF instead of PUBLIC_SKILLS_PATH for extensions pinning

The PUBLIC_SKILLS_PATH / cloneExtensionsForSkillsCache approach was considered
but not chosen. EXTENSIONS_REF is the variable the agent-server SDK uses, and
it now skips network polling when the requested SHA is already in its cache.

- scripts/dev-safe.mjs: replace PUBLIC_SKILLS_PATH spread in buildAgentServerEnv
  with a simple EXTENSIONS_REF injection; remove cloneExtensionsForSkillsCache
  function, EXTENSIONS_REPO const, and the main() clone call; remove the
  spawnSync and rmSync imports that were only needed for cloning
- scripts/dev-with-automation.mjs: remove cloneExtensionsForSkillsCache import
  and the clone call from startAgentServer()
- docker/Dockerfile: remove the extensions-cache build stage entirely; keep the
  CONFIG_EXTENSIONS_REF line in config-gen (still needed for entrypoint.sh)
- docker/entrypoint.sh: replace the cp-based seeding block with a single
  export EXTENSIONS_REF="${EXTENSIONS_REF:-${CONFIG_EXTENSIONS_REF:-}}"
- AGENTS.md: replace inaccurate OH_PUBLIC_SKILLS_PATH bullet with an accurate
  description of the EXTENSIONS_REF flow

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-06-05 14:30:45 +00:00
Tim O'Farrellandopenhands 80e01e099d fix: single-line agent-server logs in dev:automation mode (#1178) 
Switch the agent-server to LOG_JSON=true so the Python SDK emits one
JSON object per log record instead of Rich-formatted output.  Rich was
wrapping long lines across multiple entries and prepending its own
timestamp on top of the HH:MM:SS [agent-server] prefix that logService
already provides.

Add parseAgentServerLogLine() which turns each JSON record into a clean
single-line string:

  INFO     127.0.0.1:51658 - "GET /api/..." 200  h11_impl.py:481

Level-based ANSI colouring is also applied (dim for DEBUG, yellow for
WARNING, red for ERROR/CRITICAL, blue for INFO) so errors still stand
out.  Non-JSON lines (e.g. startup text) fall back to the original
yellow stderr / service-colour stdout behaviour unchanged.

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-06-05 07:43:33 -06:00
Graham Neubig b847dd296f Bump agent-server default to 1.25.0 (#1161) 
Merged by request after CI passed on the rebased branch.
 2026-06-04 20:46:09 -04:00
Graham Neubig fe26cfa2e4 Allow automation CORS origin override (#1160) 
Merged by request after local validation.
 2026-06-04 20:35:25 -04:00
Vasco SchiavoopenhandsRohit Malhotra
 		7dbe8fd7de fix: populate <RUNTIME_SERVICES> in static builds so automations work (#1125) 
* fix: populate <RUNTIME_SERVICES> in static builds so automations work

The agent's <RUNTIME_SERVICES> system-prompt block is built from
VITE_RUNTIME_SERVICES_INFO, which the dev launchers set at build time.
Static builds (the Docker image and the published binary) run
`npm run build` without it, so the block is dropped and the agent does
not know how to reach the local automation backend — it falls back to
the cloud API (app.all-hands.dev) and automation creation fails.

Inject the info at serve time, mirroring the existing --session-api-key
path:

- scripts/static-server.mjs: new --runtime-services-info flag injects
  the JSON as window.__AGENT_CANVAS_RUNTIME_SERVICES_INFO__
- src/api/agent-server-adapter.ts: parseRuntimeServicesInfo() falls back
  to that window global when the env var is empty
- docker/entrypoint.sh: builds the JSON from the sandbox-facing service
  URLs (AGENT_SERVER_URL, AUTOMATION_BASE_URL) and passes it to the
  static server(s)

Refs #1098

* refactor: extract runtime-services-info into a shared module

Replace the inline JSON building in docker/entrypoint.sh with a single
source of truth for the <RUNTIME_SERVICES> shape.

buildRuntimeServicesInfo now lives in scripts/runtime-services-info.mjs
(moved out of dev-safe.mjs, which re-exports it for back-compat) and
gains:
- optional full-URL overrides (agentServerUrl, automation.url) so the
  container can pass its runtime-resolved AGENT_SERVER_URL /
  AUTOMATION_BASE_URL and use 127.0.0.1 (avoiding IPv6 loopback) instead
  of build-time ports, and
- a CLI entrypoint so docker/entrypoint.sh emits the JSON by running the
  same builder the dev stack uses, rather than a hand-rolled node -e blob.

The Dockerfile ships the new dependency-free module into the image.

* fix: pass --runtime-services-info in static mode and verify in automation e2e

- startStaticFrontend() in dev-with-automation.mjs now builds the
  runtime-services info JSON via buildAutomationRuntimeServicesInfo()
  and passes it to static-server.mjs via --runtime-services-info.
  Without this, the npm binary / dev:static path served pre-built
  frontends that never populated the agent's <RUNTIME_SERVICES>
  system-prompt block (the Docker entrypoint already did this).

- The mock-LLM automation e2e test now verifies that the
  <RUNTIME_SERVICES> block is present in the system messages sent
  to the LLM, and that it includes the expected service entries
  (Agent Server, Automation backend, /api/automation).

Co-authored-by: openhands <openhands@all-hands.dev>

* docs: update AGENTS.md with runtime-services-info plumbing changes

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: Rohit Malhotra <rohitvinodmalhotra@gmail.com>
Co-authored-by: openhands <openhands@all-hands.dev>
 2026-06-04 18:28:35 +00:00
Xingyao WangopenhandsClaude Opus 4.8
 		9e8b068850 fix(dev): keep tmux sockets under ~/.openhands so macOS won't reap them (#1107) 
dev-safe.mjs put the tmux socket dir at os.tmpdir(). On macOS that is the
per-user $TMPDIR (/var/folders/.../T), which the OS periodically reaps
(com.apple.bsd.dirhelper deletes entries untouched for a few days). The reaper
deletes the live tmux socket while the tmux server keeps running, orphaning it,
so every later new-window fails with:

  LibTmuxException: new-window: error connecting to
  .../openhands-agent-canvas-tmux/tmux-501/openhands (No such file or directory)

#325 moved the socket dir to os.tmpdir() to dodge a Unix-domain-socket failure
on mounted volumes, but its intent (per the commit message) was literally /tmp
-- os.tmpdir() != /tmp on macOS, and the per-user temp dir is exactly what gets
reaped.

Default to <stateDir>/tmux (~/.openhands/agent-canvas/tmux) instead, matching
where the rest of dev state already lives: persistent, on local disk, and never
reaped mid-session. dev-safe.mjs only ever runs on the host (the container
launches openhands-agent-server directly, never this script), so the socket dir
is always under a normal local home there.

For the rare host whose $HOME is on a socket-incompatible mount (devcontainers,
NFS/CIFS homes) -- the case #325 cared about -- honor the standard TMUX_TMPDIR
env var (which we already pass through to the agent-server's tmux) so it can be
pointed at a local path like /tmp. No new project-specific env var needed.

Co-authored-by: openhands <openhands@all-hands.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-04 16:07:13 +00:00
Rohit Malhotraandopenhands b1ece3d1d3 fix: use dual-stack (::) binding for static-server to fix Docker e2e connection errors (#1104) 
* fix: use dual-stack (::) binding for static-server to fix Docker e2e connection errors

The Docker e2e tests suffered frequent ECONNREFUSED errors because
static-server.mjs defaulted to 0.0.0.0 (IPv4-only), while localhost
can resolve to ::1 (IPv6) on CI runners. Meanwhile, ingress.mjs (used
by the npm path) already bound to :: (dual-stack) and never had this
problem.

Changes:
- static-server.mjs: default host from 0.0.0.0 → :: (dual-stack)
- docker/entrypoint.sh: --host 0.0.0.0 → --host :: for both
  static-server instances
- playwright.mock-llm-docker.config.ts: switch URLs from 127.0.0.1 to
  localhost (now safe since the server accepts both IPv4 and IPv6)
- playwright.mock-llm.config.ts: drop explicit --host 0.0.0.0 from
  public-mode server (inherits the new :: default)
- dev-static.mjs, dev-with-automation.mjs: drop explicit --host 0.0.0.0
  (inherits the new :: default)
- AGENTS.md: replace IPv4-only guidance with dual-stack documentation

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: skip partial-stack/cross-connect tests when build/ is absent (Docker e2e)

The partial-stack and cross-connect tests spawn bin/agent-canvas.mjs
locally, which requires a pre-built build/ directory. In the Docker e2e
workflow there is no host-side build — the frontend lives inside the
Docker image. These tests are already covered by the npm e2e workflow.

Convert the hard expect(existsSync(...)).toBe(true) assertions to
test.skip() so they are gracefully skipped instead of failing.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: add test.skip to port-conflict test for missing build dir

The port-conflict test also spawns bin/agent-canvas.mjs --frontend-only,
which fails before reaching the port conflict when no build/ exists.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: handle EPIPE/socket errors in static-server proxy to prevent crashes

The static-server reverse proxy crashed with an unhandled 'error' event
(EPIPE) when a client disconnected mid-response — e.g. during browser
navigation or health-check probes. This killed the entire process and
caused cascading ECONNREFUSED in subsequent Docker e2e tests.

Add error handlers on all piped sockets (req, res, proxySocket, socket)
so write errors from client disconnects are absorbed instead of crashing
the server process.

Also add test.skip for the port-conflict test when build/ is missing.

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-06-03 20:54:52 +00:00
chuckbutkusandopenhands 578589af7f fix(static-server): expose runtime session key via window global (#1091) 
The published `agent-canvas` binary is built with no `VITE_SESSION_API_KEY`
baked in. At runtime, `scripts/static-server.mjs --session-api-key <key>`
injects the key into `index.html`, but only as a write to
`localStorage["openhands-agent-server-config"].sessionApiKey`.

PR #1046 ("Simplify backend registry selection") removed the legacy
localStorage fallback from `getAgentServerSessionApiKey()`, leaving it
reading only `import.meta.env.VITE_SESSION_API_KEY`. The combination
broke the first-launch experience for users who installed the npm
package globally:

  1. Fresh browser → `localStorage["openhands-backends"]` is null.
  2. `readLegacyBackend()` requires `baseUrl` AND `sessionApiKey` in
     `openhands-agent-server-config`; the injection only writes the key,
     so it returns null.
  3. `makeDefaultLocalBackend()` reads `VITE_SESSION_API_KEY` → null →
     returns null.
  4. Registry seeds empty → `MissingAgentServerScreen` renders the
     Manage Backends modal ("No extra backends added yet.") with no
     way out.

The fix mirrors how `__AGENT_CANVAS_AUTH_REQUIRED__` already passes the
public-mode flag from `static-server.mjs` to the bundle:

  - `static-server.mjs` now also injects
    `window.__AGENT_CANVAS_SESSION_API_KEY__ = <key>` in the `<head>`
    script. The window global is set first so it is available even if
    the localStorage write throws (private mode, etc.).
  - `getBakedSessionApiKey()` in `src/api/agent-server-config.ts` falls
    back to the window global when `VITE_SESSION_API_KEY` is empty.

Tests:
  - Unit tests in `__tests__/api/agent-server-config.test.ts` cover the
    window-global fallback, env-takes-precedence ordering, whitespace,
    and non-string injected values.
  - `__tests__/scripts/static-server.test.ts` asserts the new window
    assignment lands before the localStorage write.
  - A new mock-LLM E2E spec in
    `tests/e2e/mock-llm/mock-llm-auth-modes.spec.ts` exercises the
    exact user scenario: a fresh browser context with no pre-seeded
    localStorage must reach the onboarding modal (not the Manage
    Backends trap modal) when launched against the prebuilt stack.
  - Updated docstrings in the auth-modes spec and helper to remove
    references to the deleted `syncBakedSessionApiKey()` function.

AGENTS.md updated to document the window-global path and the current
key-rotation reconciliation (`syncLauncherDefaultLocalBackend()` in
`storage.ts`).

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-06-03 13:46:25 -04:00
Graham Neubigopenhandsallhands-bot
 		b9d78d3116 Simplify backend registry selection (#1046) 
* Add partial stack modes to agent-canvas

Co-authored-by: openhands <openhands@all-hands.dev>

* Simplify backend registry selection

Co-authored-by: openhands <openhands@all-hands.dev>

* Fix backend selection CI regressions

* Seed local proxy backend in cloud tests

* Stabilize onboarding snapshot navigation

* Stabilize ingress tests on Windows

* Remove local backend fallback for cloud calls

* Fix frontend-only backend proxy target

* Test backend-only launch without build

* Add pending workflow and status updates

* Use active LLM profile for setup banner

* Show backend connection errors before saving

* Validate backend keys in health checks

* Update backend selector health test mock

* Fix frontend-only workspace path

* Preserve OpenHands proxy base URL

* Address backend review comments

* Preserve profile config when switching models

* Fail fast on profile export errors

* Throw AgentServerUnavailableError when backend registry is empty

When no backend is configured (empty registry / NO_BACKEND sentinel),
loadAgentServerInfo() was returning null without throwing, causing
OptionService.getConfig() to succeed silently. root.tsx then rendered
the home page instead of the MissingAgentServerScreen with the manage
backends modal.

Now loadAgentServerInfo() checks for the NO_BACKEND sentinel when
getEffectiveLocalBackend() returns null and throws
AgentServerUnavailableError, which root.tsx already handles by showing
the manage backends modal. The cloud-backend path (also null from
getEffectiveLocalBackend) is preserved — it still returns null.

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: Remove PR-only artifacts

---------

Co-authored-by: openhands <openhands@all-hands.dev>
Co-authored-by: allhands-bot <allhands-bot@users.noreply.github.com>
 2026-06-03 15:26:51 +00:00
Graham NeubigopenhandsRohit Malhotra
 		8bb2b8c518 Add frontend-only and backend-only agent-canvas modes (#1040) 
* Add partial stack modes to agent-canvas

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: address PR review feedback (#1040)

- Replace padEnd(75) with ANSI-aware ansiPadEnd helper in printBanner;
  String.padEnd counts invisible escape bytes as visible chars, causing
  the box border to misalign in colour terminals
- Deduplicate storage directory creation in ensureDirectories; was being
  pushed once per launchAgentServer block and once per launchAutomation
  block (always both true together) — move to a shared unconditional slot
- Add explanatory comment to the checkNpm two-clause OR condition

Co-authored-by: openhands <openhands@all-hands.dev>

* test: add e2e tests for --frontend-only, --backend-only, and port conflicts

Add mock-llm-partial-stack.spec.ts with three test groups:

1. --frontend-only: verifies static frontend is served (200 on /),
   backend routes return 503 (/server_info, /api/settings,
   /api/automation/v1), and the browser shows the manage-backends modal.

2. --backend-only: verifies /server_info returns 200, /api/settings
   is reachable, automation endpoint works, and root/asset requests
   return 503 (no frontend configured).

3. Port conflict: verifies the process exits non-zero with a clear
   error when the ingress port is occupied, then starts successfully
   on a free port.

Unlike the other mock-llm specs, these tests spawn their own
bin/agent-canvas.mjs child processes with isolated state dirs and
high port numbers (18310+ range) to avoid collisions.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: adjust frontend-only test to expect SPA fallback instead of 503

In frontend-only mode the ingress has no backend routes — all requests
(including /server_info, /api/*) fall through to the static server's
default backend, which returns index.html via SPA fallback (200 with
HTML). The test now verifies that /server_info returns HTML (not JSON)
and that the browser detects the missing backend and shows the
manage-backends modal.

Co-authored-by: openhands <openhands@all-hands.dev>

* feat: add --reject-prefix to static server for clean 503 on missing backends

In --frontend-only mode the static server was SPA-fallbacking API paths
(/server_info, /api/*, /sockets, etc.) to index.html, returning 200
with HTML content instead of a clear failure. This made the frontend's
/server_info probe ambiguous.

Add a --reject-prefix flag to static-server.mjs: any matching request
returns 503 ('Service Unavailable') before the SPA fallback runs.

Wire it through dev-with-automation.mjs: getRejectPrefixes(config)
computes which API prefixes have no backend configured (e.g. all of
them in frontend-only mode) and buildRejectPrefixArgs() passes them
as --reject-prefix flags to the static server.

Restore the e2e test to assert 503 for /server_info, /api/settings,
and /api/automation/v1 in frontend-only mode.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: treat non-401 HTTP errors from /server_info as unavailable

loadAgentServerInfo was re-throwing all SDK HttpErrors (including 503)
as-is, but root.tsx only checks for AgentServerUnavailableError. A 503
from the static server in --frontend-only mode (or any non-401 error)
would fall through to the Outlet instead of showing the manage-backends
modal.

Narrow the re-throw to only preserve 401 (needed for the auth screen in
public mode). All other HTTP errors are now wrapped as
AgentServerUnavailableError so the app shows the correct recovery UI.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: poll automation readiness in backend-only test; retry on 5xx

The automation backend starts independently from the agent-server and
may not be ready when /server_info first returns 200. pollUrl now treats
5xx responses as 'not ready yet' and keeps retrying. The backend-only
test also polls /api/automation/v1 before asserting on it.

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>
Co-authored-by: Rohit Malhotra <rohitvinodmalhotra@gmail.com>
 2026-06-03 06:27:25 +00:00
Tim O'Farrellandopenhands 5a3011c001 fix: align dev-stack OH_PERSISTENCE_DIR and automation DB path with Docker (#960) 
* fix: align dev-stack OH_PERSISTENCE_DIR and automation DB path with Docker

Two path mismatches between `npm run dev` and Docker prevented config and
automation data from being shared across the two modes:

1. **OH_PERSISTENCE_DIR wrong (supersedes PR #959)**
   Docker's entrypoint.sh sets OH_PERSISTENCE_DIR to $HOME/.openhands
   (OPENHANDS_DIR). PR #959 added the env var to buildAgentServerEnv() but
   used config.stateDir (~/.openhands/agent-canvas) — one level too deep.
   Settings and secrets written by Docker live at ~/.openhands/settings.toml
   etc; dev wrote to ~/.openhands/agent-canvas/settings.toml.
   Fix: use path.dirname(config.stateDir) = ~/.openhands, matching Docker.

2. **Automation DB in wrong directory**
   dev-with-automation.mjs put the SQLite DB at
   ~/.openhands/agent-canvas/automations.db. Docker puts it at
   ~/.openhands/automation/automations.db (from config/defaults.json
   paths.automationDb = "automation/automations.db" relative to OPENHANDS_DIR).
   Fix: use join(dirname(config.stateDir), SHARED_DEFAULTS.paths.automationDb)
   so both modes resolve to ~/.openhands/automation/automations.db.
   Also ensure the directory is created on startup (mirrors Docker's mkdir -p).

3. **Mock-LLM test cleanup**
   Update playwright.mock-llm.config.ts to clean both STATE_DIR and the new
   AUTOMATION_DB_DIR (.tmp/automation/) before each test run, since the DB now
   lives outside STATE_DIR.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: use dev_conversations dir for npm to isolate from Docker conversations

npm dev mode now writes conversations to ~/.openhands/agent-canvas/dev_conversations
instead of conversations, keeping them separate from Docker's conversations dir.

OH_CONVERSATIONS_PATH (set via buildAgentServerEnv) is the single control point;
all mkdir and releaseStaleConversationLeases calls updated to match.

Also condense verbose multi-line comments on OH_PERSISTENCE_DIR and
AUTOMATION_DB_URL to single lines.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: use join(config.stateDir, dev_conversations) in ensureDirectories

The outer config in dev-with-automation.mjs does not have conversationsPath
(that is a SafeDevConfig property). Use the same join(stateDir, ...) pattern
as the other dirs in the list.

Also removes the debug console.log and restores dev-safe.mjs and dev-static.mjs
to dev_conversations after the manual revert.

Co-authored-by: openhands <openhands@all-hands.dev>

* test: update conversationsPath assertion to match dev_conversations

The implementation in buildConfigFromPorts was changed to use
'dev_conversations' as the subdirectory name, but the corresponding
test assertion was not updated.

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-06-02 15:26:19 +00:00
Tim O'Farrellandopenhands d0994a6fe1 fix: use X-Session-API-Key for local automation auth in prompts and RUNTIME_SERVICES (#999) 
Fixes #980

The agent prompt in recommended-automations-launcher and the
RUNTIME_SERVICES block in agent-server-adapter both advertised
X-API-Key as the auth header for the local automation backend.
The automation service (openhands-automation) does not accept
X-API-Key — it accepts Authorization: Bearer and X-Session-API-Key.

X-Session-API-Key is the established local convention: the agent
server uses it, the frontend automation API client uses it (with an
explicit comment that both backends share the same header), and
auth.py describes it as matching that convention. Update both call
sites and the corresponding test assertion to use X-Session-API-Key.

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-06-01 15:10:30 -06:00
Rohit Malhotraopenhandschuckbutkus
 		14b1b1e8ad feat: two auth modes — local (auto-key) and public (paste-key) (#790) 
* feat: two auth modes — local (auto-key) and public (paste-key)

Local mode (agent-canvas, no flags):
- Ingress binds to 127.0.0.1 only
- Auto-generates session API key
- Writes /backends.json to static dir so frontend auto-authenticates
- Zero setup for localhost use

Public mode (agent-canvas --public):
- Ingress binds to 0.0.0.0 (all interfaces)
- Requires LOCAL_BACKEND_API_KEY env var
- Does NOT write /backends.json
- Frontend shows API key entry screen on 401

Co-authored-by: openhands <openhands@all-hands.dev>

* refactor: reuse BackendForm in public-mode API key entry screen

Replace the bespoke ApiKeyEntryScreen form with BackendForm configured
for the public-auth use case:

- Host field is auto-filled from window.location.origin and read-only
- Name field is hidden (auto-derived from the existing backend)
- Only the API key input is exposed to the user
- Uses the same SettingsInput / BrandButton components as the backend
  connection modals for visual consistency

BackendForm gains three optional props to support this:
- hideName: hides the name input and uses a fallback name
- hostReadOnly: disables the host input
- onSubmitPayload: receives the submitted payload for side-effects
  (the API key screen uses it to persist to agent-server-config and
  reload the page)

Co-authored-by: openhands <openhands@all-hands.dev>

* docs: update AGENTS.md with ApiKeyEntryScreen BackendForm reuse details

Co-authored-by: openhands <openhands@all-hands.dev>

* feat: implement public mode auth flow (--public flag)

- Add --public flag to dev-with-automation.mjs and bin/agent-canvas.mjs
- In public mode: require LOCAL_BACKEND_API_KEY, use as session key,
  don't bake into frontend (no VITE_SESSION_API_KEY / --session-api-key)
- Add isAgentServerAuthError() to detect 401 from /server_info probe
- root.tsx shows ApiKeyEntryScreen when 401 detected (lazy loaded)
- useConfig skips retries on 401 for instant auth screen display
- ApiKeyEntryScreen now has default export for React.lazy compatibility

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: use VITE_AUTH_REQUIRED flag instead of 401 detection for public mode

The 401-based approach was unreliable — /server_info may not require
auth on all server versions. Instead:

- dev-with-automation.mjs sets VITE_AUTH_REQUIRED=true in public mode
- isAuthRequiredAndMissing() checks the flag + localStorage for a key
- root.tsx gates on the flag BEFORE the /server_info probe, so the
  auth screen appears instantly with zero network round-trips
- 401 fallback kept as safety net for edge cases

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: handle stale key via 401 detection in public mode

When the server restarts with a new LOCAL_BACKEND_API_KEY, the browser
still has the old key in localStorage. isAuthRequiredAndMissing() returns
false (key exists), so the /server_info probe fires and 401s.

isAgentServerAuthError() now checks VITE_AUTH_REQUIRED=true AND 401
status, so it only triggers in public mode (a 401 in local mode is a
misconfiguration, not a key-rotation event). useConfig skips retries
on 401 to show the auth screen immediately.

Two gates, one screen:
- No key at all → flag check, instant, no network
- Stale key → /server_info 401, one round-trip

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: validate stale keys against GET /api/settings (protected)

/server_info is unprotected — it returns 200 even with a wrong key.
In public mode, after the /server_info probe succeeds, we now hit
GET /api/settings to verify the stored key is still valid. A 401
from that endpoint triggers the auth screen via isAgentServerAuthError().

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: rewrite ApiKeyEntryScreen — validate before save, always empty key, match add-modal UI

Three fixes:

1. Stale key conflict: The form now always starts with an empty API key
   field instead of pre-filling from the backend registry. Stale
   credentials from a previous session never bleed into the input.

2. Wrong key indicator: On submit, the key is validated against
   GET /api/settings (protected endpoint) BEFORE persisting. Wrong
   keys show an inline red status dot + 'Invalid API key' error
   via BackendStatusDot. Only validated keys trigger the reload.

3. UI parity with add-backend modal: Replaced BackendForm wrapper
   with direct SettingsInput fields matching ManualConnectionColumn's
   layout — host (read-only + helper text), API key (password with
   placeholder), status indicator, and Connect button. No cloud
   OAuth column.

New i18n key: AUTH$INVALID_KEY (all 15 languages).

Co-authored-by: openhands <openhands@all-hands.dev>

* feat: match add-backend modal UI + add test coverage

ApiKeyEntryScreen now renders the exact same card chrome as
BackendFormModal add-mode: same title ('Add a Backend'), same
Name/Host/API Key fields, same Connect button styling. Host is
pre-filled and read-only; no cloud OAuth column.

New tests (12 total):
- api-key-entry-screen.test.tsx (7 tests):
  - UI field parity with add-backend modal
  - Stale key wipe (empty API key field despite stale localStorage)
  - Connect disabled until name + key filled
  - Valid key: validates → persists → reloads
  - Invalid key: error indicator, no persist, no reload
  - Retry flow: wrong key → error → correct key → success
  - Stale key isolation: only fresh key persisted
- agent-server-config.test.ts (5 new tests for isAuthRequiredAndMissing):
  - Flag unset → false
  - Flag set, no key → true
  - Flag set, localStorage key → false
  - Flag set, VITE_SESSION_API_KEY → false
  - Flag not 'true' → false

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: distinguish 401 from other errors in ApiKeyEntryScreen

The catch-all was showing 'Invalid API key' for EVERY failure —
including 500s, network errors, and timeouts — even when the key
was correct. Now:

- 401 → 'Invalid API key. Please check the key and try again.'
- Anything else → 'Connection failed: <actual error message>'

This reveals the real problem when a correct key fails for a
non-auth reason (e.g. server misconfiguration, missing OH_SECRET_KEY).

New i18n key: AUTH$CONNECTION_FAILED (all 15 languages).
New test: non-401 errors show 'Connection failed' + detail.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: agent-server receives wrong session key in public mode

startAgentServer() called buildSafeDevConfig() which generated its
own random session key, ignoring config.sessionApiKey (which holds
LOCAL_BACKEND_API_KEY in public mode). The agent-server was started
with a random key while users were told to paste the LOCAL_BACKEND_API_KEY
value — every key was rejected with 401.

Fix: override OH_SESSION_API_KEYS_0 in the agent-server env with
config.sessionApiKey so both the agent-server and the frontend
agree on which key is valid.

Co-authored-by: openhands <openhands@all-hands.dev>

* refactor: address review comments on ApiKeyEntryScreen

1. Remove dead BackendFormProps (hideName, hostReadOnly, onSubmitPayload)
   — ApiKeyEntryScreen is standalone so no caller used these props.

2. Auto-generate backend name from window.location.hostname instead of
   requiring users to type one. Only the API key field is required now,
   reducing public-mode auth to a single-field flow.

3. Simplify redundant ternary: connectionStatus === 'success' ? true : false
   → connectionStatus === 'success'.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: address second round of review comments

1. Use shared isSdkHttpError() helper in ApiKeyEntryScreen instead of
   duplicating the SDK error shape check inline. Exported the helper
   from agent-server-compatibility.ts.

2. Add code comment acknowledging the edge case where a network hiccup
   between /server_info and getSettings() probes lets the app load with
   an unvalidated key. Acceptable since the window is narrow and a page
   refresh recovers.

3. Add --auth-required flag to static-server.mjs so pre-built static
   binaries (npx @openhands/agent-canvas --public) show the API key
   entry screen without needing VITE_AUTH_REQUIRED baked in at build
   time. The flag injects window.__AGENT_CANVAS_AUTH_REQUIRED__=true
   into index.html at runtime. Frontend isAuthRequired() checks both
   the build-time env var and the runtime window flag.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: use double cast (unknown) to satisfy strict TS on window flag access

window cannot be cast directly to Record<string, unknown> — TypeScript
requires going through unknown first for unrelated types.

  (window as unknown as Record<string, unknown>).__AGENT_CANVAS_AUTH_REQUIRED__

This fixes the CI typecheck failure introduced in aa76c01a.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: address remaining review comments on auth modes PR

- Use isAuthRequired() instead of raw import.meta.env.VITE_AUTH_REQUIRED
  in isAgentServerAuthError() so the runtime window flag injected by
  static-server.mjs in pre-built binaries is also honoured (bug fix).

- Preserve existing backend name during re-authentication flow in
  ApiKeyEntryScreen; only fall back to window.location.hostname for
  the initial entry so users don't lose custom labels on key rotation.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: restore MCP-to-integrations migration from main

A prior merge into this branch incorrectly kept the old
@openhands/extensions/mcps imports instead of the
@openhands/extensions/integrations paths introduced by d41bfe15
on main. Restore all affected files from origin/main so the
extensions package (which no longer exports ./mcps) resolves
correctly.

Files restored from main:
- src/utils/mcp-marketplace-utils.ts
- src/routes/mcp.tsx
- src/components/features/mcp-logo-badge.tsx
- src/components/features/mcp-page/* (6 files)
- src/components/features/automations/* (2 files)
- __tests__/ (4 test files)

Co-authored-by: openhands <openhands@all-hands.dev>

* style: fix prettier formatting and remove unused eslint-disable in api-key-entry-screen

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: address remaining PR review comments

- Extract isSdkHttpStatusError() helper in agent-server-compatibility.ts
  to DRY up the SDK error status check (review comment #3321202503).
  Both isAgentServerAuthError() and ApiKeyEntryScreen now use it.

- Use AUTH i18n keys in api-key-entry-screen.tsx:
  • Heading: AUTH$API_KEY_REQUIRED_TITLE ('API Key Required')
  • Description: AUTH$API_KEY_REQUIRED_DESCRIPTION added below heading
  • Button: AUTH$CONNECT ('Connect')
  (review comments #3325478721, #3325478729)

- Fix nested <main> landmark in root.tsx: remove the outer <main>
  wrapper since ApiKeyEntryScreen already provides its own semantic
  container (review comment #3325478704).

- Change ApiKeyEntryScreen root element from <main> to <div> so
  the Layout's own landmarks are not violated.

Co-authored-by: openhands <openhands@all-hands.dev>

* test: add coverage for window.__AGENT_CANVAS_AUTH_REQUIRED__ runtime flag

Add isAuthRequired() test block covering the window flag path used by
pre-built static binaries (static-server.mjs --auth-required). Also add
window-flag variants to isAuthRequiredAndMissing() tests.

Addresses review comment #3325587577.

Co-authored-by: openhands <openhands@all-hands.dev>

* refactor!: deduplicate SESSION_API_KEY into LOCAL_BACKEND_API_KEY

BREAKING CHANGE: The user-facing env var for setting the API key is now
`LOCAL_BACKEND_API_KEY` everywhere. The old `SESSION_API_KEY`,
`OH_SESSION_API_KEYS_0`, and `VITE_SESSION_API_KEY` env vars are no
longer read by launchers as user-facing configuration.

Internal plumbing (`config.sessionApiKey`, `VITE_SESSION_API_KEY` build
injection, `OH_SESSION_API_KEYS_0` agent-server env) is unchanged — only
the user-facing surface is unified into a single env var.

Changes:
- scripts/dev-safe.mjs: read LOCAL_BACKEND_API_KEY instead of
  SESSION_API_KEY / OH_SESSION_API_KEYS_0 / VITE_SESSION_API_KEY
- scripts/dev-with-automation.mjs: unify key resolution through
  buildSafeDevConfig for both public and local modes
- bin/agent-canvas.mjs: update CLI help text and examples
- docker/entrypoint.sh: read LOCAL_BACKEND_API_KEY, migrate legacy
  session-api-key.txt → api-key.txt
- scripts/static-server.mjs: add mutual-exclusion guard for
  --session-api-key + --auth-required flags
- playwright configs: pass LOCAL_BACKEND_API_KEY instead of the old trio
- test helpers: prefer LOCAL_BACKEND_API_KEY fallback chain
- Update tests and documentation

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: address review comments — narrow settings probe rethrow and use shared client options

- loadAgentServerInfo: narrow getSettings() catch to rethrow only 401
  errors. Other HTTP errors (403, 5xx) and non-HTTP errors (network,
  timeout) are now swallowed with a console.warn, since the server is
  confirmed up (via /server_info) and the probe is best-effort. This
  prevents misconfigured servers from silently falling through to
  <Outlet /> without showing either the auth or unavailable screen.

- ApiKeyEntryScreen: replace hand-rolled SettingsClient options with
  getAgentServerClientOptions() so transport-level settings (e.g.
  VITE_INSECURE_SKIP_VERIFY) are honoured. Uses the sessionApiKey
  override to pass the freshly-entered key.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: rewrite git+ssh to git+https for @openhands/extensions in lockfile

npm normalizes GitHub URLs to git+ssh:// in the lockfile, but machines
without SSH keys for GitHub (or with stale npm caches) can end up
installing a wrong version of the package. This causes the Vite resolve
error:

  "./integrations" is not exported under the conditions [...]

The same pattern was already fixed for @openhands/typescript-client
(see #384). vercel-install.sh already does a blanket sed rewrite, but
the committed lockfile itself should use git+https:// so local npm ci
works without SSH keys.

Co-authored-by: openhands <openhands@all-hands.dev>

* refactor: align public auth screen with Add Backend form layout

Replace the custom 'API Key Required' screen with the same form
layout used by the 'Add a Backend' left column in BackendFormModal:

- Heading changed from 'API Key Required' to 'Add a Backend'
- Added backend Name field (required, same as ManualConnectionColumn)
- Host field remains pre-filled and disabled (from window.location.origin)
- API Key field unchanged
- Submit button now uses BACKEND$CONNECT label (matching the modal)
- Removed the subtitle description paragraph for cleaner parity
- Name is persisted to the backend registry on submit

Tests updated: fillApiKey → fillRequiredFields (name + apiKey),
assertions cover the new name field and dual-field submit gating.

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: remove unused AUTH$ i18n keys from this PR

The UI refactor (02faa0b0) switched ApiKeyEntryScreen to the
BACKEND$* keys. Drop the three AUTH$ entries that were introduced
and then superseded within this same PR:

- AUTH$API_KEY_REQUIRED_TITLE
- AUTH$API_KEY_REQUIRED_DESCRIPTION
- AUTH$CONNECT

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: sync stale session API key on boot when LOCAL_BACKEND_API_KEY changes

When a user restarts the stack with a different LOCAL_BACKEND_API_KEY,
the new VITE_SESSION_API_KEY is baked in correctly, but localStorage
may still hold the old key in two places:

  1. openhands-agent-server-config.sessionApiKey (written by onboarding
     or the Settings page)
  2. openhands-backends[].apiKey (seeded on first load, never re-synced)

The existing syncDefaultLocalBackendAuth() in storage.ts already tries
to fix #2 by comparing against makeDefaultLocalBackend(), but that
function reads through getConfiguredSessionApiKey() which hits #1
(stale localStorage) before falling back to VITE_SESSION_API_KEY.
So a stale #1 defeats the #2 sync.

Fix: add syncBakedSessionApiKey() which runs from readStoredBackends()
before any key resolution. When VITE_SESSION_API_KEY is set and the
stored key in openhands-agent-server-config differs, overwrite it.
This ensures getConfiguredSessionApiKey() and makeDefaultLocalBackend()
both return the correct key, and the downstream backend-registry sync
works as intended.

Also fix the static-server.mjs injection script to always overwrite a
stored key that differs from the runtime key (was guarded by
`if(!_c.sessionApiKey)` which skipped updates when any key existed).

Add mock-LLM E2E tests for:
- Key rotation recovery: seeds stale localStorage, verifies app loads
- Public-mode auth gate: tests auth screen visibility, wrong key
  rejection, and correct key acceptance

Co-authored-by: openhands <openhands@all-hands.dev>

* docs: document key rotation resilience in AGENTS.md

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: add syncBakedSessionApiKey to vi.mock stubs and use click-then-fill in E2E

Three test files mock #/api/agent-server-config without exporting
syncBakedSessionApiKey, which storage.ts now calls at import time.
Add the missing vi.fn() stub to all three.

Also fix the public-mode auth E2E test: use the click() → fill()
pattern for React controlled inputs (matching the established
convention in mock-llm-conversation.spec.ts) so the SettingsInput
onChange fires reliably in Playwright.

Co-authored-by: openhands <openhands@all-hands.dev>

* test: add public-mode key rotation E2E test

Simulates a server key rotation: localStorage holds a stale key from
a previous session, the server now has a new key. Verifies the app
detects the 401 from the stale key probe, shows the auth screen, and
accepts the new key.

Flow: stale key in localStorage → probe /server_info → 401 →
isAgentServerAuthError → ApiKeyEntryScreen → user pastes new key →
reload → app loads normally.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(e2e): suppress consent modal in public-mode auth tests

The analytics consent modal overlays the auth screen on first visit
(clean localStorage). Playwright's click() on the form inputs was
intercepted by the modal overlay, causing a 60s timeout loop (121
retries). Add a beforeEach that seeds 'analytics-consent' and
'openhands-telemetry-consent' in localStorage before navigation.

Also deduplicate the consent seeding from the key-rotation test's
addInitScript since the beforeEach now handles it.

Co-authored-by: openhands <openhands@all-hands.dev>

* refactor: deduplicate readStoredConfig() call in syncBakedSessionApiKey

Capture the first readStoredConfig() result and reuse it in the
spread instead of hitting localStorage twice.

Co-authored-by: openhands <openhands@all-hands.dev>

* chore(docker): remove legacy session-api-key.txt migration

The backwards-compatibility shim that migrated the old
session-api-key.txt to api-key.txt is no longer needed — a breaking
change here is acceptable.

Co-authored-by: openhands <openhands@all-hands.dev>

* refactor: dedup ApiKeyEntryScreen against BackendForm

ApiKeyEntryScreen now renders BackendForm with three new props instead
of reimplementing the name/host/API-key inputs from scratch:

- hostReadOnly: locks the host field (pre-filled from window.origin)
- requireApiKey: forces a non-empty API key for local backends
- onSubmitOverride: replaces the default sync persist with async
  server-side validation (GET /api/settings) before persisting

The auth-gate-specific chrome (full-screen wrapper, connection status
indicator, validating/error state) stays in ApiKeyEntryScreen via the
existing renderActions slot.

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>
Co-authored-by: chuckbutkus <chuck@openhands.dev>
 2026-06-01 12:02:37 -06:00
Tim O'Farrellandopenhands 95b6d7a23e fix: persist OH_SECRET_KEY to secret-key.txt in dev mode, same as Docker (#957) 
Dev mode (npm run dev) was always using the hardcoded static default key
'openhands-dev-secret-key-change-in-prod' from config/defaults.json.
Docker mode (docker/entrypoint.sh) generates a random key on first run and
persists it to ~/.openhands/agent-canvas/secret-key.txt.

When both modes share the same ~/.openhands directory, they used different
keys — causing decryption failures for any settings encrypted by the other
mode.

Fix: remove the static default in dev-safe.mjs and instead use
getOrCreatePersistedApiKey() with a new DEFAULT_SECRET_KEY_PATH constant
pointing to the same secret-key.txt file that Docker reads/writes.
Whichever mode runs first generates and persists the key; the other picks
it up automatically on next start.

- Add DEFAULT_SECRET_KEY_PATH export to dev-safe.mjs
- Replace 'env.OH_SECRET_KEY || DEFAULT_SECRET_KEY' with
  'env.OH_SECRET_KEY || getOrCreatePersistedApiKey(secretKeyPath, "secret")'
- Update startup log to show persisted file path (not 'default (for local development)')
- Remove now-unused 'defaults.secretKey' from config/defaults.json
- Update AGENTS.md to reflect the new shared-file behavior

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-05-30 06:36:47 -06:00
Tim O'Farrellandopenhands eb3ae22b23 fix: fast-fail dev scripts when ports are already in use (#939) 
* fix: fast-fail dev scripts when ports are already in use

Add `assertPortsFree` to `scripts/dev-safe.mjs` that checks each
preferred port and throws a descriptive error if any are already bound,
rather than silently binding to an alternative port.

- `buildSafeDevConfigAsync` now calls `assertPortsFree` before
  returning config, so `npm run dev:minimal` exits immediately with a
  clear message when the agent-server port is occupied.
- `dev-with-automation.mjs`'s `buildConfig` does the same for all four
  service ports (ingress, agent-server, automation, vite), covering
  `npm run dev` and `npm run dev:static`.
- `buildConfig` gains env-var overrides for internal service ports
  (`OH_CANVAS_SAFE_BACKEND_PORT`, `OH_CANVAS_SAFE_AUTOMATION_PORT`,
  `OH_CANVAS_SAFE_VITE_PORT`) so tests and advanced users can redirect
  ports without touching production defaults.

Tests updated accordingly:
- Old "falls back when port is busy" tests replaced with "throws when
  port is busy" equivalents.
- New `assertPortsFree` describe block with three targeted cases.
- `envWithIsolatedKeyPath` in `dev-with-automation.test.ts` now seeds
  high free ports so the pre-flight check passes when a real dev stack
  is running during local test execution.

Closes #934

Co-authored-by: openhands <openhands@all-hands.dev>

* refactor: address review bot suggestions on assertPortsFree

- Check ports in parallel with Promise.all instead of sequentially
  (each check is independent I/O, so parallel is faster and more idiomatic)
- Include vscode port in the buildSafeDevConfigAsync pre-flight check
  alongside the agent-server port, so a conflict on that internal port
  is also caught with a helpful message rather than a cryptic spawn error

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-05-29 17:25:52 +00:00
Rohit Malhotraandopenhands caef236c10 mock-llm e2e: use bin/agent-canvas.mjs (production binary path) (#906) 
Switch mock-LLM E2E tests from npm run dev:minimal (Vite dev server +
agent-server only) to the full agent-canvas binary entry point — the same
path real users exercise when they run `npx @openhands/agent-canvas`.

This means tests now launch:
  - Pre-built static frontend (via static-server.mjs)
  - Agent-server via uvx
  - Automation backend via uvx
  - Ingress proxy unifying all routes on a single port

Changes:
- playwright.mock-llm.config.ts: replaced dev-safe.mjs webServer with
  bin/agent-canvas.mjs; single ingress port (18300) serves both the
  browser UI and proxied API calls; conditional build step for build/
- scripts/dev-with-automation.mjs: buildConfig now respects
  OH_CANVAS_SAFE_STATE_DIR from env (needed for test isolation)
- tests/e2e/mock-llm/utils/mock-llm-helpers.ts: BACKEND_URL now
  defaults to the ingress URL (API calls are proxied transparently)
- .github/workflows/mock-llm-e2e.yml: added npm run build:app step
  before tests (pre-build for CI caching)
- AGENTS.md: added Mock-LLM E2E Tests section documenting the new
  production-fidelity test architecture

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-05-28 19:17:59 +00:00
simonrosenbergClaude Opus 4.7Debug Agent
 		665a258b80 feat(acp): inline live model picker for ACP conversations (#769) (#832) 
* feat(acp): inline live model picker for ACP conversations (#769)

Converge ACP model selection onto the native LLM-profile inline picker UX
with live mid-conversation switching, replacing the display-only popover.

- Bump @openhands/typescript-client 1.23.3 -> 1.24.0 (adds switchAcpModel).
- AgentServerConversationService.switchAcpModel(conversationId, model): POST
  /switch_acp_model via ConversationClient, with switchProfile's local-only guard.
- useSwitchAcpModel hook: live switch for a running ACP session; for the
  home/no-session case, persist the choice as the agent-settings default
  (agent_settings_diff { acp_model }) so the next conversation inherits it.
- ChatInputModel popover becomes a picker over the provider's available_models
  (check on the effective model), local backend only; cloud / custom-provider /
  native surfaces keep the display + Settings link.
- New i18n key MODEL$AVAILABLE_MODELS.
- Tests for the hook (live vs settings-default branches) and the picker.

Local backend only (matches native switching); custom/unknown providers and any
app_server route remain out of scope per #769.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(acp): open the model picker on click (don't self-close via click-outside)

The inline picker's trigger button sits outside the popover element, so the
document click-outside handler (useClickOutsideElement) treated the opening
click as an "outside" click and closed the popover in the same interaction —
clicking the chip appeared to do nothing. (A programmatic el.click() worked by
fluke: the popover isn't rendered yet when that click bubbles, so the ref is
null and the close is skipped.)

Pass the trigger button as the hook's ignoreOutsideClickRef so a click on the
chip toggles the popover instead of being treated as an outside click.

Validated end-to-end against a local agent-server 1.24.0: the picker opens and
lists the provider's available_models, and selecting one writes the default via
PATCH /settings (home case), with the chip updating to the new model.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(acp): drop disableToast in useSwitchAcpModel so switch errors surface

useSwitchLlmProfile sets meta.disableToast because it's wrapped by
useSwitchLlmProfileAndLog, which re-surfaces errors via its own onError.
useSwitchAcpModel is called directly (no such wrapper / no onError), so
disableToast was silently swallowing failed switches and settings writes
(e.g. a 409 before the first message, network errors, the cloud guard).

Remove it and let the global mutation error toast report failures — simpler
and gives the user feedback when a switch doesn't take.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(acp): share chat input model picker state

* chore: address PR review feedback (#832)

- Add unit test for useChatInputModelState pinning its branching contract,
  incl. the active-ACP getAcpProvider lookup (was home-only in old component).
- Document why the overflow model submenu uses overflow-y-auto (scroll long
  model lists) rather than overflow-visible — no floating children to clip.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: address PR review feedback (#832)

- Wrap the 'Available models' section label in a presentational <li> so it
  is a valid child of the ContextMenu <ul> (was a bare <div>).
- Drop unnecessary 'as never' casts in use-switch-acp-model tests now that
  the real return types (Promise<void>, Promise<boolean>) are honored.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(acp): bump agent-server pin to 1.24.0 for /switch_acp_model

The inline ACP model picker POSTs to /api/conversations/{id}/switch_acp_model,
which is new in openhands-agent-server 1.24.0. The PR description already
lists agent-server:1.24.0 as a dependency, but config/defaults.json was
left at 1.23.1, so local dev (npm run dev) and Docker installs would 404
on every model switch attempt.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(settings): always land on /settings/agent from /settings

The fallback order in ``getFirstAvailablePath`` put ``/settings/llm``
first whenever ``hide_llm_settings`` was off, so clicking Settings sent
the user to the LLM page. For ACP users that page is disabled and
``redirectIfAcpActive`` only catches them when the *personal* settings
already say ``agent_kind === "acp"`` — being in an ACP conversation
with non-ACP personal settings (the common case during the inline
picker flow) bypassed the guard and dumped them on /settings/llm.

Make ``/settings/agent`` the unconditional first fallback. It is
always available (no feature flag hides it), houses the agent-kind
picker, and the left nav still gets OpenHands users to LLM in one
click — so one extra click for non-ACP users buys a much simpler
routing surface and kills the ACP misroute.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(settings/agent): clear command when switching to Custom preset

Selecting "Custom" in the agent preset dropdown reset ``acpModel`` and
flipped ``isCustomAcpModel`` but left ``commandText`` untouched. On the
next render, ``detectPreset(commandText, ACP_PROVIDERS)`` still matched
the previous provider's ``default_command`` and snapped the dropdown
back off "Custom" — the toggle never stayed on Custom.

Clear ``commandText`` in the Custom branch so ``detectPreset`` falls
through to ``ACP_CUSTOM_PRESET_KEY`` on the next render and the dropdown
stays where the user put it. Empty command also matches the intended
"user supplies their own" semantics of the preset.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(settings): mark Verification page as disabledByAcp

The Verification page writes ``confirmation_mode`` and
``security_analyzer`` into ``conversation_settings_diff``. The ACP
agent loop never reads either: ``openhands/sdk/agent/acp_agent.py``
has zero references to ``confirmation_policy`` or
``security_analyzer``, and the only runtime readers
(``openhands/sdk/agent/agent.py:844,855``) live on the native
``Agent`` class — not on ``ACPAgent``. The backend accepts the values
and stores them on conversation state, but the ACP subprocess never
consults them.

So the page presents real-looking knobs that silently do nothing for
ACP users. Mark it ``disabledByAcp: true`` — same pattern as
``/settings/llm`` and ``/settings/condenser`` — so it greys out in the
nav and the existing route guard at ``src/routes/settings.tsx:47-51``
bounces direct visits to ``/settings/agent``.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ci): bump doc/script SDK version examples to 1.24.0

The docs-version-sync test enforces that every documented agent-server
version example matches ``config/defaults.json:versions.agentServer``.
The previous commit bumped that pin from 1.23.1 to 1.24.0 for the
``/switch_acp_model`` route, but left the example references in
AGENTS.md, ``scripts/dev-safe.mjs``, and ``scripts/check-sdk-version-sync.mjs``
behind — the drift-detector caught it as ``test-and-build`` failure.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ci): bump remaining hard-coded 1.23.1 to 1.24.0

``__tests__/scripts/dev-safe.test.ts`` asserts ``buildAgentServerCommand``'s
default ``uvx`` args literally include ``openhands-agent-server==1.23.1`` and
matching ``openhands-{sdk,tools,workspace}==1.23.1``. The CI fix in the prior
commit only updated docs and example references; the central pin bump in
``config/defaults.json`` flowed through to this test's runtime expectation but
the literal expectations were never updated. Bump them.

Also bump the ``MOCK_AGENT_SERVER_VERSION`` placeholder in
``src/mocks/settings-handlers.ts`` for consistency with the central pin —
no test asserts on it, but leaving the mock at 1.23.1 invites future
drift confusion.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Debug Agent <debug@example.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-28 16:42:17 +02:00
Jamie Chicagoopenhandshieptl
 		b570b4a2f6 fix: buildNpmScriptCommand always uses cmd.exe on Windows (#734) 
* fix: buildNpmScriptCommand always uses cmd.exe on Windows

On Windows, npm sets npm_execpath to a path like
  C:\Program Files\nodejs\node_modules\npm\bin\npm-cli.js
which contains spaces. buildNpmScriptCommand was returning that
path as a spawn argument with the full node.exe path as the command.
spawnService uses shell:true on Windows, so Node.js passes the
unquoted command to cmd.exe:

  cmd.exe /d /s /c C:\Program Files\nodejs\node.exe ...

cmd.exe splits on the space and fails with
  'C:\Program' is not recognized as an internal or external command
causing Vite to exit with code 1 immediately after npm run dev.

Fix: check platform === 'win32' BEFORE checking npm_execpath so
Windows always uses the safe cmd.exe /d /s /c npm run <script> form.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: buildNpmScriptCommand always uses cmd.exe on Windows

On Windows, npm sets npm_execpath to a path like
  C:\Program Files\nodejs\node_modules\npm\bin\npm-cli.js
which contains spaces. buildNpmScriptCommand was returning that
path as a spawn argument with the full node.exe path as the command.
spawnService uses shell:true on Windows, so Node.js passes the
unquoted command to cmd.exe:

  cmd.exe /d /s /c C:\Program Files\nodejs\node.exe ...

cmd.exe splits on the space and fails with
  'C:\Program' is not recognized as an internal or external command
causing Vite to exit with code 1 immediately after npm run dev.

Fix: check platform === 'win32' BEFORE checking npm_execpath so
Windows always uses the safe cmd.exe /d /s /c npm run <script> form.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: AnimatePresence mode=wait expects one child, not two

ChatStatusIndicator had two separately-keyed motion.span children inside
<AnimatePresence mode="wait">. framer-motion's wait mode expects exactly ONE
child to exit before the next enters; two children trigger the repeated warning:
  "attempting to animate multiple children within AnimatePresence,
   but its mode is set to 'wait'"

Fix: wrap both elements in a single motion.span with unified key={status}
and className="contents" (CSS display:contents preserves flex layout).

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: set PYTHONUTF8=1 in agent-server/automation env on Windows

Python on Windows defaults to the system ANSI codepage (cp1252). The agent-server
writes metadata JSON containing emoji (e.g. U+2705 ✅) that cp1252 cannot encode,
producing UnicodeEncodeError → POST /api/conversations 500. Old UTF-8 conversation
files also fail to load at startup (UnicodeDecodeError). PYTHONUTF8=1 enables
Python's UTF-8 mode (PEP 540) for the process, matching Linux/macOS behaviour.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: set PYTHONUTF8=1 in agent-server/automation env on Windows

Python on Windows defaults to the system ANSI codepage (cp1252). The agent-server
writes metadata JSON containing emoji (e.g. U+2705 ✅) that cp1252 cannot encode,
producing UnicodeEncodeError → POST /api/conversations 500. Old UTF-8 conversation
files also fail to load at startup (UnicodeDecodeError). PYTHONUTF8=1 enables
Python's UTF-8 mode (PEP 540) for the process, matching Linux/macOS behaviour.

Co-authored-by: openhands <openhands@all-hands.dev>

* refactor: remove unrelated file

---------

Co-authored-by: openhands <openhands@all-hands.dev>
Co-authored-by: hieptl <hieptl.developer@gmail.com>
 2026-05-28 16:29:55 +07:00
chuckbutkusopenhandsRohit Malhotra
 		cbeeee002e fix: inject runtime session key into index.html for published binary (#795) 
* fix: inject runtime session key into index.html for published binary

The globally installed agent-canvas binary starts the agent-server with a
persisted session API key (~/.openhands/agent-canvas/session-api-key.txt)
as OH_SESSION_API_KEYS_0, making auth required. However, the pre-built
static frontend in the npm package has a different (or empty)
VITE_SESSION_API_KEY baked in at publish time, so every API request gets
401 Unauthorized.

Fix: static-server.mjs now accepts --session-api-key <key> and injects a
tiny bootstrap <script> before </head> in every index.html response. The
script seeds the key into localStorage['openhands-agent-server-config']
only if no key is already stored there, so explicit user overrides (via
Settings > Agent Server) are always preserved.

dev-with-automation.mjs and dev-static.mjs both pass
--session-api-key ${config.sessionApiKey} when spawning the static server,
so the runtime key is always available regardless of what was baked into
the bundle.

Tests: added 8 new cases to __tests__/scripts/static-server.test.ts
covering parseArgs, injection in direct and SPA-fallback index.html
responses, no injection for non-html assets, cache headers, and null key.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(docker): pass runtime session key to static-server so frontend can authenticate

The entrypoint computed EFFECTIVE_SESSION_KEY and forwarded it to the
agent-server (OH_SESSION_API_KEYS_0) and automation backends, but did not
pass it to the static-server. As a result the pre-built index.html served
with no session key injected, so every browser API call received 401.

Wire --session-api-key "$EFFECTIVE_SESSION_KEY" into the static-server
launch command so the runtime key is injected into index.html responses
(via the mechanism added in this branch to static-server.mjs).

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: address review suggestions on session key injection

- static-server.mjs: add comment clarifying replace() targets first
  </head> only; fall back to inserting before </body> when </head> is
  absent (avoids prepending before <!DOCTYPE html>)
- docker/entrypoint.sh: add comment documenting source of
  EFFECTIVE_SESSION_KEY before the static-server invocation
- static-server.test.ts: add test for </head>-absent fallback path
  confirming injection lands before </body>

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>
Co-authored-by: Rohit Malhotra <rohitvinodmalhotra@gmail.com>
 2026-05-27 11:12:23 -04:00
Rohit Malhotraandopenhands e2dd1b5f17 fix: unify session and automation API keys into a single credential with consistent header (#681) 
* fix: unify session and automation API keys into a single credential

Both the agent-server and automation backend now share the same API key
value. The agent-server validates it via `X-Session-API-Key` and the
automation backend validates it via `Authorization: Bearer …` — different
header formats, same credential.

Changes:
- Frontend: automation axios client reads `VITE_SESSION_API_KEY` instead
  of the now-removed `VITE_AUTOMATION_API_KEY`
- Dev launcher: removed separate `AUTOMATION_LOCAL_API_KEY` generation
  and persistence (`automation-api-key.txt`); `localApiKey` is set to
  `sessionApiKey` so both backends receive the same value
- Static build: stopped baking `VITE_AUTOMATION_API_KEY` (the frontend
  reads from `VITE_SESSION_API_KEY`)
- Docker entrypoint: `OPENHANDS_AUTOMATION_API_KEY`,
  `AUTOMATION_LOCAL_API_KEY`, and `AUTOMATION_AGENT_SERVER_API_KEY` all
  default to the session key when not explicitly overridden
- Tests updated to verify unified key behavior

Fixes the 401 on `/api/automation/v1` when the automation backend is
running but no separate `VITE_AUTOMATION_API_KEY` was configured.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: use X-Session-API-Key header for automation backend auth (consistent with agent-server)

Switch automation backend requests from `Authorization: Bearer …` to
`X-Session-API-Key` header, matching the agent-server's auth pattern.
Both backends now authenticate using the same header and the same key
value (`VITE_SESSION_API_KEY`).

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: address review — remove localApiKey alias, dead constant, add entrypoint guard

- Remove `localApiKey` from config; all call sites now use
  `config.sessionApiKey` directly, making the unified-key intent obvious.
- Delete `DEFAULT_AUTOMATION_API_KEY_PATH` constant and its export
  (no downstream consumers in beta).
- Add fail-fast guard in docker/entrypoint.sh when no session key is
  available, instead of silently exporting empty strings.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: update stale comment on AUTOMATION_LOCAL_API_KEY to reflect unified session key

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-05-26 22:15:27 +00:00
Rohit Malhotraandopenhands 45da5606d6 fix: bump agent-server SDK to 1.23.1 (#782) 
Fixes two bugs in the upstream agent-server SDK v1.23.0 that caused
500 Internal Server Error on POST /api/conversations:

1. LLM registry duplicate usage_id: The condenser and main agent LLMs
   both used usage_id='default', causing ValueError on conversation
   creation. v1.23.1 checks for existing usage IDs before registering.

2. Validation error handler crash: The _validation_exception_handler
   tried to JSON-serialize raw ValueError objects from Pydantic
   validation contexts, turning 422 errors into 500s. v1.23.1 properly
   sanitizes validation errors before serializing.

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-05-26 18:42:17 +00:00
simonrosenbergClaude Opus 4.7Debug Agent
 		cc63f48a07 refactor(acp): source ACP model lists from typescript-client (closes #740) (#775) 
* refactor(acp): source model lists from typescript-client registry

Replace the hand-mined CLAUDE_MODELS / CODEX_MODELS / GEMINI_MODELS lists (and
the duplicated provider metadata) with the @openhands/typescript-client ACP
registry, which mirrors the Python SDK source of truth
(openhands.sdk.settings.acp_providers). acp-providers.ts becomes a thin
adapter: it enriches each upstream record with Canvas-only UI fields (brand
icon + onboarding description) and keeps the helper functions + public export
surface unchanged, so no consumers change.

- Bump the @openhands/typescript-client pin to the #187 merge commit
  (082d4d46), which adds available_models / default_model to the registry.
- Delete the three hardcoded model lists; build ACP_PROVIDERS from
  getAcpProvider() + a small ACP_PROVIDER_UI map.
- Incidentally corrects the Gemini default to auto-gemini-2.5 (the CLI's
  auto-router default), matching the merged SDK/client.

Closes #740.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(acp): pin typescript-client to v1.23.2 tag (was SHA)

Now that typescript-client v1.23.2 is tagged/released (includes #187's ACP
registry, mirroring SDK #3389), pin to the tag instead of the raw #187 merge
SHA. v1.23.2 tracks the SDK's v1.23.2 patch line. Resolves to the same commit
as the prior SHA, so no resolved-content change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci(acp): remove obsolete ACP providers sync check

The acp-providers-sync workflow + scripts/check-acp-providers-sync.mjs existed
to keep Canvas's hand-kept ACP registry mirror in sync with the SDK source
(agent-canvas#587). That mirror is gone — acp-providers.ts now sources its
model data from @openhands/typescript-client, which carries its own
SDK-drift check (check-acp-drift.py). So this canvas-side check is redundant
and was failing on the refactored ACP_PROVIDERS (no longer a literal array).

- Delete .github/workflows/acp-providers-sync.yml + the script.
- Drop the docs-version-sync test case that asserted the script's example.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Debug Agent <debug@example.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-26 19:25:08 +02:00
Tim O'Farrellandopenhands c9616c1153 fix: pin openhands-sdk to same version as other SDK packages (#772) 
Add openhands-sdk==${VERSION} to the --with list in both PyPI
resolution branches (specific version and default) of
buildAgentServerCommand so all four packages are pinned to the
same versions.agentServer:

  openhands-agent-server, openhands-sdk, openhands-tools, openhands-workspace

Without this pin, openhands-sdk floated to the latest release on
PyPI (a transitive dep with no version bound in the published
openhands-agent-server metadata), causing non-reproducible builds
and version skew between the banner and defaults.json.

The local-path (editable) and git-ref branches are unaffected —
they already source all packages from the same checkout/ref.

Update the two affected unit-test cases to expect the new pinned
openhands-sdk entry in the args array.

Fixes #767

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-05-26 15:38:53 +00:00
Hiep Le e54b04cf38 chore: refresh stale 1.22.1 doc examples after agent-server bump to 1.23.0 (#694) 2026-05-21 12:49:04 +07:00
FraterCCCLXIIICursorhieptl
 		59058c7609 fix(ui): left navigation rail, mobile drawer, and responsive chrome (#623) 
* fix: archived row icon, default-local config sync, and dockerless dev fixes

Archived MISSING sandboxes show an archive icon in the status column instead of a gray dot and pill; ERROR sandboxes keep the error pill. Harden port checks and automation CORS for alternate frontend ports, set agent-server HOME to the host home on macOS, sync legacy agent-server config when editing the default-local backend, and clarify static stack rebuild/skip-build behavior.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): sidebar conversation list flush to rail with stable gutter

Drop expanded aside `md:pr-0` so the thread scrollbar aligns with the rail
while nav, logo row, and footer keep horizontal padding. Use scrollbar-gutter
on the conversation list for consistent right inset with or without overflow.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): 40px backend selector and non-italic combobox text

Pin the backend Dropdown trigger to h-10, add an italicPlaceholder escape
hatch, and force upright type for value/placeholder in the selector. Add a
subtle top border above Add Workspace in the new-conversation menu.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): full-bleed sidebar footer divider to left rail

Pull the backend block border past aside `pl-2` with matching width calc;
keep inner `px-2` so controls stay aligned with nav.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): align context menus with sidebar filter menu and muted row icons

Match list padding, border, and shadow to the conversations filter surface;
use theme foreground/muted tokens; reserve leading icons as muted until row
hover/focus. Simplify list-item rows and remove unused context-menu height
constant.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): unify menu dividers, section labels, and filter actions

Standardize full-bleed menu dividers via Divider inset="menu", give filter
menu section headings consistent pt-1 padding, and add icons to hide/show
and delete-all rows in the conversation panel filter menu.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): rename sidebar conversations link to New Chat

The /conversations nav entry should read "New Chat" instead of "Code" to match user expectations for starting a conversation.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): polish cloud new-thread popover search and repo list

Use a flat search row with icon and menu divider, align horizontal padding with list items, and show a custom scrollbar on the repository list.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): unify filter menu section headings and action icons

Share pt-1 section label padding via MenuHeading, fold hide/delete rows into
MenuRow with Eye and Trash icons, and add a regression test for both actions.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): add settings tooltip and neutral delete-all row

Show a white hover tooltip on the backend selector settings button and
style Delete all like other filter menu actions instead of danger red.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): theme scrollbars/skeletons and improve settings tooltips

Derive scrollbar colors from the cool-grey scale, use interactive-active
for skeleton loaders, and fix settings tooltip placement when the drawer
is open plus collapsed-sidebar coverage.

Co-authored-by: Cursor <cursoragent@cursor.com>

* feat(ui): replace mobile top nav with left drawer

On small screens, hide the horizontal sidebar strip and open the full
vertical nav from a top-bar chevron toggle, matching the desktop collapse
control icon.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): restore mobile page gutters and center home title

Apply 14px horizontal padding in the root outlet on mobile, keep
conversation full-bleed, and center the home heading with w-full text-center.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): correct mobile nav icons and home title line height

Use PanelLeft for the mobile menu trigger, ChevronLeft to close the
drawer, and relax the home headline leading when it wraps.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): remove border under mobile nav menu bar

The top-bar menu trigger no longer draws a divider above page content.

Co-authored-by: Cursor <cursoragent@cursor.com>

* feat(ui): mobile settings/customize hubs and animated nav drawer

On mobile, Settings and Customize open list hubs matching desktop left nav;
detail pages show drawer and back controls in the top bar. The slide-out nav
drawer now animates open and closed with a fading scrim.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): keep sidebar icons aligned when collapsing the rail

Use shared h-10 row geometry and a fixed icon column so collapsed and
expanded states share padding and gap; labels clip instead of recentering.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): stabilize collapsed sidebar icon column and hover targets

Use a shared 18px icon slot in both rail states, square collapsed
controls for hover/active, and symmetric rail padding so icons and the
logo stay aligned without full-width row highlights.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): refine collapsed sidebar slots and empty-list load-more

Use consistent px-2.5 rail padding with 40×40 collapsed icon slots via
SidebarCollapsedIconSlot, fix backend dot anchoring and logo alignment,
and hide “Load more” when no conversations are visible after filtering.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): keep conversations header on one line during sidebar resize

Use flex-nowrap with a truncating title so the toolbar row does not wrap
while the drawer animates, and nudge the collapsed backend status dot up-left.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): align DropdownMenu padding and tighten backend footer actions

Use uniform `p-1` on the combobox menu panel to match other menus, and
remove vertical gap between Add/Manage backend items in the selector footer.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): trim vertical padding on cloud repo search row

Drop wrapper `py-1` so the new-conversation repo search aligns with the
dropdown chrome; horizontal inset stays `px-2`.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): flush cloud repo menu divider against search and list

Drop flex `gap-1` on the popover so the rule sits tight to the search row
and repository list; keep tab stripe spacing with `py-1` on the provider row.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): show backend settings tooltip above when sidebar is expanded

Use `useSidebarCollapsed()` so the gear tooltip uses top placement on the
full-width rail while keeping left placement for the icon-only strip unless
the conversation right drawer is open.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): use full-screen route for mobile tools panel and tidy conversation chrome

Restore horizontal inset on the conversation route, fold the sidebar opener into the chat header, and open Files/Tools via `/conversations/:id/panel` with a dedicated back affordance instead of a bottom sheet.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): only show sidebar drawer toggle when the rail is hidden

The hamburger used the 1024px layout breakpoint while the sidebar stays visible from the `md` rail width up, so it duplicated chrome between tablet widths. Gate the toggle and header padding on the same max-md width as the rail (<=767px). Mirror the right-panel icon horizontally for the right-side drawer.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): align mobile conversation chrome, chat padding, and settings scroll

Unify mobile top-bar icon buttons with shared classes; add compact conversation
tabs and consistent horizontal padding for chat plus stable composer/git chrome.
Move settings and extensions horizontal inset into layout helpers and drop the
root outlet gutter so pages control their own padding.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): home mobile padding and Lucide sizes in chat mobile header

Add px-4 to the home shell on small viewports and shift launcher inset to
md+ only. Pin PanelLeft/ChevronLeft to 20px to match the right-panel icon and
restore chat header left inset when the rail menu toggle shows.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): use block-drawer icon for mobile sidebar toggle

Match the right-panel control’s SVG so both header icons share the same
optical weight instead of Lucide PanelLeft filling the hit target.

Co-authored-by: Cursor <cursoragent@cursor.com>

* refactor: remove unrelated file

* refactor: remove unrelated files

* fix: failing tests

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: hieptl <hieptl.developer@gmail.com>
 2026-05-21 02:18:19 +07:00
Hiep Le f42d684a03 fix(frontend): validate OH_AGENT_SERVER_LOCAL_PATH in dev-with-automation (#650) 
* fix: validate OH_AGENT_SERVER_LOCAL_PATH in dev-with-automation

* fix: failing tests
 2026-05-20 15:29:24 +07:00
Rohit Malhotraandopenhands 979e64fe19 feat: add Docker CI to build all-in-one image with agent-server + automation + frontend (#634) 
* feat: add Docker CI to build all-in-one image with agent-server + automation + frontend

Adds a GitHub Actions workflow (.github/workflows/docker.yml) that builds and
publishes ghcr.io/openhands/agent-canvas — a single Docker image combining:

  1. Agent Server (ghcr.io/openhands/agent-server base image from SDK repo)
  2. Automation server (pip-installed from openhands-automation)
  3. agent-canvas frontend (static build from this repo)

The automation server is pip-installed rather than copied from its Docker image
because both services share openhands-sdk, fastapi, uvicorn, pydantic, httpx
etc. — installing into the agent-server's Python 3.13 deduplicates all shared
packages. Only automation-specific deps (asyncpg, sqlalchemy, boto3, …) are
added on top.

An entrypoint script starts all three services and a static-server proxy that
unifies them behind a single port (default 8000):
  /api/automation/* → automation backend (:18001)
  /api/*            → agent-server (:18000)
  /*                → static frontend + SPA fallback

Workflow triggers:
  - Push to main: builds and pushes with branch + SHA tags
  - v* tags (releases): also pushes semver tags (1.2.3, 1.2, 1, latest)
  - PRs: builds, pushes SHA-tagged image, updates PR description with
    pull/run instructions (same pattern as the SDK repo)
  - workflow_dispatch: supports overriding base image and automation version

Files added:
  - docker/Dockerfile (multi-stage: frontend build + agent-server base)
  - docker/entrypoint.sh (process manager for all three services)
  - .dockerignore
  - .github/workflows/docker.yml

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: build multi-arch Docker images (amd64 + arm64)

Adds QEMU setup for cross-compilation and defaults the platform matrix
to linux/amd64,linux/arm64 so the image works on both Intel and Apple
Silicon machines.

Co-authored-by: openhands <openhands@all-hands.dev>

* refactor: rewrite Docker workflow to match SDK repo structure

Replace the single-job QEMU approach with the same architecture-matrix
pattern used by the SDK repo's server.yml:

  1. build-and-push-image — matrix over {amd64, arm64} with native runners
     (ubuntu-24.04 for amd64, ubuntu-24.04-arm for arm64). Each job pushes
     arch-suffixed tags (e.g. sha-abc1234-amd64) and uploads build-info
     artifacts.

  2. merge-manifests — downloads both arch build-infos, strips the -amd64
     suffix from amd64 tags to derive manifest tags, and creates multi-arch
     manifests via `docker buildx imagetools create`.

  3. consolidate-build-info — aggregates all build-info and manifest-info
     artifacts into a single JSON summary (PR-only).

  4. update-pr-description — renders the summary into the PR body between
     AGENT_CANVAS_DOCKER_START/END markers.

Native runners avoid the 3-5× slowdown of QEMU emulation for arm64
builds.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: sanitize branch names in Docker tags (/ is not allowed)

Branch names like 'feat/docker-ci' produce invalid Docker tags because
'/' is forbidden in tag names. Replace '/' with '-' so the tag becomes
'feat-docker-ci-amd64'.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: default automation to SQLite and fix wait blocking proxy startup

Two bugs:

1. The automation server defaults to PostgreSQL on localhost, which
   doesn't exist in the all-in-one container. Default AUTOMATION_DB_URL
   to sqlite+aiosqlite:// so it works out of the box. Users can override
   with a real Postgres URL for production.

2. The bare 'wait' command waited for ALL background children — including
   the long-running agent-server and automation processes — so the
   static-server/proxy on port 8000 never started. Fix by waiting only
   for the wait_for_port subshell PIDs.

Verified locally: all three services start, endpoints respond correctly,
no more scheduler ConnectionRefusedError.

Co-authored-by: openhands <openhands@all-hands.dev>

* feat: add VOLUME directives for persistence and project mounts

Declare /home/openhands/.openhands (settings, secrets, conversations,
automation SQLite DB) and /projects (user code) as Docker volumes so
data survives container restarts by default. Users should bind-mount
these for durable persistence:

  docker run -v ~/.openhands:/home/openhands/.openhands \
             -v ~/projects:/projects \
             -p 8000:8000 ghcr.io/openhands/agent-canvas

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: set OH_SECRET_KEY default and pre-create persistence dirs

Three issues fixed:

1. OH_SECRET_KEY was not set → agent-server refused to return encrypted
   secrets → conversation creation failed with 503. Set the same static
   default used by dev-safe.mjs / dev-docker.mjs.

2. Persistence dirs (conversations, bash_events, automation DB) were not
   pre-created → the openhands user got PermissionError when the VOLUME
   directive created them as root. Pre-create with correct ownership
   before the USER switch in the Dockerfile.

3. Set OH_PERSISTENCE_DIR, OH_CONVERSATIONS_PATH, OH_BASH_EVENTS_DIR
   defaults in the entrypoint (matching dev-docker.mjs) so data lands
   under the well-known ~/.openhands tree.

Verified locally: all three services start clean, no warnings about
OH_SECRET_KEY, SQLite migrations apply successfully.

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: merge main and remove stale dev-docker.mjs references

Main removed scripts/dev-docker.mjs (Docker is no longer a dependency of
the npm package flow). Update comments in docker.yml, entrypoint.sh, and
AGENTS.md that referenced the deleted file.

Co-authored-by: openhands <openhands@all-hands.dev>

* feat: centralize config into config/defaults.json (single source of truth)

All version pins, port defaults, persistence paths, package names, and
the dev secret key now live in config/defaults.json. Consumers read from
it instead of hardcoding values:

- scripts/dev-safe.mjs: reads via JSON.parse(readFileSync(...))
- scripts/dev-with-automation.mjs: same
- scripts/check-sdk-version-sync.mjs: same (no longer regex-parses JS)
- docker/Dockerfile: config-gen build stage converts JSON to
  /opt/agent-canvas/defaults.env (shell-sourceable)
- docker/entrypoint.sh: sources defaults.env at startup; also adds
  session API key auto-generation so the image doesn't run wide-open
- .github/workflows/docker.yml: reads versions from JSON in a setup
  step (no more hardcoded env vars)

To bump a version, edit config/defaults.json only.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: address PR review feedback (#634)

- Fix PID tracking bug: move PIDS+=($!) inside if/elif branches so the
  else (automation-not-found) path doesn't add a stale PID
- chmod 600 session API key file to prevent credential leak
- Warn when using insecure default OH_SECRET_KEY in Docker entrypoint
- Add try/catch + field validation for config/defaults.json loading in
  check-sdk-version-sync.mjs
- Fix semver tag parsing: strip pre-release/build metadata, only create
  abbreviated tags (major.minor, major, latest) for stable releases
- Sanitize branch names for Docker tags (tr invalid chars, strip leading
  dot/dash) to handle branches with #, @, spaces, etc.
- Add arch validation before manifest merge (assert both amd64.json and
  arm64.json exist)
- Remove $schema reference to non-existent defaults.schema.json

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: remove hardcoded version defaults from Dockerfile

Replace hardcoded ARG defaults (AGENT_SERVER_IMAGE, AUTOMATION_VERSION)
with empty ARGs. Values are always derived from config/defaults.json:
- CI: reads JSON in the workflow config step, passes --build-arg
- Local: new scripts/docker-build.mjs helper reads JSON and invokes
  docker build with the correct --build-arg values

Added npm run build:docker convenience script.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: stabilize snapshot tests and auto-generate Docker secret key

Two fixes:

1. **Flaky snapshot tests**: The 'Local pagination fixture' mock conversation
   used a fixed absolute timestamp (PAGINATION_BASE_TIME = May 13, 2026) for
   its created_at/updated_at, while 'Errored Project' used a relative
   timestamp (now - 7d). As real time progressed past the crossover point,
   their sort order in the sidebar flipped, causing 30/73 snapshot diffs on
   every PR. Fix: use relative timestamps (now - 6d) for the pagination
   fixture's conversation listing fields. The internal event timestamps
   (used by pagination tests) still use PAGINATION_BASE_TIME — only the
   sidebar ordering is affected.

2. **Docker OH_SECRET_KEY**: The entrypoint used a static insecure default
   for OH_SECRET_KEY and warned about it. Now mirrors the session API key
   pattern: auto-generate a cryptographic random key on first run, persist
   it to ~/.openhands/agent-canvas/secret-key.txt, and reuse on restart.
   Users can still override via the OH_SECRET_KEY env var. Removed the
   now-unused CONFIG_SECRET_KEY from the Docker defaults.env generation.
   Also deduped STATE_DIR computation (was repeated for session key path).

Co-authored-by: openhands <openhands@all-hands.dev>

* docs: update AGENTS.md with mock timestamp and Docker secret key notes

Co-authored-by: openhands <openhands@all-hands.dev>

* fix: include canvas_ui tool in Docker image

The Docker image was missing the tools/ directory and OH_EXTRA_PYTHON_PATH,
so the agent-server couldn't import canvas_ui_tool.py when the frontend
sent canvas_ui in the conversation tools list. This caused:

  HTTP 500: ToolDefinition 'canvas_ui' is not registered

Fix: COPY tools/ into the image and set OH_EXTRA_PYTHON_PATH in the
entrypoint, matching what scripts/dev-safe.mjs already does for local dev.

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-05-20 04:24:45 +00:00
Rohit Malhotraandopenhands edb998220a Remove Docker dependency from dev workflow (#635) 
- Delete scripts/dev-docker.mjs and its test
- Simplify package.json: 'npm run dev' now runs local uvx stack directly
  (agent-server + automation + Vite + ingress), no Docker needed
- Remove dev:docker, dev:docker:dynamic, dev:dangerously-dockerless scripts
- Add dev:static for production-build frontend variant
- Update bin/agent-canvas.mjs CLI to use uvx-based stack
- Rename Docker-specific variables: DOCKER_PROJECTS_PATH → PROJECTS_PATH,
  shouldDefaultToDockerProjects → shouldDefaultToProjectsPath
- Update i18n: HOST_HOME_NOT_MOUNTED_HINT no longer references Docker
- Update all docs (README, DEVELOPMENT, SELF_HOSTING, AGENTS.md, CHANGELOG)
- Rename e2e snapshot: docker-workspace-browser → projects-workspace-browser
- Fix all tests to reflect new script names and remove Docker references

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-05-19 15:27:25 -04:00
Graham Neubigopenhandsallhands-bot
 		90ad71dbd9 Add recommended automations and MCP marketplace setup flow (#504) 
* Add recommended automations marketplace flow

Co-authored-by: openhands <openhands@all-hands.dev>

* Update GitHub MCP QA findings

Co-authored-by: openhands <openhands@all-hands.dev>

* Polish MCP and automation marketplace UI

Add a shared MCP logo badge, make marketplace cards more compact, and show required MCP logos prominently on recommended automation cards. Update the extensions package lock to the per-entry catalog split and save QA screenshots/results in .pr/.

Co-authored-by: openhands <openhands@all-hands.dev>

* Align recommended automations styling

Remove the custom gradient treatment and match the recommended automation cards and setup modal to the existing Automations and MCP page surfaces, spacing, borders, and typography.

Co-authored-by: openhands <openhands@all-hands.dev>

* Show existing automations before recommendations

Move the recommended automations section below the current automation list and creation guidance so the page prioritizes the user existing automation state.

Co-authored-by: openhands <openhands@all-hands.dev>

* Add recommendations to onboarding

Show recommended automations below the Say Hello input so new users can launch a curated automation from the final onboarding step.

Co-authored-by: openhands <openhands@all-hands.dev>

* Use extensions MCP marketplace exports

Remove the local MCP marketplace wrapper and consume MCP catalog data plus logo mappings directly from @openhands/extensions/mcps.

Co-authored-by: openhands <openhands@all-hands.dev>

* Archive previous PR QA and add refreshed artifacts

Co-authored-by: openhands <openhands@all-hands.dev>

* Add scheduled automation QA evidence

Co-authored-by: openhands <openhands@all-hands.dev>

* Streamline recommended automation launch

Co-authored-by: openhands <openhands@all-hands.dev>

* Refresh QA evidence and remove old artifacts

Co-authored-by: openhands <openhands@all-hands.dev>

* Ensure canvas tools are on Python path

* Require MCP installs before launching recommendations

* Remove archived PR artifacts

* Drop redundant PYTHONPATH launcher changes

* Inline recommended automation catalog

* Point extensions dependency at main

* Augment recommended automation prompts with explicit API instructions

When a recommended automation is selected, the pre-filled prompt now
includes backend-specific API instructions so the agent calls the
correct endpoint:

- Local backends: directs the agent to use the local automation API
  from <RUNTIME_SERVICES> with $OPENHANDS_AUTOMATION_API_KEY auth,
  and explicitly tells it NOT to call the cloud API at app.all-hands.dev.

- Cloud backends: directs the agent to use the OpenHands Cloud
  Automations API at app.all-hands.dev with Bearer $OPENHANDS_API_KEY.

The buildAutomationPrompt() helper is exported for testability.
Three new unit tests cover both backend kinds and prompt preservation.

Co-authored-by: openhands <openhands@all-hands.dev>

* Fix recommended automation launch regressions

Co-authored-by: openhands <openhands@all-hands.dev>

* Expose local automation API key to agent terminals

Co-authored-by: openhands <openhands@all-hands.dev>

* Stabilize conversation panel stop menu test

Co-authored-by: openhands <openhands@all-hands.dev>

* chore: Remove PR-only artifacts

* fix: pin @openhands/extensions to specific commit for reproducibility

Updates the dependency from #main to the exact commit SHA
(3bba8e3b) that contains the MCP and automation catalogs
added in extensions#237.

This ensures reproducible builds since npm ci will use the
locked SHA instead of potentially picking up a newer main.

* Address final automation marketplace review comments

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>
Co-authored-by: allhands-bot <allhands-bot@users.noreply.github.com>
 2026-05-19 15:04:53 -04:00
simonrosenbergDebug AgentClaude Opus 4.7
 		56fc790076 ci: detect drift between TS ACP_PROVIDERS mirror and SDK source (#630) 
Closes #587.

PR #416 introduced src/constants/acp-providers.ts as a hand-kept
TypeScript mirror of the Python registry in
openhands-sdk/openhands/sdk/settings/acp_providers.py
(OpenHands/software-agent-sdk). Drift between the two is hazardous:
during PR #416's E2E we briefly shipped
["npx","-y","@openai/codex","acp"], which is not a valid ACP server,
and the agent-server deadlocked on the handshake instead of failing
loudly.

This commit adds the minimum infrastructure to catch that class of
drift before it lands:

- scripts/check-acp-providers-sync.mjs fetches the SDK file (from a
  configurable ref, default `main`), parses both registries with a
  string-aware brace matcher, and diffs them on the three fields
  canvas mirrors: key, display_name, default_command. The richer SDK
  record (api_key_env_var, session mode, agent_name_patterns, etc.)
  is intentionally not compared because canvas does not mirror it.
  --sdk-file lets the script run offline against a local SDK
  checkout for development.
- .github/workflows/acp-providers-sync.yml runs the check on PRs
  touching the mirror or the script, on push to main, on a daily
  cron (to catch SDK-side drift that did not ping us), via
  workflow_dispatch, and via repository_dispatch (so the SDK repo
  can trigger us when it changes acp_providers.py — payload key
  `sdk_ref`).

Co-authored-by: Debug Agent <debug@example.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-19 15:46:01 +02:00
simonrosenbergClaude Opus 4.7Debug Agent
 		f0c36bac8f feat(acp): Settings → Agent + onboarding + chat-UI gating for ACP-driven conversations (#416) 
* feat(acp): add minimal ACP agent UI (parity with OpenHands#14401)

Adds a Settings → Agent page so users can switch the conversation
between the built-in OpenHands agent and an external ACP (Agent Client
Protocol) subprocess (Claude Code, Codex, Gemini CLI, or custom command)
without hand-editing settings.

Discriminates in agent-server-adapter: when `agent_settings.agent_kind
=== "acp"`, build an `ACPAgent` payload (kind, acp_command, acp_model)
instead of the LLM-shaped Agent, and skip the LLM defaults that would
otherwise be rejected as extras. Stamps the provider key onto
`tags.acpserver` so the chip can resolve a brand name from a single
source.

Tag-key constant note: the conventional `acp_server` form is invalid —
agent-server validates tag keys against `^[a-z0-9]+$` and returns 422.
The flattened `acpserver` form survives validation; the named constant
`ACP_SERVER_TAG_KEY` keeps the regex and the key colocated.

Gates the LLM and Condenser nav items behind a `disabledByAcp` flag,
greys them out with a tooltip, and redirects to `/settings/agent` in
the settings loader (not a per-route useEffect, so there is no one-
frame flash of the LLM page before bouncing).

E2E validated against `ghcr.io/openhands/agent-server:fa29ae2-python`:
- PATCH /api/settings with `agent_kind: "acp"` round-trips
- POST /api/conversations with the adapter's ACP payload returns 201,
  `agent.kind=ACPAgent`, `acp_command` preserved, tags stamped.

Closes #412

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(acp): wire onboarding ChooseAgent step into ACP settings

Drops the "Support for other agents coming soon!" banner now that
the support exists. Enables the Claude Code / Codex tiles and adds a
Gemini CLI tile so the four options here match ``ACP_PROVIDERS`` from
the Settings → Agent page.

Selecting an ACP option and clicking Next persists ``agent_kind:"acp"``
plus the registry provider key (``acp_server``) via ``useSaveSettings``,
mirroring the diff the Settings page emits. The advance only happens
on save success — a failed PATCH stays on the step and surfaces a toast.

Skips the embedded LLM-setup step (index 2) on both forward and back
navigation when an ACP agent is active: the subprocess owns its own
LLM and authenticates through Secrets, so the form has nothing to
configure. OpenHands path is untouched.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(acp): seamless Claude Code + Codex CLI auth via dev-docker

Live-validated against `ghcr.io/openhands/agent-server:1.22.1-python`
(the canvas's default pin, which now ships ACPAgent natively — no
SHA override needed). Two changes surfaced by the run:

1. **Mount `~/.claude.json` in dev:docker.**  Recent Claude Code CLI
   versions persist auth + workspace state in `~/.claude.json` next
   to (not inside) `~/.claude/`.  Without this single-file mount,
   `@agentclientprotocol/claude-agent-acp` can't see the user's
   existing login and prompts to re-auth inside the sandbox.

2. **Use the new ACP package name in `ACP_PROVIDERS`.**  Upstream
   renamed `@zed-industries/claude-code-acp` → `@agentclientprotocol/
   claude-agent-acp`.  The old name still works but emits an npm
   deprecation warning; the agent-server's own OpenAPI example uses
   the new name.  Test fixtures pinning the legacy name updated to
   match.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(acp): import ACP_PROVIDERS from typescript-client

Canvas was carrying its own copy of the ACP provider registry, which
drifted out of sync with the canonical Python SDK source and ended up
encoding an invalid Codex invocation (``@openai/codex acp`` — codex
CLI has no ``acp`` subcommand, so the spawn deadlocked silently with
``Error: stdin is not a terminal`` and no log line).

This change deletes ``src/constants/acp-providers.ts`` and imports the
registry from ``@openhands/typescript-client`` instead, which now
mirrors the Python SDK (see OpenHands/typescript-client#167). The TS
SDK pin in ``package.json`` is bumped to the PR-branch SHA
(``45a803c``) for now; once #167 merges and a new tagged release is
cut, the pin can flip to the tag in a follow-up commit.

Shape changes consumers needed to absorb:
- ``ACPProviderConfig[]`` → ``Record<string, ACPProviderInfo>``
  (lookup by key replaces ``.find``; ``Object.values`` where an array
  is needed)
- ``display_name`` → ``displayName`` (camelCase matches TS conventions)
- ``default_command`` → ``defaultCommand`` (and now ``readonly string[]``;
  components spread into a fresh array before passing to consumers that
  expect mutability)

``ACP_CUSTOM_PRESET_KEY`` is the only ACP-related constant that stays
canvas-local — it's a synthetic sentinel for the "Custom" dropdown
option, not a real provider, so it has no SDK counterpart. Moved to
``src/constants/acp-presets.ts``.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* revert(acp): keep ACP_PROVIDERS local to canvas

Reverts the brief detour through `@openhands/typescript-client` for
the ACP provider registry.  Splitting the registry across two repos
adds publish-coordination friction and doesn't actually eliminate
the drift problem — it just moves it from
"canvas vs. python-sdk" to "ts-sdk vs. python-sdk", with extra steps.

Now:

- `src/constants/acp-providers.ts` is the canvas-local copy again,
  with the corrected `codex` command (`@zed-industries/codex-acp`,
  the real ACP-protocol stdio server — not `@openai/codex acp`,
  which is the codex CLI's interactive mode and deadlocks the agent
  handshake when spawned without a TTY).
- The package.json pin reverts to `v0.6.0` (the typescript-client
  release that does not include the unmerged `ACP_PROVIDERS` export
  from #167, which is now closed).
- The split `acp-presets.ts` file is folded back in.

Drift risk between this file and the Python SDK source is tracked
in #587, with a longer-term plan to address it (TS-SDK mirror,
code-gen, or runtime endpoint).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(acp): resolve empty acp_command from registry in adapter

PR #416 ships the Settings → Agent page (and onboarding) with a
"default preset" shortcut that stores ``acp_command: []`` and trusts
the agent-server to resolve it from ``acp_server``.  It doesn't.

The agent-server's ``ACPAgent`` model has no ``acp_server`` field and
no registry resolution — it just hands ``acp_command`` straight to a
subprocess spawn.  Empty list trips ``acp_agent.py:1013`` with
``IndexError: list index out of range``, the agent loop dies silently
inside the agent-server's run thread, and the conversation hangs in
``idle`` with the user's message persisted but never answered.  No
error reaches the UI; from the user's perspective they sent a message
and nothing happened.

Caught while exercising the live ``dev:safe`` stack: a fresh
conversation seeded from the onboarding "Claude Code" tile produced
``Failed to start ACP server: list / IndexError: list index out of
range`` in the agent-server log.

The fix is purely client-side — expand ``acp_command`` against
``ACP_PROVIDERS`` (canvas's local mirror of the Python SDK registry,
see #587) before the payload leaves the adapter, when the user picked
a built-in preset.  ``acp_server: "custom"`` and any unknown key are
left untouched — those genuinely depend on the user's explicit
command, and silently inventing one would mask a real config bug.

Three new adapter tests cover:
- ``acp_command: []`` + ``acp_server: "claude-code"`` → command
  resolved to ``["npx","-y","@agentclientprotocol/claude-agent-acp"]``
- ``acp_command`` omitted entirely + ``acp_server: "codex"`` → same
  resolution path
- ``acp_command: []`` + ``acp_server: "custom"`` → left untouched

2273 tests pass, lint + typecheck clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(acp): pass disabled state into SettingsDesktopSidebar

When ACP is the active agent, ``useSettingsNavItems`` correctly tags
the LLM and Condenser entries with ``disabled: true``.  The mobile
drawer (rendered via ``SettingsNavLink``) already respected that.
The desktop sidebar (rendered via ``SidebarNavLink``, came in with
the recent sidebar refactor) was constructing the link without
forwarding the flag, so both items stayed fully clickable / styled
as enabled while the conversation was running on an ACP subprocess.

Two tiny changes:

1. ``SettingsDesktopSidebar`` passes ``renderedItem.disabled`` through
   to ``SidebarNavLink``.  That alone gives the right visual state
   (``opacity-50``, ``pointer-events-none``) and keyboard behaviour
   (``tabIndex=-1`` + ``onClick preventDefault``) — both already
   implemented by ``SidebarNavLink``.
2. ``SidebarNavLink`` additionally sets ``aria-disabled="true"`` when
   ``disabled``, closing a screen-reader gap that existed independently
   of this regression (the link sounded actionable to assistive tech
   even though it wasn't).

The ``clientLoader`` redirect in ``routes/settings.tsx`` continues to
handle direct URL navigation to a disabled-by-ACP page, so even if
someone bookmarks ``/settings/condenser`` and lands there while ACP
is active, they get bounced to ``/settings/agent``.

Two new tests in ``settings-navigation.test.tsx``:
- Disabled-by-ACP items in the desktop sidebar carry ``aria-disabled``.
- Enabled items don't.

2275 tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(acp): address PR #416 review feedback

Addresses both human and all-hands-bot review comments on #416:

**Critical bugs fixed**

- ``acp_args`` duplication on load (bot critical #1): the textarea
  is the single source of truth for the launch tokens, but save only
  wrote ``acp_command`` — any API-set ``acp_args`` survived and
  concatenated at spawn time. Save now always writes ``acp_args: []``.

- ``tokenizeCommand`` corrupted quoted Custom commands (human bug #2):
  ``bash -c "echo hello"`` got split into
  ``["bash","-c","\"echo","hello\""]`` and silently misbehaved. New
  ``src/utils/acp-command.ts`` wraps ``shell-quote`` with selective
  re-quoting (so ``npx -y @org/pkg`` renders verbatim, not ``\@org/pkg``)
  and filters non-string entries (redirects, env-var refs) out of the
  parsed argv. Round-trip tests pin the contract.

- Loader/component settings cache mismatch (bot critical #4): loader
  used ``SETTINGS_QUERY_KEYS.byScope("personal")``; ``useSettings``
  used ``[...byScope("personal"), backend.id, orgId]``. They didn't
  share cache. Aligned + set ``staleTime: 0`` on the loader read so
  cross-tab kind flips are picked up immediately (the in-render hook
  keeps its 5-minute stale window).

- ``getFirstAvailablePath`` ignored the new agent route (human bug #3):
  ``/settings/agent`` now precedes the others in the fallback list,
  so first-time / hide_llm_settings users land on the agent picker
  rather than ``/settings/app``.

- ``ACP_SETTINGS_KEYS`` documentation (human #4): pre-empts the
  "why not trim this list to UI-visible fields" question by spelling
  out that it serves as both the ACP allow-list and the OpenHands
  deny-list — trimming would silently leak API-set ``acp_*`` state.

**Refactor (human #2 + #3)**

- ``description_key`` moves into ``ACP_PROVIDERS``; the onboarding
  ``AGENT_OPTIONS`` is now derived from the registry so adding a new
  provider only needs one edit.
- One ``buildAcpAgentSettingsDiff`` helper replaces the two near-copies
  in ``choose-agent-step.tsx`` and ``agent-settings.tsx``; both call
  sites are now under a single contract for the agent_settings_diff
  shape.

**UX (bot)**

- Onboarding progress bar shows the actual visited-step count when
  the LLM step is skipped (3 segments for ACP, 4 for OpenHands).
  Previously segment 2 popped "completed" on a slide the user never
  visited.

**Test coverage (bot)**

- New ``__tests__/utils/acp-command.test.ts`` covers parseCommand /
  formatCommand round-trips, quoted args, embedded escapes, shell-
  operator filtering, package-style tokens.
- Adapter: empty ``acp_model: ""``, unknown ``acp_server`` key,
  ACP→OH→ACP round trip (no field leakage either direction).
- agent-settings: cleared input keeps Save disabled, whitespace-only
  same, full Custom command with quoted args round-trips through
  shell-quote.
- choose-agent-step: provider switching (claude-code → codex) rebuilds
  the diff cleanly, no leak from the prior selection.

**Acknowledged (no action)**

- Bot critical #2 (supply chain drift) — same problem as the existing
  agent-canvas#587, already tracked.
- Bot critical #3 (desktop sidebar disabled) — fixed in 27a3e79 a few
  commits before this review was written; review snapshot was stale.
- Translation duplication (human #1) — matches the existing
  ``translation.json`` convention (every key has all 15 locales).
- Option-bag → split functions (human #5) — cosmetic; defer.

2292 tests pass, lint + typecheck clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(acp): pre-bundle shell-quote so the Vite dev server can load it

``shell-quote`` is a CommonJS module that does ``module.exports = {
parse, quote }``. The previous commit wired it into ``src/utils/
acp-command.ts`` with a named ESM import, which the dev server
rejected on the first ``agent-settings.tsx`` load:

    SyntaxError: The requested module '/node_modules/shell-quote/
    index.js?v=...' does not provide an export named 'parse'

Switching to a namespace import (``import * as shellQuote from
"shell-quote"; const { parse, quote } = shellQuote;``) makes the
named-export check pass, but Vite then served the raw CJS file
to the browser unchanged and the next request died with:

    ReferenceError: exports is not defined

This second failure is because ``vite.config.ts`` sets
``optimizeDeps.noDiscovery: true`` — new dependencies must be listed
in ``optimizeDeps.include`` or Vite won't run them through its
CJS-to-ESM prebundler. Adding ``"shell-quote"`` there fixes it; the
existing entry has a comment block explaining the same constraint
for other deps. The Rollup-based prod build was unaffected.

Verified: dev server boots clean, ``GET /settings/agent`` returns
200, no ``exports is not defined`` in the Vite client log, 9 unit
tests in ``__tests__/utils/acp-command.test.ts`` pass on the Node
test runner (vitest) where the CJS interop already worked.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(acp): address second-pass review on PR #416

Addresses the second all-hands-bot review's critical + improvements:

**Critical: load path mis-merged acp_command + acp_args**

Settings stored with the registry-default shortcut (``acp_command:
[]``, ``acp_server: "claude-code"``) plus a non-empty ``acp_args``
showed only the args in the textarea — no registry prefix. Saving
then sent ``acp_command: ["--extra-arg"]`` and flipped the preset
to ``custom``, silently losing the ``npx -y @agentclientprotocol/
claude-agent-acp`` prefix. The fix expands the registry default
*before* concatenating with args, so the textarea always shows
the full launch command and round-trips cleanly.

**Improvement: formatCommand drops empty-string args**

``formatCommand(["bash", "-c", ""])`` rendered as ``"bash -c "``
which parsed back to ``["bash", "-c"]``, silently losing the empty
slot. Now quotes empty tokens explicitly so they survive.

**Improvement: desktop sidebar disabled tooltip parity**

Mobile drawer's ``SettingsNavLink`` already showed "Disabled while
{agentName} is active" on greyed-out items; the desktop
``SidebarNavLink`` had no explanation. Added a ``disabledReason``
prop (i18n-agnostic; the caller formats the string) and wrap with
``StyledTooltip`` when disabled-with-reason. ``SettingsDesktopSidebar``
now forwards the formatted message — same UX on both surfaces.

**Test coverage gaps the bot flagged**

- ``agent-settings``: new regression guard for ``acp_command:[]`` +
  non-empty ``acp_args`` load (would have caught the critical bug
  above).
- ``acp-command``: empty-string round-trip case + explicit assertion;
  five more shell-operator filters (pipe, ``;``, ``&&``, ``||``,
  ``>>``).
- ``settings-navigation``: desktop sidebar wraps disabled items in
  StyledTooltip when ``disabledReason`` is supplied; not when omitted.

Plus a clean merge from ``origin/main`` (one-line import conflict
in ``agent-server-adapter.ts``).

2350 tests pass, lint + typecheck clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(acp): address third-pass review on PR #416

- parseCommand: try/catch around shell-quote.parse so a malformed
  command in the textarea can't crash Settings → Agent mid-render
- Rewrite shell-metasyntax tests to pin the *actual* shell-quote
  behaviour (it's a parser, not a security filter) — operators,
  globs, and comments are dropped; backticks / $VAR / $(...) survive
  as literal tokens but are NOT expanded at parse time
- Add npm URLs + verification date (2026-05-19) to each ACP_PROVIDERS
  entry so future maintainers can re-check upstream packages
- Document the silent preset-switch behaviour on detectPreset (the
  dropdown follows the textarea; the textarea is the source of truth)
- Use the exported ACP_SERVER_TAG_KEY constant in the adapter test
  so a rename surfaces as a compile error rather than a runtime
  schema mismatch
- Restore the canonical typescript-client lock entry (drop the
  git+ssh:// + SHA bump that crept in from a local npm install)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(acp): don't expose LLM-switch UI on ACP conversations

The SDK's ACPAgent carries a sentinel ``llm`` (``acp-managed``) for
cost-attribution only — the real model lives on the ACP subprocess
via ``acp_model`` and isn't visible on ``agent.llm.model``. Without
this fix, ``toAppConversation`` surfaced the sentinel as the
conversation's ``llm_model``, and the chat header's
SwitchProfileButton happily let users "change the model" while the
running Claude-Code / Codex / Gemini subprocess kept its own. A
confusing silent no-op.

Two layers of defence so no future consumer has to re-derive the rule:

  1. Boundary normalisation: ``toAppConversation`` reads the
     pydantic discriminator (``info.agent.kind === "ACPAgent"``),
     surfaces it as ``agent_kind: "acp" | "openhands"`` on
     AppConversation, and nulls ``llm_model`` for ACP. Mirrors
     OpenHands PR #14401.

  2. UI gate: SwitchProfileButton returns null when
     ``conversation.agent_kind === "acp"``. The right control for ACP
     model switching is the ``acp_model`` field on Settings → Agent,
     not this picker.

Tests cover both: a new ``toAppConversation`` case asserts
``agent_kind === "acp"`` + ``llm_model === null`` for an
``{kind: "ACPAgent"}`` payload, and a new SwitchProfileButton case
asserts the button hides for an ``agent_kind: "acp"`` conversation
even when profiles are present.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(acp): bridge Settings → Secrets into the ACP subprocess env

The bare ``payload.secrets`` channel lands in the agent-server's
``secret_registry`` server-side, which the OpenHands ``Agent`` reads
directly — but ``ACPAgent._start_acp_server`` builds its subprocess
env from ``agent_context.secrets``, not from the registry. Without a
bridge, a Settings → Secrets entry like ``ANTHROPIC_API_KEY`` is
silently invisible to the ACP CLI (Claude Code, Codex, Gemini), so
users hit "authentication failed" with no on-screen hint that their
configured secret never reached the subprocess.

Mirror the same LookupSecret map onto
``payload.agent.agent_context.secrets`` when ``acpMode === true``,
so the agent-server's existing env-injection loop picks them up.
The bare ``payload.secrets`` channel is also kept (it serves other
consumers + remains the canonical "conversation secrets" wire). The
mirroring fires only when there's something to bridge; non-ACP
payloads are unchanged.

This is a shim. Once canvas pins to an agent-server build that
includes software-agent-sdk PR #3299 (which teaches ACPAgent to
also read from ``state.secret_registry``), the ``if (acpMode)``
branch can be deleted with no behaviour change.

Tests:
- New: ACP payload mirrors customSecrets onto agent_context.secrets
- New: empty customSecrets does NOT synthesize an empty bridge map
- New: non-ACP payload does NOT get an agent_context.secrets bridge
- All 42 adapter tests pass

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(acp): hide MCP nav + cloud LLM-model fallback while ACP is active

Two ACP-leak fixes the review surfaced:

MCP page reachable + editable under ACP
- The SDK's ``ACPAgent`` rejects ``mcp_config`` on init (acp_agent.py:845)
  and the canvas adapter already strips it from start payloads, but the
  /mcp route and the Extensions nav still let users add / edit / delete
  MCP servers — silent no-ops against the running subprocess.
- Add a ``clientLoader`` on /mcp that bounces to /settings/agent when
  ``agent_kind === "acp"``. Grey out the MCP item in
  ExtensionsNavigation with the same explanatory tooltip the LLM /
  Condenser items already use under ACP.
- Extract the redirect into ``utils/acp-route-guard.redirectIfAcpActive``
  so /settings and /mcp share one cache-key + redirect-target
  definition. settings.tsx's clientLoader now calls into it.

Cloud chat ``ChatInputModel`` falls back to ``settings.llm_model`` for ACP
- ``toAppConversation`` writes ``llm_model: null`` on ACP conversations
  (commit 8f0efe62), but ChatInputModel did
  ``conversation?.llm_model ?? settings?.llm_model``, resurrecting the
  user's default OpenHands model on a Claude-Code conversation and
  linking to /settings (which is itself ACP-disabled). Gate on
  ``conversation?.agent_kind === "acp"`` and return null instead.

Tests:
- New: ExtensionsNavigation greys MCP under ACP, leaves Skills + non-ACP
  clickable
- New: /mcp clientLoader redirects under ACP, returns null otherwise +
  on settings-fetch errors (no redirect-loop)
- New: ChatInputModel returns null for ACP even when settings has a model
- All 18 affected tests pass

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(acp): preserve unknown acp_server on no-op saves + reviewer cleanups

Fourth-pass review (PR #416 review comment 4486154133). Triage:

Fixed:
- **Unknown ``acp_server`` demoted to ``"custom"`` on save** (P1, real
  data corruption). A user with ``acp_server`` set out-of-band to a
  provider canvas's registry doesn't carry yet (e.g. a future provider,
  or one removed from the local mirror) would open Settings → Agent
  and lose the original key on the next Save — ``detectPreset`` routes
  every unknown server to ``ACP_CUSTOM_PRESET_KEY``. Now we capture
  the loaded ``acp_server`` + textarea at load time, and on save —
  when both are unchanged and the loaded key is non-empty,
  non-``"custom"``, and absent from ``ACP_PROVIDERS`` — pass it back
  verbatim via a new ``allowUnknownServer`` opt on
  ``buildAcpAgentSettingsDiff``. Editing the command still demotes
  to ``"custom"`` (user is configuring a new thing, so the preset
  name follows the command).
- **Dead ``...existingContext`` spread** in the ACP secret bridge.
  ``createAgentFromSettings`` never populates ``agent_context`` on the
  ACP branch, so the spread always merged into ``{}``. Direct
  assignment — and a comment explaining why a deep-merge would be the
  wrong direction (ACPAgent only treats ``secrets`` as acp_compatible).
- **Misleading ``$VAR`` test comment**. Reworded to lead with the
  no-leak contract (host env values must not end up in the persisted
  ``acp_command``) rather than the implementation-detail tangent.

Documented but not changed:
- **``acp_args: []`` "data loss" concern** — false alarm. Load merges
  ``acp_command + acp_args`` into the textarea before render; save
  persists the merged tokens as ``acp_command`` with ``acp_args: []``.
  Round-trip is correct. Added an inline comment on the load merge so
  the next reviewer doesn't re-flag the reset.
- **Silent preset migration without user feedback** — by design.
  The dropdown re-derives from the textarea so it always reflects
  what will be saved; adding a toast on every keystroke would be
  noise. Already documented as intentional on ``detectPreset``.

Tracked elsewhere:
- Supply-chain drift / npm verification: agent-canvas#587.
- Gemini onboarding icon: agent-canvas#621.

Tests:
- New: ``preserves an unknown loaded acp_server when the user saves
  without editing``
- New: ``demotes an unknown loaded acp_server to 'custom' when the
  user edits the command``
- All 73 affected tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(acp): stop silently corrupting argv, restore AgentContext, fix home-screen gating

Three real review findings, all wired:

1. ``parseCommand`` silently dropped URL tokens with ``?`` query strings
   (and any other shell-glob metacharacter). Reproducer:

     node acp.js --endpoint https://example.com/acp?tenant=abc

   ``shell-quote.parse`` read ``?tenant=abc`` as a glob pattern and
   emitted a non-string AST node; the ``.filter(string)`` then dropped
   the URL entirely, persisting ``["node","acp.js","--endpoint"]``.
   Replaced ``shell-quote.parse`` with a small custom argv tokenizer
   that handles single/double quotes + backslash escapes and treats
   every other character — ``?``, ``*``, ``$``, ``|``, ``>``, ``#``,
   ``&``, ``;``, ``(``, ``)``, backticks — as literal. The agent-server
   passes the argv straight to ``subprocess.create_subprocess_exec``
   anyway (no shell intermediary), so the literal-only model matches
   what actually happens at spawn time. ``shell-quote.quote`` is
   still used by ``formatCommand`` for output.

2. The ACP path skipped the ``agent_context`` block that the OpenHands
   path seeded with ``load_public_skills`` / ``load_user_skills`` /
   optional ``system_message_suffix``. All three are marked
   ``acp_compatible: true`` on the SDK ``AgentContext`` model — the
   ACP CLI renders them via ``ACPAgent._render_suffix`` — so ACP
   conversations were silently shipping a smaller system prompt than
   OpenHands ones. ``createAgentFromSettings`` now seeds the same
   block on both branches. The secret bridge below merges into that
   block (was overwriting it) so ``{ secrets }`` no longer wipes the
   skill flags.

3. ``ChatInputModel`` and ``SwitchProfileButton`` only checked
   ``conversation?.agent_kind``. On the home screen (and during the
   task-startup window) ``conversation`` is undefined, so the
   per-conversation check missed and both surfaces fell back to
   ``settings.llm_model`` / the LLM-profile picker — even when
   ``settings.agent_settings.agent_kind === "acp"`` made it clear
   the next-created conversation would be ACP. Added a settings
   fallback so both controls hide consistently with the rest of the
   ACP nav gating.

Tests:
- parseCommand: new "preserves URLs with query strings" + "preserves
  URLs with multiple query params" + "preserves shell metacharacters as
  literal argv tokens" cases; the old "filters operator" cases flipped
  to "preserves operator as literal". 17 parseCommand cases pass.
- adapter: assertion on the ACP payload's ``agent_context`` updated to
  expect the skill flags instead of ``undefined``.
- chat-input-model + switch-profile-button: new "hides on the home
  page when ACP is the default agent" cases.
- 83 tests pass across the 5 affected files.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(acp): two chat-rendering UX glitches on streaming ACP tool calls

1. Half-formed ACP tool-call cards flashed in the chat before the
   final state arrived. ACP servers stream multiple events per
   ``tool_call_id`` (status flips ``in_progress`` → ``completed`` /
   ``failed``); the intermediate events carry partial
   ``raw_input`` / ``raw_output`` / ``title``. The previous gate
   suppressed only ``in_progress`` and let ``null`` through (a
   "backwards compat" carve-out for older agent-server builds that no
   longer apply at our pinned version). Streaming intermediates often
   arrive without a status set yet, so they leaked.

   Tighten ``shouldRenderEvent`` to require ``status === "completed" ||
   "failed"``. ``handleEventForUI`` already collapses by
   ``tool_call_id`` in place, so the terminal event lands at the
   original position once it arrives — no flash, no double-render.

2. "Reading Read /Users/foo/bar" — Claude Code emits titles like
   ``"Read /Users/foo/bar"`` for a read tool, and our i18n template
   ``"Reading <cmd>{{title}}</cmd>"`` then doubles up the verb.

   Add ``stripRedundantTitlePrefix`` keyed by ``tool_kind``: read →
   strip ``"Read"``, edit → strip ``"Edit"`` / ``"Write"``, execute →
   strip ``"Bash"`` / ``"Run"``, fetch → strip ``"Fetch"`` /
   ``"WebFetch"``. Boundary-checked via trailing whitespace so a token
   like ``"Reads-from"`` is left alone. English-only on purpose: ACP
   servers are anglophone and emit english titles regardless of the
   user's canvas locale; matching translated verbs would go stale the
   moment a new server is added. Titles already lacking a redundant
   prefix (the OpenHands ACP wrapper, future servers) round-trip
   verbatim — the strip is a no-op there.

Tests:
- ``shouldRenderEvent``: ``null`` status now flips to false +
  comment explains why (treated as in-flight, not legacy).
- New ``stripRedundantTitlePrefix`` describe block covers the four
  tool kinds, the no-op case, the word-boundary guard, ``tool_kind:
  null`` (no strip), and empty titles.
- 53 tests pass across the conversation-events helpers.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(acp): drop React Router type import on /mcp clientLoader (CI build)

CI's ``build:lib`` failed with:

  src/routes/mcp.tsx(3,23): error TS6059: File '.../.react-router/types/
  src/routes/+types/mcp.ts' is not under 'rootDir' '/src'.

``tsconfig.lib.json`` sets ``rootDir: "src"`` and pulls in
``src/components/**/*.tsx``. ``src/components/settings/index.ts``
re-exports from ``routes/mcp-settings``, which imports ``routes/mcp``
— so the lib's typecheck graph reaches ``routes/mcp.tsx`` and trips
on the generated ``./+types/mcp`` import that lives under
``.react-router/types/``, outside the lib's rootDir. (``routes/
settings.tsx`` uses the same import pattern but isn't reachable from
the lib graph, which is why local typecheck passed.)

Drop the type import and declare the loader with no parameters —
matches the existing ``index-redirect`` and ``mcp-settings-redirect``
loader pattern. Test calls collapsed to ``clientLoader()`` to match
the new signature.

``npm run build:lib`` now passes locally; 248 tests pass across the
affected suites.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(acp): tighten adapter comments around SDK refs

Two reviewer-flagged comment fixes:

- ``ACP_SETTINGS_KEYS`` docblock no longer claims there's a matching
  ``ACP_SETTINGS_KEYS`` constant in the Python SDK (there isn't;
  the fields are model attributes on ``ACPAgentSettings``). Reworded
  to "Keep aligned with the ``acp_*`` fields on ``ACPAgentSettings``
  in ``openhands-sdk/openhands/sdk/settings/model.py``" with an
  explicit "no matching SDK constant — hand-maintained" note, and
  cross-linked to the existing #587 drift tracker.

- ``createAgentFromSettings`` now spells out where the
  ``acp_compatible`` markers live on each of the three fields we set
  (``system_message_suffix`` L66, ``load_user_skills`` L80,
  ``load_public_skills`` L89 in
  ``openhands-sdk/openhands/sdk/context/agent_context.py``) plus what
  happens when a future SDK bump drops one (422 at conversation start
  → drop the demoted field, don't wrap a workaround). Line refs are
  brittle by design — they're the tripwire that surfaces a regression
  here rather than in production.

No behaviour change; lint + 42 adapter tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Debug Agent <debug@example.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-19 13:04:45 +00:00
Tim O'Farrellandopenhands 1ee1de48cd fix(dev:docker): use localhost for AUTOMATION_AGENT_SERVER_URL, separate sandbox URL (#609) 
The previous attempt (#603) collapsed the host-side and sandbox-side
agent-server URLs onto a single value, `host.docker.internal:<hostPort>`,
on the assumption that the host's /etc/hosts would alias it back to
loopback. That holds on Docker Desktop macOS but NOT on OrbStack / colima
/ Linux hosts, where `host.docker.internal` only exists inside
containers. On those hosts the automation backend (which runs on the
host via uvx) fails to resolve the URL on its very first `_upload`
call:

  [Errno 8] nodename nor servname provided, or not known

so dispatch never reaches `_start_bash`, and every automation run ends
up with `bash_command_id: NULL`.

Fix:

* Restore `AUTOMATION_AGENT_SERVER_URL` to `http://localhost:<hostPort>`
  in every mode. localhost on the host always resolves to the published
  agent-server port; this is the URL the *backend* uses for HTTP calls.
* Add a new launcher option `sandboxAgentServerUrl` that is exported
  as `AUTOMATION_SANDBOX_AGENT_SERVER_URL`. The automation backend
  (OpenHands/automation#125) uses this to override the AGENT_SERVER_URL
  it exports into the in-sandbox bash chain. In dev:docker this is
  `http://127.0.0.1:8000` — the agent-server's in-container loopback,
  which avoids bouncing through the host port-forward.
* Plumb `sandboxAgentServerUrl` through dev-with-automation.mjs::main
  (mirrors the existing `automationApiHost` / `automationWorkspaceBase`
  pattern) and set it in dev-docker.mjs.
* Older automation backends that don't recognise
  AUTOMATION_SANDBOX_AGENT_SERVER_URL ignore it and fall back to
  AUTOMATION_AGENT_SERVER_URL, so this is forward-compatible.

Dockerless modes (`dev`, `dev:automation`) leave
`sandboxAgentServerUrl` undefined; the backend falls back to
AUTOMATION_AGENT_SERVER_URL, which is correct for them.

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-05-18 19:31:42 -06:00
Tim O'Farrellandopenhands 2ac97d1bd8 fix(dev:docker): container-safe automation paths, hostnames, and AGENT_SERVER_URL alias (#603) 
* fix(dev:docker): set AUTOMATION_WORKSPACE_BASE to a container-safe path

When agent-canvas is started via `npm run dev:docker`, the agent-server
runs in a container but the automation backend runs on the host via uvx.
The dispatcher resolves `AUTOMATION_WORKSPACE_BASE` on the host (where
it expands to the host's $HOME, e.g. /Users/<you>/.openhands/...) and
then embeds that absolute path into a `mkdir -p ...` shell command
that is executed *inside* the agent-server container. The container
has no /Users directory and the non-root user can't write to /, so
every preset automation fails with:

  mkdir: cannot create directory '/Users': Permission denied

Fix:
* Thread a new `automationWorkspaceBase` option through the launcher
  (mirroring the existing `viteWorkingDir` pattern).
* `dev-docker.mjs` now passes `CONTAINER_WORKSPACES_DIR` — the same
  in-container path already used as the agent-server's working-dir
  root, so it's guaranteed to exist and be writable.
* Resolution order for `AUTOMATION_WORKSPACE_BASE` is now:
  1) explicit user env var (wins over everything; previously the
     hard-coded value silently clobbered user-set values)
  2) launcher-provided default (container-safe in docker mode)
  3) host-side fallback under config.stateDir (unchanged for dockerless)

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(dev:docker): route AUTOMATION_BASE_URL through host.docker.internal

In `npm run dev:docker`, the automation backend's `AUTOMATION_BASE_URL`
was hard-coded to `http://localhost:${ingressPort}`. That URL is then:

  1. propagated into each automation sandbox as `AUTOMATION_API_URL`
     (dispatcher.py:213), and
  2. consumed by the auto-generated `setup.sh` inside the sandbox to
     hit `${AUTOMATION_API_URL}/sdk-version`.

The sandbox is a separate Docker container, so `localhost` resolves to
the sandbox itself, not the host ingress. Every preset automation run
therefore failed at the very first step with:

  [setup] ERROR: Failed to fetch SDK version from
  http://localhost:8000/api/automation/sdk-version

Reachability check from inside a container in the same network:

  http://localhost:8000/api/automation/sdk-version          -> 404
  http://host.docker.internal:8000/api/automation/sdk-version -> 200

Fix (mirrors the existing `automationWorkspaceBase` plumbing for the
same host-vs-container class of bug):

* New `automationApiHost` launcher option threaded through main() and
  stamped onto config.
* `dev-docker.mjs` passes `automationApiHost: "host.docker.internal"`.
* `startAutomationBackend` resolves `AUTOMATION_BASE_URL` with
  precedence: user env > launcher-provided host > `localhost`.

Dockerless modes (`dev`, `dev:automation`) are unaffected — they
don't pass `automationApiHost` and fall back to the existing
`http://localhost:${ingressPort}` value.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(dev:docker): expose AGENT_SERVER_URL and SESSION_API_KEY aliases to the sandbox

The OpenHands SDK boilerplate emitted by automation prompt/plugin presets
reads AGENT_SERVER_URL and SESSION_API_KEY in main.py / setup.sh when
calling back into the agent-server from an automation run. The
agent-server itself sets OH_INTERNAL_SERVER_URL at startup and we set
OH_SESSION_API_KEYS_0 via the container/process env, but neither of the
unprefixed aliases the SDK actually reads were defined — so every preset
automation hit ECONNREFUSED / 401 the moment its setup.sh tried to hit
the agent-server.

Mirror the values under their canonical SDK names in both the dockerless
buildAgentServerEnv() (covers dev / dev:automation) and in dev-docker.mjs
containerEnv (covers dev:docker). Inside the dev:docker container the
agent-server always listens on port 8000, and 0.0.0.0 normalises to
127.0.0.1 (matching the agent-server's own OH_INTERNAL_SERVER_URL
construction), so the docker path uses http://127.0.0.1:8000 directly.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(dev:docker): route AUTOMATION_AGENT_SERVER_URL via host.docker.internal

This env var plays a dual role: the automation backend uses it directly
to call the agent-server's upload/bash REST APIs (host-side), and the
same value is exported as AGENT_SERVER_URL into the in-sandbox bash
command that main.py uses to call back. In dev:docker the script runs
inside the agent-server container, so the URL has to be reachable from
both sides.

http://localhost:${agentServerPort} was fine for dockerless modes
(both backend and agent-server live on the host) but broke dev:docker:
from inside the container localhost:${hostPort} doesn't resolve, and
`main.py` failed at the first RemoteWorkspace call.

Reuse the same automationApiHost launcher option already plumbed for
AUTOMATION_BASE_URL (Bug 2): dev:docker passes host.docker.internal, so
the URL works as a loopback alias from the host and bounces back into
the container via the published port-forward from the sandbox side.
Dockerless modes keep the previous `localhost` default.

Co-authored-by: openhands <openhands@all-hands.dev>

* revert: drop SESSION_API_KEY alias from agent-server env

The OpenHands SDK's sanitized_env() strips SESSION_API_KEY from every
bash subprocess as a (cosmetic) defense-in-depth measure, so setting
this alias on the agent-server's process env had no effect on what the
sandbox script actually sees. Worse, it created cross-purposes between
the dev stack (which exports it) and the SDK (which strips it).

Keep the AGENT_SERVER_URL alias — that one is genuinely needed and
isn't subject to filtering. SESSION_API_KEY is now obtained inside the
sandbox script via OH_SESSION_API_KEYS_0 (handled in an accompanying
PR against openhands/automation), which the SDK does not strip.

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-05-18 16:32:38 -06:00
Hiep Leandallhands-bot 3300768da8 chore: remove unused assets, env var, and obsolete script (#564) 
* chore: remove unused assets, env var, and obsolete script

* chore: Remove PR-only artifacts

---------

Co-authored-by: allhands-bot <allhands-bot@users.noreply.github.com>
 2026-05-18 11:15:13 +07:00
Tim O'Farrellandopenhands 0cf58f8657 fix(dev-docker): allow exec on the home tmpfs so stdio MCP servers work (#535) 
Docker's `--tmpfs` flag defaults its mount option set to
`rw,noexec,nosuid,nodev`. When dev:docker overlays the agent-server
container's `/home/openhands` with a tmpfs (so the mapped host user can
own it), it was inheriting that `noexec` flag unintentionally.

That breaks any stdio MCP server installed via npx -- e.g.
`npx -y @modelcontextprotocol/server-github` caches its binary under
`~/.npm/_npx/<hash>/node_modules/.bin/mcp-server-github`, npx then tries
to exec it, and the kernel returns EACCES regardless of the 0755 mode
bits on the file. The user sees:

    sh: 1: mcp-server-github: Permission denied
    Failed to connect to MCP server 'github', skipping
    ...
    MCPError: MCP Connection Failure

and the conversation that triggered it aborts during agent init.

Pass `exec` explicitly to override only the `noexec` default. We keep
`nosuid` and `nodev` (the home dir has no business hosting setuid
binaries or device nodes) so we lose no defense-in-depth beyond what's
necessary to make the supported MCP integration actually function.

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-05-16 21:15:42 -06:00
Engel Nystandopenhands 5c42bd3492 Rename PROJECT_PATH to PROJECTS_PATH (#521) 
* Rename PROJECT_PATH to PROJECTS_PATH

Co-authored-by: openhands <openhands@all-hands.dev>

* Apply suggestion from @enyst

---------

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-05-16 16:20:44 +00:00
Hiep Le 5c33c10b18 feat(frontend): add canvas_ui tool so the agent can drive the UI (#420) 
* feat: add canvas_ui tool so the agent can drive the UI

* refactor: update the code based on feedback

* fix: failing tests

* refactor: update the code based on feedback
 2026-05-16 16:09:43 +07:00
Tim O'Farrellandopenhands b2b71855c6 feat(dev): surface dev-stack runtime services in agent system prompt (#503) 
* feat(dev): surface dev-stack runtime services in agent system prompt

Add a structured 'runtime services' info object that the dev launchers
(`dev:safe`, `dev:automation`, `dev:docker`, and the published
`agent-canvas` binary) propagate to the frontend via
`VITE_RUNTIME_SERVICES_INFO`. The frontend renders it into a
`<RUNTIME_SERVICES>` markdown block and attaches it as
`AgentContext.system_message_suffix` on every `POST /api/conversations`.

This means agents start each conversation knowing exactly what services
exist in the current dev stack (ingress URL, automation backend URL +
`/api/automation` prefix, auth header, etc.), instead of having to probe
or — worse — assume `localhost:8000` is the automation server when it is
actually the Agent Server they are running inside of.

URLs are written from the agent's point of view: dockerless modes use
`localhost`, `dev:docker` uses `host.docker.internal`. When automation
isn't running in the current mode (e.g. `dev:safe`), the block says so
explicitly so agents know to skip `/api/automation` calls.

Co-authored-by: openhands <openhands@all-hands.dev>

* fix(runtime-services): address review feedback on PR #503

- Validate required `agentServerPort` in `buildRuntimeServicesInfo`;
  previously a missing port baked `http://localhost:undefined` into
  the agent's system prompt.
- Skip the automation entry when the supplied `automation` object has
  no `port` (e.g. a bare `{}` from a misconfigured launcher).
- Rename the JSON service key from `vite` to `frontend` and add a
  `kind: "vite" | "static"` discriminator + mode-aware description,
  so static-build dev stacks (`dev:docker`, the published binary, ...)
  no longer surface a misleading "Vite dev server" line in the agent
  system prompt. The renderer still accepts the legacy `vite` key.
- Anchor the "don't guess" warning to the actual agent-server URL from
  runtime info instead of hardcoded `localhost:8000`, since the
  agent-server uses different ports across dev modes (18000 in
  dev:safe, 8000 in dev:docker, ...).
- Plumb `frontendKind` through `buildAutomationRuntimeServicesInfo`
  and stamp `config.frontendKind` in `dev-with-automation.mjs::main`
  so both Vite spawn and static-build paths describe the frontend
  correctly.
- Expand AGENTS.md with the JSON schema of `VITE_RUNTIME_SERVICES_INFO`
  and a concrete example of the rendered `<RUNTIME_SERVICES>` block.
- Tests: assert the new URL-in-warning behavior, the new `frontend` /
  legacy `vite` rendering, the `agentServerPort`-required guard, the
  `automation: {}` skip, and the legacy `vitePort` alias.

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-05-15 20:53:45 -06:00
Tim O'Farrellandopenhands 4db59b8b94 Proxy agent-server FastAPI docs (/docs, /redoc, /openapi.json) through the ingress (#501) 
* feat(ingress): route /docs to the agent server

Add /docs to the list of prefixes proxied to the agent-server in:
  - vite.config.ts (Vite dev server proxy)
  - scripts/dev-with-automation.mjs (ingress + static-server fallback)
  - scripts/dev-static.mjs (ingress + static-server fallback)

Update the explanatory comment in scripts/static-server.mjs to match.

This exposes the agent-server's FastAPI Swagger UI at `/docs` on the
ingress port, alongside the automation backend's existing
`/api/automation/docs`.

Co-authored-by: openhands <openhands@all-hands.dev>

* feat(ingress): also route /redoc and /openapi.json to the agent server

Without /openapi.json, the Swagger UI page served at /docs (added in the
previous commit) renders but fails to load any spec. /redoc is the
FastAPI-served ReDoc alternative and benefits from the same fix.

Routes are added everywhere /docs already is:
  - vite.config.ts (Vite dev server proxy)
  - scripts/dev-with-automation.mjs (ingress + static-server fallback)
  - scripts/dev-static.mjs (ingress + static-server fallback)

Co-authored-by: openhands <openhands@all-hands.dev>

---------

Co-authored-by: openhands <openhands@all-hands.dev>
 2026-05-15 18:46:13 -06:00
Hiep Le 2d5a52d4be chore: bump agent-server default to 1.22.1 (#477) 
* chore: bump agent-server default to 1.22.1

* chore: update OH_AUTOMATION_VERSION

* chore: update DEFAULT_AUTOMATION_SDK_VERSION
 2026-05-16 02:38:59 +07:00
FraterCCCLXIIICursorhieptl
 		e1f5a6662f design: cool-grey palette, runtime theme switcher, and token-system cleanup (#458) 
* fix(conversation): cap chat column width at 800px

Replace responsive max-w-4xl / max-w-6xl with max-w-[800px] so the
middle column stays narrower on large viewports.

Co-authored-by: Cursor <cursoragent@cursor.com>

* feat(chat): Connect Repo CTA and hide empty branch pill

- Use COMMON$CONNECT_REPO with FolderOpen when no repo/workspace is linked
- Show branch control only when selectedBranch is set (drop No Branch)
- Cap chat interface wrapper at max-w-[800px] without right-panel width coupling

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): refine input controls and local auth fallback

Improve chat input pills and model dropdown interactions while ensuring local agent-server auth uses the configured session key for default-local and cloud-proxy calls to avoid stale-key 401s.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): align attachment and placeholder control styling

Move the file-attach trigger into the chat action controls so it sits before Tools, and restyle it as a grey plus button with a circular hover state to match adjacent controls. Also align the chat input placeholder color with the same neutral control tone for visual consistency.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): simplify agent status labels and tone

Shorten English agent-status messages for the chat pill and align the status text color with the other grey controls for a more consistent compact UI.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): align model popover settings row styling

Add an LLM Settings action to the model popover and normalize its layout, spacing, and divider treatment to match existing dropdown menu patterns while keeping left-aligned positioning.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): restyle status controls and move send action

Make the agent-status control transparent by default with gray-to-white icon hover behavior, and move the submit button to the bottom-right controls area beside agent status.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): tighten spacing above git control bar

Reduce the top margin before the git control bar so it better matches the bottom spacing around the chat action controls.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): gate submit button on input content

Keep the send button inactive until the input has non-whitespace text, and align the revised button sizing/positioning with the bottom action row layout.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): streamline overlays and remove legacy event rails

Unify chat control styling and overlay behavior so status/typing/scroll controls float above the thread without adding layout bars, and remove left-rail/checkmark affordances from grouped and generic event cards for a cleaner stream.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): tighten status indicator spacing

Reduce status indicator pill padding and icon size, and add right text padding to balance the compact layout in the chat control overlay.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): prioritize centered scroll control over loader

Keep the scroll-to-bottom control centered and visible whenever the user is away from the bottom, and use solid base/hover fills so it matches the updated chat surface styling.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): soften conversation event header styling

Use the lighter gray chat tone for conversation event header labels/icons and switch those labels to normal weight so grouped event rows match the updated control styling.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): refine markdown spacing and divider styling

Tighten markdown vertical rhythm in chat content, add a shared grey horizontal-rule renderer, and tune heading hierarchy to medium/compact styles for clearer structure without heavy emphasis.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): tighten vertical spacing in action event rows

Reduce stacked margins and paddings across grouped action rows, generic event cards, and collapsible thinking blocks so adjacent conversation entries read as a denser, more consistent stream.

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs(design): add app gray palette reference artifacts

Capture the current gray color usage in dedicated SVG references, including both a curated palette and a strict exhaustive inventory for design and UI consistency work.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): align compact input overflow menus with menu conventions

Keep add-file pinned inline, collapse controls only when width truly runs out, and switch overflow entries to standard context-menu row/submenu patterns while preserving the send button layout at tight widths.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(conversation-panel): use list filter icon for older filters

Swap the older-conversations summary toggle icon to ListFilter so it matches the intended sidebar filter affordance.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): complete local workspace launch flow in git controls

Switch the local git control CTA from repository connection to workspace launching, including an above-button workspace menu and automatic add-workspace modal when none exist. This also captures the pending chat action/menu styling and test updates in the current working tree.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): relocate desktop vertical padding to input controls

Remove desktop top/bottom padding from the main chat panel and apply equivalent bottom spacing to the chat control area so the open repo/workspace controls and input footer keep consistent breathing room.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(conversation): remove bottom margin from chat pane header

Drop the chat header bottom margin so the conversation title row sits flush with the content below.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(chat): refresh git control bar immediately after Connect Repo

The "Connect Repo" empty-state in the chat input footer kept rendering
even after the Open Repository modal had successfully launched a clone
and the agent had reported the repository as ready. The bar would only
heal after a hard refresh (or never, on cloud backends).

Three independent bugs were stacking:

1. Optimistic update was writing to the wrong React Query cache key.
   `useUpdateConversationRepository.onMutate` called `setQueryData`
   with `["user", "conversation", id]` (3 elements), but
   `useUserConversation` reads from
   `["user", "conversation", id, backendId, orgId]` (5 elements).
   `setQueryData` requires an *exact* key match, so the update landed
   on an orphan cache entry that no observer ever read. Switched to
   `setQueriesData`/`getQueriesData` with the 3-element prefix so the
   optimistic write actually reaches the active query (Tanstack v5
   prefix-matches `setQueriesData` filters). Also normalized
   `branch`/`gitProvider` to `null` to match the shape produced by the
   server-side refetch and prevent identity-flicker between the two
   updates.

2. Cloud `batchGetCloudConversations` / `searchCloudConversations`
   ignored the local repo selection entirely. For local backends
   `toAppConversation` overlays `selected_repository`/`selected_branch`/
   `git_provider` from `localStorage`, but the cloud path returned the
   raw SaaS payload — and the SaaS often returns `null` for those
   fields until its own background hydration finishes. So every
   refetch (mutation invalidation, 30s poll, panel mount) overwrote
   the optimistic value with `null` and the bar snapped back to
   "Connect Repo". Added `overlayStoredRepoSelection` which fills only
   the `null` slots from local storage; populated server values still
   win, so we don't shadow real backend changes.

3. `updateConversationRepository` overwrote the entire metadata blob.
   `setStoredConversationMetadata` is replace-not-merge, so calling it
   with just `{selected_repository, selected_branch, git_provider}`
   silently dropped `selected_workspace` (the local-folder attach
   marker used by the Files tab to default to diff view, see the
   "Files tab diff-view default logic" note in `AGENTS.md`). Now reads
   the existing entry first and spreads it under the new repo fields.

Defense-in-depth changes:

- `useLocalGitInfo` now stays enabled until the conversation reports a
  *complete* repo tuple (`selected_repository` + `git_provider` +
  `selected_branch`), not just `selected_repository`. This lets the
  bar recover from partial-metadata cases (e.g. cloud hydration
  populates only the repo name first, or the user clones into a
  subdirectory of `working_dir`). The probe also gained a nested
  `find . -mindepth 2 -maxdepth 4 -name .git` fallback so a clone
  into `<workingDir>/<repo>/` is still detected after the direct
  `git remote get-url origin` in `<workingDir>` returns "no such
  remote 'origin'" (the agent-server pre-initialises every workspace
  as a worktree, so the parent directory always has a `.git` folder
  with no remote).

- `useUpdateConversationRepository.onSettled` invalidates
  `["local-git-info", conversationId]` so the bar re-probes
  immediately after a connect rather than waiting on the next 10s
  refetch tick.

- `git-control-bar.tsx`'s `hasRepository` predicate now keys off the
  *resolved* `selectedRepository` + `gitProvider` (which include the
  local-git probe's findings), not just the conversation field. This
  lets pull/push/PR buttons light up for local-workspace conversations
  whose repo metadata was inferred from `git remote`, matching what
  the repo + branch chips already showed.

Verification

I traced the failure mode by hitting the live agent-server directly:

  $ curl -s -X POST .../api/bash/execute_bash_command \\
      -H "X-Session-API-Key: \$KEY" \\
      -d '{"command":"git remote get-url origin", "cwd":"<workingDir>"}'

  git remote: error: No such remote 'origin'
  git rev-parse HEAD: ambiguous argument 'HEAD': unknown revision

confirming the worktree-without-remote shape that broke the direct
probe and forced the nested-find fallback.

Tests

  __tests__/hooks/mutation/use-update-conversation-repository.test.tsx
    - optimistically updates the cached conversation under the
      prefix-extended key used by useUserConversation
    - rolls back the prefix-keyed cache entry when the mutation rejects

  __tests__/api/cloud-conversation-service.test.ts (new)
    - overlays locally-stored repo selection onto
      batchGetCloudConversations results when the server returns nulls
    - prefers the cloud server values over locally-stored selections
      when present
    - leaves null entries untouched when the cloud server returns null
      for a missing conversation
    - returns an empty array without calling the proxy when no ids
      are provided
    - overlays repo selection on each item returned from
      searchCloudConversations

Wider sweep:

  npx vitest run __tests__/hooks/mutation \\
                __tests__/api/cloud-conversation-service.test.ts \\
                __tests__/api/conversation-metadata-store.test.ts \\
                __tests__/api/agent-server-adapter.test.ts \\
                __tests__/components/features/chat
  -> 22 files, 152 tests passed.

User-visible behavior after this change:

  1. Clicking Launch in the Connect Repo modal flips the bar to
     repo + branch chips immediately (optimistic update now reaches
     the active query).
  2. The bar stays flipped through the next refetch on cloud
     backends (overlay keeps the local selection visible until the
     SaaS catches up).
  3. Bar picks up nested clones within ~1s on local backends
     (local-git-info invalidation forces a re-probe instead of
     waiting on the 10s poll), and the nested-find fallback handles
     'clone into <workingDir>/<repo>/' flows.
  4. Pull/push/PR buttons now light up for local-workspace
     conversations whose remote was inferred from git remote.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(conversation): make right-panel drawer state session-only

The right-side drawer's open/closed state (`isRightPanelShown` /
`hasRightPanelToggled`) was persisted in localStorage, which made
the panel feel sticky in a way users didn't expect — it would still
be open after reloads or revisits even though they wanted a clean,
focused chat view.

Move drawer state fully into the in-memory Zustand store so it:
- always starts closed on app load (or on opening a conversation
  after a restart),
- survives in-app navigation because Zustand stays alive across
  React Router transitions,
- only persists tab selection (`selectedTab`), which is the part
  users do want to come back to.

The legacy `rightPanelShown` field is silently stripped from older
persisted blobs by `sanitizeStoredState`, so old localStorage data
doesn't churn or leak into the new schema.

Co-authored-by: Cursor <cursoragent@cursor.com>

* refactor(ui): standardize three-dots ellipsis trigger across the app

Different surfaces had drifted to slightly different "more options"
buttons:
- conversation header used a 24x24 icon with a hardcoded fill color,
- conversation cards in the side panel used a separate square
  `ellipsis.svg` glyph,
- the conversation tab bar used a 20x20 icon with bespoke colors,
- LLM profile rows wrapped the icon in a bordered button with
  yet another color.

Promote `EllipsisButton` to be the canonical trigger and route every
inline variant through it so size (w-4 h-4 / 16x16), color
(`text-[#9299AA]`), and hover treatment (`hover:text-white
hover:bg-white/10`) stay consistent everywhere. Layout-only overrides
(e.g. translate, opacity-when-paused) flow through `className`, and a
`testId` escape hatch keeps the existing `profile-menu-trigger`
selector working.

The chat-input overflow button intentionally keeps its pill-shaped
custom variant; a doc comment on `EllipsisButton` calls that out so
future contributors don't replace it.

Co-authored-by: Cursor <cursoragent@cursor.com>

* chore(design): add 15-stop cool grey palette and complete migration plan

Documents migration of ~98 scattered grey values across agent-canvas to a
unified 15-stop cool blue-grey family (hue ≈ 220–224°), with all existing
hex values, Tailwind utilities, CSS variables, and alpha variants mapped to
the nearest new token by RGB + lightness proximity.

Artifacts:
- cool-grey-palette.svg: visual palette strip + per-shade migration map
- cool-grey-migration.md: CSS/Tailwind definitions, per-file migration
  tables, alpha variant equivalents, and a 6-phase implementation plan

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): remove circular pill and ripple effect from autocomplete caret buttons

Replace the default HeroUI selector button styling (rounded-full, fixed dimensions,
hover fill) with a flat transparent icon and disable the press ripple via
selectorButtonProps={{ disableRipple: true }} on all Autocomplete instances.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(design): enforce single border color token across all UI elements

- Unify --oh-border-input to cool-grey-700 (same as --oh-border), eliminating
  the 3-way border split across inputs, cards, and dividers
- Replace border-neutral-600 in .button-base with border-[var(--oh-border)]
- Replace all border-tertiary usages (27 files) with --oh-border for outer
  borders and --oh-border-subtle for within-panel dividers
- Fix border-tertiary-light on toggle switch OFF state → --oh-border
- Fix border-t-tertiary on app-settings Git section divider → --oh-border-subtle
- Fix divide-tertiary in profiles-body → divide-[var(--oh-border-subtle)]
- Fix secrets table row dividers: --oh-border-subtle → --oh-border
- Fix files-tab toolbar and file-quick-row header lines → --oh-border
- Fix repo-connector and new-conversation card borders → --oh-border
- Remove bg-surface from automations-list and automation-detail routes so
  they inherit bg-base from the root layout, matching all other pages

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(design): migrate automations to shared tokens; fix secondary button, card, and hover strokes

- Replace all legacy tailwind.config.js color tokens in automations/ (27 files):
  bg-surface-card → bg-[var(--oh-surface)], bg-surface-elevated → bg-surface-raised,
  border-border → border-[var(--oh-border)], text-content-muted → text-muted,
  status/toggle/badge tokens → --oh-success/--oh-danger/--oh-muted variants
- Fix active-status-badge and status-badge inactive fills from bg-border → bg-surface-raised
- BrandButton secondary variant: yellow outline+text → border-[var(--oh-border)] text-white
  hover:bg-surface-raised; move hover:opacity-80 off base onto primary/tertiary only
- BrandButton primary: replace text-base (font-size conflict) with text-[var(--oh-color-base)]
  so all variants share the base text-sm font size
- Card primitive default/outlined themes: --oh-border-input → --oh-border (fixes visible
  mismatch between repo-connector and Start from Scratch cards on home screen)
- marketplace-card, skill-card, skills-toolbar: replace hover:border-white/40 with
  hover:border-[var(--cool-grey-500)] and focus:ring-primary/60 with focus:ring-[var(--oh-border)]
- automations routes: remove explicit bg-surface so pages inherit bg-base from root layout

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(design): normalize spinners, borders, and accent colors to design tokens

Replace hardcoded `border-primary`, `border-blue-500`, and `text-primary`
with cool-grey-aligned tokens (`border-white`, `border-white/20`,
`var(--oh-border)`, `var(--oh-muted)`) across loading spinners, modals,
dropdowns, and link styles. Switch dropdown selected-item highlight from
`--oh-interactive-active` to `--oh-interactive-selected`.

Co-authored-by: Cursor <cursoragent@cursor.com>

* feat(theme): add runtime color theme switcher with OpenHands-Neutral palette

- Add src/themes/color-themes.ts: two themes (OpenHands-DeepSea /
  OpenHands-Neutral) with --cool-grey-* scale overrides and matching
  --heroui-* HSL channel overrides (default, content, background,
  foreground families) so HeroUI components and portalled popovers
  both respond to theme changes.
- Inject overrides via a <style> tag on [data-agent-server-ui] AND
  [data-theme=dark] so portal content rendered to document.body picks
  up the new palette alongside inline components.
- Add ThemeInput (SettingsDropdownInput) to Application Settings;
  applies the theme immediately on selection and persists to
  localStorage under openhands-color-theme.
- Add ColorThemeApplier to root.tsx so the persisted theme is
  re-applied on every page load with no flash.

Additional token fixes found during theme testing:
- Define --color-tertiary-alt → --oh-text-dim in tailwind.css so the
  ~25 placeholder:text-tertiary-alt / text-tertiary-alt usages
  (API key input, helper text, badges) resolve correctly.
- Fix environment-switch-overlay: replace bg-card / border-border /
  text-foreground with --oh-surface / --oh-border / --oh-foreground.
- Fix AutocompleteSection headings in model-selector: add
  classNames={{ heading: "text-[var(--oh-muted)]" }} so Verified /
  Other Models labels are readable against the dropdown background.
- Unify structural panel dividers: sidebar right edge + footer
  separator + files-tab tree divider all changed from
  --oh-border-subtle to --oh-border, matching the right panel.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ui): improve suggestion card hover to match secondary button style

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(theme): set OpenHands-Neutral as the default color theme

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: failing tests

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: hieptl <hieptl.developer@gmail.com>
 2026-05-16 00:57:13 +07:00