mirror of
https://github.com/OpenHands/OpenHands.git
synced 2026-10-07 17:08:34 +08:00
cfa2ba57966e82e30bc4e400a8ae745a4b8d92ae
125
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
|
74f06866ec |
Use libraries for local proxy and static serving (#1543)
* Use libraries for local proxy and static serving * Fix CI for proxy library refactor * Fix static server CI failures Co-authored-by: openhands <openhands@all-hands.dev> --------- Co-authored-by: Codex <codex@openai.com> Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Graham Neubigandneubig
|
e3c096ba83 |
chore: bump @openhands/extensions 0.6.0 -> 0.7.0 (#1519)
Bump to the released 0.7.0 (OpenHands/extensions#369): defaultTool removed, every HTTP connector has openApiUrl, MCP-first ordering, 5 vendors recovered as MCP, 10 connectors dropped, strict JSON schema added. Typecheck passes; 3444 tests pass (1 pre-existing EADDRINUSE port-flake unrelated to the bump). Co-authored-by: neubig <398875+neubig@users.noreply.github.com> |
||
|
|
b2ba5889d3 |
fix(examples): inherit acp-docker image from config/defaults.json (#1434)
* fix(examples): inherit acp-docker image from config/defaults.json
examples/acp-docker/docker-compose.yml hardcoded the agent-server image at
`1.25.0-python`. Canvas enforces `compatibility.minimumAgentServer` (1.28.0)
from the repo's single source of truth, so the example default fell below the
floor and rendered "Disconnected — requires 1.28.0 or newer" — a reviewer
following the quickstart as written never reached the feature.
examples/acp-docker was the lone in-repo file hardcoding a version instead of
inheriting from config/defaults.json (14 other files read it; check-sdk-version
-sync only validates the released PyPI package, not in-repo files).
- scripts/gen-acp-docker-env.mjs: read defaults.json, pin AGENT_SERVER_IMAGE to
`${images.agentServer}:${versions.agentServer}-python` in examples/acp-docker
/.env (idempotent upsert; mirrors scripts/docker-build.mjs).
- package.json: `npm run example:acp-docker:env`.
- docker-compose.yml: no-config fallback `1.25.0-python` -> `latest-python`,
always >= the compatibility floor, so zero-config `docker compose up` never
shows "Disconnected"; the generated .env overrides with the pinned SoT
version for the reproducible path.
- .env.example / README.md: document both paths; correct the version narrative
(floor is the defaults.json compatibility pin; #3510 is the deeper functional
floor at/below it).
- __tests__/scripts/acp-docker-env-sync.test.ts: assert the generator's tag
matches defaults.json, the pin satisfies the floor, and the compose fallback
stays `latest-python`. Mirrors docs-version-sync.test.ts — the guard that
makes "can't silently drift" true.
* test(examples): harden acp-docker env-sync per review
Addresses the cli-review-panel findings worth acting on (the rest were
cosmetic or matched the no-validation idiom of scripts/docker-build.mjs):
- gte() in the test guarded with parseSemver — a non-numeric pin (sha /
pre-release) now fails the floor check loudly instead of silently
comparing NaN. The floor check is a CI gate; its one piece of logic
shouldn't mis-compare in silence.
- compose-fallback assertion derives the registry from config.images
.agentServer instead of hardcoding ghcr.io/openhands/... — a registry
change no longer false-fails a test that only cares about the latest-python
tag.
- upsertEnvLine now has unit tests (append / replace-in-place+preserve /
idempotent / commented-template-line / keyless-line guard), making the
"idempotent upsert" claim defensible. It was the one untested piece of real
logic.
- upsertEnvLine guards a keyless line (no "=") with a clear throw, instead of
an empty key matching every line and rewriting the whole file.
* fix(examples): guard acp-docker env-sync entrypoint against undefined argv[1]
The CLI entrypoint guard called pathToFileURL(process.argv[1]) unconditionally.
process.argv[1] is undefined in some ESM contexts (e.g. importing the module for
its exports via `node --input-type=module -e "import(...)"`), so the guard threw
ERR_INVALID_ARG_TYPE at import, before any exported helper was reachable.
Short-circuit on process.argv[1] before pathToFileURL so importing the module is
side-effect-free while the CLI path is unchanged. Add a regression test that
reproduces the bare-import context and asserts a clean exit.
Addresses the review finding on #1434.
* docs(acp-docker): trim verbose comments per review
Address all-hands-bot's review suggestions on #1434:
- test header describes the current invariant, not the prior-state history
(that narration belonged in the PR description)
- docker-compose.yml: condense the image-pin comment to the how-to-override;
the compatibility-floor / #3510 rationale already lives in README §1 + the test
- .env.example: 7-line pin explainer down to 2
Comment-only; env-sync test still 10/10 green, prettier clean.
* Clarify ACP Docker image version guidance
Co-authored-by: openhands <openhands@all-hands.dev>
---------
Co-authored-by: enyst <engel.nyst@gmail.com>
Co-authored-by: openhands <openhands@all-hands.dev>
|
||
|
Rohit Malhotraandopenhands
|
bfd5f04109 |
Draft: Prepare 1.1.0 release (#1511)
* chore: prepare 1.1.0-rc.1 release candidate Co-authored-by: openhands <openhands@all-hands.dev> * chore: prepare 1.1.0 release Co-authored-by: openhands <openhands@all-hands.dev> --------- Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Hiep Le
|
c3f20e0df5 |
chore: bump typescript-client 1.28.0 + agent-server/openhands-sdk 1.29.3 (#1507)
* chore: bump typescript-client 1.28.0 + agent-server/openhands-sdk 1.29.3 * chore: automation |
||
|
Vasco Schiavo
|
32d2e12042 |
chore(deps): bump typescript-client 1.27.0 + agent-server/openhands-sdk 1.29.0 (#1486)
* chore(deps): bump @openhands/typescript-client to 1.27.0 * test: update ACP provider/model fixtures for typescript-client 1.27.0 1.27.0 refreshed the claude-code/codex ACP registry data: provider command versions (claude-agent-acp 0.30.0->0.44.0, codex-acp 0.15.0->0.16.0), claude-code model ids (claude-opus-4-8->opus[1m], claude-sonnet-4-6->sonnet, claude-haiku-4-5->haiku) plus a new well-labeled "default" option, and the codex default (gpt-5.5/medium->gpt-5.5). Canvas sources these lists from the client registry (closes #740), so the source was already correct -- only the hardcoded test expectations were stale. Also relaxed the acp-providers placeholder guard to accept the SDK's intentional "Default (recommended)" entry. * chore(deps): bump agent-server/openhands-sdk to 1.29.0 Align the spawned agent-server SDK release train (openhands-sdk, openhands-tools, openhands-workspace, openhands-agent-server) with the version @openhands/typescript-client 1.27.0 is validated against (agent-server 1.29.0-python). Bump the coupled openhands-automation pin to 1.0.0a12, whose SDK deps resolve to 1.29.0, to satisfy the check-sdk-version-sync gate. minimumAgentServer compat floor unchanged. Doc/JSDoc/test references updated to keep docs-version-sync green. |
||
|
|
1bf2f95800 |
chore: pin extensions catalog dependency (#1451)
* chore: pin extensions catalog dependency Co-authored-by: openhands <openhands@all-hands.dev> * chore: update extensions catalog pin Co-authored-by: openhands <openhands@all-hands.dev> * chore: repin extensions catalog package Co-authored-by: openhands <openhands@all-hands.dev> * chore: consume raw integration catalog entries Co-authored-by: openhands <openhands@all-hands.dev> * refactor: rely on extensions Linear catalog data Co-authored-by: openhands <openhands@all-hands.dev> * chore: repin extensions without aggregate catalog Co-authored-by: openhands <openhands@all-hands.dev> * chore: repin extensions generated catalog comment Co-authored-by: openhands <openhands@all-hands.dev> * chore: repin extensions catalog Co-authored-by: openhands <openhands@all-hands.dev> * refactor: remove marketplace runtime filtering Co-authored-by: openhands <openhands@all-hands.dev> * fix: render MCP logos from catalog metadata Co-authored-by: openhands <openhands@all-hands.dev> * chore: repin extensions catalog dependency Co-authored-by: openhands <openhands@all-hands.dev> * chore: repin extensions catalog metadata Co-authored-by: openhands <openhands@all-hands.dev> * chore: repin extensions release workflow Co-authored-by: openhands <openhands@all-hands.dev> * chore: use released extensions package Co-authored-by: openhands <openhands@all-hands.dev> * fix: add img onError handler and clarify isAutomationAvailable intent - mcp-logo-badge: add onError handler to hide broken images when the simpleicons CDN is unreachable, so the badge background still shows rather than a broken-image icon - recommended-automations-section: document why isAutomationAvailable uses length > 0 (intentional: hides cards whose required integrations are not in the catalog or are empty) vs the old .every() behaviour which returned true for empty arrays Co-authored-by: openhands <openhands@all-hands.dev> * fix: satisfy logo fallback lint Co-authored-by: openhands <openhands@all-hands.dev> * fix: resolve @openhands/extensions@0.6.0 from npm registry instead of GitHub archive Now that 0.6.0 is published on npm, update the lockfile resolved URL from the GitHub tarball to the canonical registry artifact. The integrity hash now matches the npm release provenance. Co-authored-by: openhands <openhands@all-hands.dev> * chore: remove dead marketplace backend prop Co-authored-by: openhands <openhands@all-hands.dev> --------- Co-authored-by: neubig <398875+neubig@users.noreply.github.com> Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Rohit Malhotraandopenhands
|
089ecc45f3 |
Pin exact dependency versions (#1455)
Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
|
94d5ecff9c |
Fix: upgrade typescript-client to v1.25.0 for pinned ACP versions (#1369)
* Update typescript-client to v1.25.0 with pinned ACP versions Upgrades from v1.24.3 to v1.25.0 to get the ACP provider version pins: - claude-agent-acp@0.30.0 - codex-acp@0.15.0 - gemini-cli@0.38.0 Fixes the 'Method not found' error when starting Codex ACP sessions. The unpinned npm package was resolving to codex-acp@0.16.0 which lacks the session/set_model RPC method that the SDK expects. Closes: agent-canvas#<issue> (codex version incompatibility) Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: update package-lock.json typescript-client version to 1.25.0 Synchronize lockfile dependency version with package.json to fix npm ci validation. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: complete lockfile update for typescript-client@1.25.0 Update both dependency version and package definition with correct integrity hash. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * test: update ACP provider command expectations for pinned versions Update test expectations to match typescript-client@1.25.0 registry which includes version pins: claude-agent-acp@0.30.0, codex-acp@0.15.0, gemini-cli@0.38.0. These pins fix the 'Method not found' error on Codex ACP sessions by ensuring npm resolves to compatible versions. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: update ACP test expectations for typescript-client@1.25.0 pinned versions - Change empty acp_command to fall back to registry defaults (now with pinned versions) - Update expected Claude Code default model from opus-4-7 to opus-4-8 * fix: update test expectations for typescript-client@1.25.0 registry changes - Default Claude Code model updated: claude-opus-4-7 → claude-opus-4-8 - Pinned commands now include version: @claude-agent-acp@0.30.0, @codex-acp@0.15.0 - Credential tests load acp_command:[] so preset detection finds claude-code - Reconciles test types pinned codex command to match registry --------- Co-authored-by: Debug Agent <simon@openhands.dev> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> |
||
|
Graham Neubigandneubig
|
df93ca36a7 |
Add Windows portability guards for workspace flows (#1311)
* Add Windows portability guards for workspace flows * Increase snapshot workflow timeout * Trigger CI after timeout update * Fix windows portability PR after main merge --------- Co-authored-by: neubig <398875+neubig@users.noreply.github.com> |
||
|
OpenHands Bot
|
82ea2b609a | feat: save hosted MCP credentials as secrets (#1331) | ||
|
Rohit Malhotraandopenhands
|
c7c8862c11 |
Remove visual snapshot tests and bump Docker E2E timeout (#1332)
* Remove visual snapshot tests Co-authored-by: openhands <openhands@all-hands.dev> * Bump Docker E2E timeout Co-authored-by: openhands <openhands@all-hands.dev> * Align Docker E2E timeout caps Co-authored-by: openhands <openhands@all-hands.dev> --------- Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Tim O'Farrellandopenhands
|
771acb24a5 |
chore: bump @openhands/extensions from 0.4.1 to 0.4.2 (#1323)
Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Tim O'Farrellandopenhands
|
910b19ae76 |
chore: bump agent-server → 1.28.1, automation → 1.0.0a9, extensions → 0.4.1 (#1319)
* chore: bump agent-server → 1.28.1, automation → 1.0.0a9, extensions → 0.4.1 Co-authored-by: openhands <openhands@all-hands.dev> * Test fixes * fix: inject proxy base_url for litellm_proxy/* when server omits it (agent-server ≥1.28) Agent-server ≥1.28 may return base_url:null when fetching a litellm_proxy/* profile config, even when the profile was saved with the All-Hands proxy URL. This caused the Basic-tab re-save flow in LlmSettingsLocalView.handleSave to call isOpenHandsProxyModel(model, null) → false, hitting the else-branch that deletes base_url and stranding the profile (issue #1146). Fix: add a secondary check — litellm_proxy/* with a missing base_url is treated the same as litellm_proxy/* with the proxy URL already set, and OPENHANDS_LLM_PROXY_BASE_URL is injected before the save request is sent. Also updates the mock-LLM E2E test to accept both storage representations: - litellm_proxy/* + proxyBaseUrl (pre-1.28, guards issue #1146 regression) - openhands/* + null (1.28+, server-managed routing) And adds a unit test exercising the base_url:null path. Co-authored-by: openhands <openhands@all-hands.dev> --------- Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Tim O'Farrellandopenhands
|
8071edf72a |
Revert "chore: bump agent-server → 1.28.1, automation → 1.0.0a9, extensions → 0.4.1 (#1315)" (#1318)
This reverts commit 1917b5d39fbf09dc51213b4b484698fe394314c7. Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Tim O'Farrellandopenhands
|
15a52fea75 |
chore: bump agent-server → 1.28.1, automation → 1.0.0a9, extensions → 0.4.1 (#1315)
* chore: bump agent-server → 1.28.1, automation → 1.0.0a9, extensions → 0.4.1 Co-authored-by: openhands <openhands@all-hands.dev> * chore: update doc examples to reference agent-server 1.28.1 Update version references in AGENTS.md, scripts/dev-safe.mjs, and scripts/check-sdk-version-sync.mjs from 1.27.0 → 1.28.1 to stay in sync with the agentServer pin in config/defaults.json. Fixes: docs-version-sync.test.ts failures Co-authored-by: openhands <openhands@all-hands.dev> * fix: inject proxy base_url for litellm_proxy/* when server omits it (agent-server ≥1.28) Agent-server ≥1.28 may return base_url:null when fetching a litellm_proxy/* profile config, even when the profile was saved with the All-Hands proxy URL. This caused the Basic-tab re-save flow in LlmSettingsLocalView.handleSave to call isOpenHandsProxyModel(model, '') → false, hitting the else-branch that deletes base_url and stranding the profile (issue #1146). Fix: add a secondary check for litellm_proxy/* models with a missing base_url (null/undefined/empty), treating them the same as a stored proxy URL and injecting OPENHANDS_LLM_PROXY_BASE_URL before the save request is sent. Also adds a unit test exercising the base_url:null path. Co-authored-by: openhands <openhands@all-hands.dev> * test(e2e): accept agent-server 1.28 model rewrite in proxy profile test Agent-server 1.28 normalises litellm_proxy/* → openhands/* on storage and manages the proxy URL internally (returning base_url:null). The old assertions hard-coded the pre-1.28 storage format (litellm_proxy/* + explicit proxy URL), causing the test to fail on every 1.28 run. Extract assertProxyProfileConfig() helper that accepts both storage representations: - litellm_proxy/* + proxyBaseUrl (pre-1.28, guards issue #1146 regression) - openhands/* + null (1.28+, server-managed routing) The issue #1146 guard is preserved: a litellm_proxy/* profile without a proxy URL is still flagged as a stranded profile. Co-authored-by: openhands <openhands@all-hands.dev> --------- Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Engel Nystandopenhands
|
f6ea202d56 |
chore: align package version with RC (#1303)
Keep package metadata in sync with config/defaults.json so npm scripts and mock E2E logs report the current agent-canvas RC version. Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Tim O'Farrellandopenhands
|
e65a07dcad |
Bump extensions to latest version (#1294)
Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
|
c39354f2b3 |
feat: load public skills from @openhands/extensions npm package (#1199)
* build(deps): move @openhands/extensions to npm 0.2.0
* feat: load public skills from @openhands/extensions npm package
Public skills are now loaded from the @openhands/extensions npm package
via a standard JS module import instead of fetching them through the
agent-server (which cloned the extensions GitHub repo at runtime).
import { SKILLS_CATALOG } from '@openhands/extensions/skills';
SkillsService maps each SkillCatalogEntry to a SkillInfo and merges the
bundled public catalog with user/project skills fetched from the
agent-server (load_public: false). If the agent-server is unreachable,
the bundled catalog is returned alone.
Changes:
- SkillsService: imports SKILLS_CATALOG from @openhands/extensions/skills,
maps entries to SkillInfo, merges with user/project skills from
agent-server (load_public: false).
- agent-server-adapter: hardcodes load_public_skills: false in
buildAgentContext().
- agent-server-config: removes shouldLoadPublicSkills() and its
VITE_LOAD_PUBLIC_SKILLS env var.
- dev-safe.mjs: removes getExtensionsRef() / DEFAULT_EXTENSIONS_REF
and EXTENSIONS_REF injection in buildAgentServerEnv().
- Docker: removes CONFIG_EXTENSIONS_REF from config-gen stage and
EXTENSIONS_REF from entrypoint.sh.
- .env.sample: removes VITE_LOAD_PUBLIC_SKILLS comment.
- Tests updated to match new architecture.
Depends on OpenHands/extensions#310 which adds the SKILLS_CATALOG export.
Co-authored-by: openhands <openhands@all-hands.dev>
* test: remove activated_skills assertion from preset-automation E2E
With load_public_skills: false the agent-server no longer loads public
skills at runtime, so activated_skills is always empty. The conversation
itself works (slash command sent, agent replies) — only the server-side
skill activation metadata is gone.
Co-authored-by: openhands <openhands@all-hands.dev>
* feat: pass bundled public skills via agent_context.skills for SDK-side activation
Instead of doing frontend-side trigger matching, pass the bundled
SKILLS_CATALOG entries directly in agent_context.skills at conversation
start. The SDK performs trigger matching, sets activated_skills on user
events, and injects skill content into the system prompt — the exact
same behavior as when load_public_skills was true, but without cloning
the extensions repo at runtime.
buildBundledSkills() converts each catalog entry into the SDK Skill JSON
shape with KeywordTrigger ({ type: 'keyword', keywords: [...] }) for
skills with triggers, or null for always-active skills.
Restores the activated_skills E2E assertion in the preset-automation
test since the SDK now handles activation.
Co-authored-by: openhands <openhands@all-hands.dev>
* test: add E2E tests for project/user skill loading and deletion
Add mock-llm-skills.spec.ts with three tests:
1. Project skill in workspace/.agents/skills/ triggers on matching keyword
2. User skill in ~/.openhands/skills/ triggers on matching keyword
3. Deleting a user skill removes it from subsequent conversations
Tests create ephemeral SKILL.md files with unique trigger keywords,
send messages through the real agent-server stack, and verify
activated_skills in the conversation events API.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: use explicit APIRequestContext type import for CI TS6 compatibility
Replace inline `import('@playwright/test').APIRequestContext` type
references with a proper top-level type import. Also align afterEach
fixture destructuring with other specs' pattern.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: remove node: prefix from imports to fix CI TS resolution
TypeScript 6 on CI (Node 24) has a type resolution conflict when
`node:` prefixed imports (node:path, node:fs, node:os) coexist with
`@playwright/test` types in the same file. This caused
`APIRequestContext` to be incorrectly resolved as `Page`. Use
unprefixed imports (path, fs, os) which work identically in Node.js.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: split fs helpers into separate file to fix CI TS6 type resolution
Move node built-in imports (path, fs, os) and filesystem helpers to
`utils/skill-test-helpers.ts`. The spec file now only imports from
`@playwright/test` and the two helper modules, avoiding the type
resolution conflict between node builtins and Playwright fixture types
that caused `APIRequestContext` to be incorrectly inferred as `Page`
on CI (TypeScript 6 / Node 24 / Ubuntu).
API assertion logic is now inline within each test step, using the
`request` fixture directly instead of standalone functions with
explicit `APIRequestContext` type annotations.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: use namespace imports to avoid TS6 type inference issue
Switch from named imports to namespace imports (`import * as helpers`)
with subsequent destructuring. This changes how TypeScript resolves the
imported function signatures, avoiding a Node 24 / TS6 type inference
bug where `ensureMockLLMProfile` was incorrectly resolved as expecting
`Page` instead of `APIRequestContext`.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: add typed wrapper for ensureMockLLMProfile to fix CI TS2345
Add a local `configureMockLLM` wrapper with an explicit
`APIRequestContext` type annotation. This works around a CI-specific
TypeScript 6 type inference issue where the imported
`ensureMockLLMProfile` signature is incorrectly resolved as expecting
`Page` instead of `APIRequestContext` when called from a Playwright
test body that also imports from `skill-test-helpers` (a module with
node built-in imports). The wrapper's explicit type annotation forces
correct type checking at the call site.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: inline ensureMockLLMProfile logic to fix CI TS2345
Instead of importing ensureMockLLMProfile from mock-llm-helpers (which
triggers a CI-specific TS6 type inference bug when combined with
skill-test-helpers imports), inline the same logic as a local function
with explicit APIRequestContext typing. This avoids the cross-module
type resolution issue entirely.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: resolve WORKSPACE_DIR relative to agent-server CWD, not STATE_DIR
The agent-server resolves the relative working_dir ("workspace/project")
from its own CWD (the project root), not from STATE_DIR/workspaces.
The test was writing skill files to the wrong directory so the SDK
never found them, causing activated_skills to be empty.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: create standalone git repo for project skill E2E test
The agent-server creates a git worktree for each conversation, and only
committed files appear in worktrees. The previous approach wrote skill
files to the filesystem without committing them, so the worktree never
contained them and load_project_skills found nothing.
Now the test:
1. Creates a standalone git repo (.tmp/mock-llm-skill-repos/) with the
skill file committed
2. Creates the conversation via API with that repo as working_dir
3. The agent-server worktree includes the committed skill
4. load_project_skills discovers it in the worktree
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: add secrets_encrypted flag to skill test conversation creation
The GET /api/settings with X-Expose-Secrets: encrypted returns cipher-
encrypted secret values. The POST /api/conversations needs
secrets_encrypted: true to tell the server to decrypt them, otherwise
the request fails with HTTP 422.
Co-authored-by: openhands <openhands@all-hands.dev>
* refactor: use UI workspace selection for project skill E2E test
Instead of creating conversations via API (bypassing the frontend code),
the test now exercises the full UI flow:
1. Creates a standalone git repo with the skill committed
2. Registers the repo as a workspace via POST /api/workspaces
3. Opens the 'Open workspace' dialog in the UI
4. Selects the workspace from the dropdown
5. Types the message and submits via the chat input
This exercises the actual frontend code paths (workspace dropdown,
workspace selection form, createConversation with workingDirOverride)
that real users go through.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: add padding response for skill-analysis in deletion test
The agent-server makes a skill-analysis LLM call even when no user/project
skills are loaded, because public skills from the npm package are still
present. The deletion test only had 1 trajectory response, causing the
agent to hang waiting for the 2nd response (the actual reply).
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: simplify deletion test to not depend on specific event type
The deletion test was failing because it waited for an event with
source='agent' and event_type='message' in the events API, but the
mock LLM text reply may produce a different event type. Since
waitForNonUserMessageText already confirms the agent replied in the
UI, we just need to verify no activated_skills contains the deleted
skill name.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: mount skill test dirs into Docker container for e2e tests
The Docker E2E skills test was failing because the agent-server inside
the Docker container couldn't access skill repos and user skill files
created on the host filesystem.
Fix by:
- Adding volume mounts for skill repos (.tmp/mock-llm-skill-repos/ →
/tmp/mock-llm-skill-repos/) and user skills (.tmp/mock-llm-user-skills/
→ /home/openhands/.openhands/skills/) to the Docker run command
- Setting env vars (MOCK_LLM_SKILL_REPOS_CONTAINER_DIR,
MOCK_LLM_USER_SKILLS_HOST_DIR) so skill-test-helpers.ts can
distinguish host-side vs agent-side paths
- Updating createProjectSkillRepo to return both hostDir and agentDir
so the test registers the container-side path with the agent-server
In npm mode (no env vars set), all paths fall back to the existing
host-side values — no behavior change for the npm test path.
Co-authored-by: openhands <openhands@all-hands.dev>
* docs: document Docker skill test volume mounts in AGENTS.md
Co-authored-by: openhands <openhands@all-hands.dev>
* feat: mark newly added mock-LLM E2E tests with 🆕 badge in PR comments
The render-mock-llm-report.mjs script now accepts a --new-files flag
with a comma-separated list of spec file paths added in the PR. Tests
from those files get a 🆕 badge in the results table, and the summary
line shows the count (e.g. '🆕 2 new').
Both CI workflows (mock-llm-e2e.yml and mock-llm-docker-e2e.yml) add
a 'Detect newly added spec files' step that queries the GitHub API
for files with status=='added' matching the mock-LLM spec pattern,
avoiding shallow-clone issues with git diff.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: match Playwright basename file paths against repo-relative --new-files
Playwright's JSON reporter emits file paths relative to testDir
(e.g. 'mock-llm-skills.spec.ts') while the GitHub API returns
repo-relative paths (e.g. 'tests/e2e/mock-llm/mock-llm-skills.spec.ts').
The isNewTest() matcher now compares basenames in addition to exact/suffix
matching, so 🆕 badges render correctly.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: stabilize pagination loading-indicator test + improve new-test callout
1. Flaky test fix: the 'loads older events when scrolling up' test
asserts that the loading-older-events indicator appears, but the
instant mock response lets React batch isLoading true→false in one
commit — the DOM element never materialises. Add a 300ms delay to
older-events mock responses so the indicator renders reliably.
2. Better new-test visibility: replace the subtle inline 🆕 emoji with
a prominent green blockquote callout above the results table that
lists each new test with its status icon and spec file.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: address PR review — type safety, docs, test assertions
1. Define BundledSkill interface for buildBundledSkills() return type
instead of the opaque SettingsRecord[] (review thread #1).
2. Document PUBLIC_SKILLS as an immutable build-time snapshot that is
baked into the bundle and requires a dependency bump to update
(review thread #2).
3. Add migration note to buildAgentContext() explaining that the former
VITE_LOAD_PUBLIC_SKILLS env var was removed because bundled skills
have no clone latency. load_public_skills: false is still passed to
tell the SDK to skip its own clone (review thread #3).
4. Add structural assertions for individual skill entries in the adapter
test: name, content, source, is_agentskills_format, and trigger
shape (review testing gap).
5. Update stale VITE_LOAD_PUBLIC_SKILLS comments in E2E test files.
Co-authored-by: openhands <openhands@all-hands.dev>
---------
Co-authored-by: Joe Laverty <joe.laverty@openhands.dev>
Co-authored-by: openhands <openhands@all-hands.dev>
|
||
|
chuckbutkusandopenhands
|
f08d8912ac |
fix: resolve npm audit vulnerabilities (ajv ReDoS + dompurify XSS) (#1045)
* non-breaking updates * fix: update overrides to resolve npm audit vulnerabilities - ajv: add override to 8.20.0 (fixes ReDoS in $data option, GHSA-2g4f-4pwh-qvx6, affected 7.0.0-alpha.0–8.17.1) - dompurify: bump override from 3.3.2 to 3.4.7 (fixes XSS bypasses, GHSA-39q2-94rc-95cp and others, affected <=3.3.3) Co-authored-by: openhands <openhands@all-hands.dev> * fix: scope ajv override to @vercel/static-config to fix lint crash The blanket 'ajv: 8.20.0' override forced AJV 8.x globally, breaking ESLint's @eslint/eslintrc which requires AJV ^6.x (incompatible API). Scope the override to @vercel/static-config only — the sole vulnerable consumer (ajv 8.6.3 via @vercel/react-router). ESLint-related packages now get their own nested ajv@6.15.0 instead of the incompatible 8.x. npm audit: 0 vulnerabilities npm run lint: ✅ Co-authored-by: openhands <openhands@all-hands.dev> * Bump react-router to 7.17.0 to fix GHSA-8x6r-g9mw-2r78 Resolves 5 high-severity npm audit findings for the React Router DoS-via-unbounded-path-expansion advisory affecting react-router 7.0.0 – 7.14.2 and the dependent @react-router/{node,dev,serve,express} packages. - Bumped @react-router/node, @react-router/serve, @react-router/dev, and react-router (incl. peerDep) from 7.14.2 to 7.17.0. - Regenerated package-lock.json cleanly (the resolver ERESOLVE-looped when trying to upgrade in place from the existing lockfile). - Updated AGENTS.md: dropped the obsolete vite-tsconfig-paths nested-typescript lockfile invariant (no longer a dep), rewrote the @openhands/typescript-client git-dep note to reflect that it is now a registry package and the Vercel ssh→https rewrite now protects @openhands/extensions, and added a tip to regenerate the lockfile cleanly when bumping pinned versions. npm audit: 0 vulnerabilities. typecheck + build verified. Co-authored-by: openhands <openhands@all-hands.dev> * docs(AGENTS.md): document CVEs addressed by package.json overrides For each entry in 'overrides' in package.json, record the specific advisory it patches and (for ajv) why it's scoped to @vercel/static-config rather than applied globally. Future maintainers can decide when an override can be dropped (upstream bumps past the fixed version) without re-deriving the context from git history. - @vercel/static-config > ajv: 8.20.0 -> GHSA-2g4f-4pwh-qvx6 - dompurify: 3.4.7 -> GHSA-39q2-94rc-95cp Co-authored-by: openhands <openhands@all-hands.dev> --------- Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
|
211a54b247 |
Fix runtime logger dependencies for published CLI (#1198)
Co-authored-by: openhands <openhands@all-hands.dev> Co-authored-by: John-Mason P. Shackelford <jpshack@gmail.com> |
||
|
Tim O'Farrellandopenhands
|
90754e2571 |
feat: add daily-rotating file logger for dev scripts (closes #815) (#1181)
* feat: add daily-rotating file logger for dev scripts (issue #815) Add winston + winston-daily-rotate-file to write all dev-server log output to logs/agent-canvas.YYYY-MM-DD.log alongside the existing console output (which is unchanged). - scripts/logger.mjs — shared module; exports fileLog(level, msg) and stripAnsi(str). DailyRotateFile transport stores files in logs/ relative to the project root, rotates at midnight, and auto-deletes files older than 7 days. - scripts/dev-with-automation.mjs — logService / logStep / logSuccess / logError each call fileLog as a side-channel. The shutdown message, startup title, checkPrerequisites uvx-error, and printBanner summary are also captured. - scripts/dev-safe.mjs — spawnProcess errors, main() startup lines, the unexpected-exit error, and the fatal-error handler all call fileLog. - logs/ was already in .gitignore. Co-authored-by: openhands <openhands@all-hands.dev> * fix: store log files in agent-canvas state dir, not project root Use OH_CANVAS_SAFE_STATE_DIR (or ~/.openhands/agent-canvas as the default) to match where all other agent-canvas runtime state lives, e.g. ~/.openhands/agent-canvas/logs/agent-canvas.YYYY-MM-DD.log Co-authored-by: openhands <openhands@all-hands.dev> --------- Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Rohit Malhotraandopenhands
|
af3284bd53 |
feat: support slash-command automation prompts (#1068)
* feat: update extensions to slash-command catalog prompts Update @openhands/extensions to pick up slash-command catalog prompts (/slack-monitor:poll, /github-monitor:poll). The buildAutomationPrompt boilerplate still appends API routing info since the skills don't distinguish local vs cloud backends themselves. Companion PR: https://github.com/OpenHands/extensions/pull/298 Co-authored-by: openhands <openhands@all-hands.dev> * chore: update extensions to ed3fcc4 (all catalog entries use slash commands) Co-authored-by: openhands <openhands@all-hands.dev> * test: add mock-LLM e2e for preset automation → slash command flow Exercises the full recommended-automations flow: 1. Configure Slack MCP and mock LLM profile via API 2. Navigate to /automations, click Slack standup digest card 3. Verify conversation opens with /standup-digest:setup 4. Submit the slash command, verify skill activation 5. Mock LLM replies with text and conversation ends Step 4 (skill activation) will fail until the extensions PR #298 merges, since the agent-server needs the skill with the /standup-digest:setup trigger registered. Co-authored-by: openhands <openhands@all-hands.dev> * chore: update @openhands/extensions to 8a66900 Includes CI fixes: marketplace entries, README, plugin manifests, and vendor symlinks for all 5 new automation skills. Co-authored-by: openhands <openhands@all-hands.dev> * fix: use correct SDK mcp_config format (mcpServers wrapper) Co-authored-by: openhands <openhands@all-hands.dev> * fix(test): fix preset automation e2e — verify slash command triggers skill Root cause: Two issues blocked the activated_skills assertion: 1. MCP configuration with a dummy command (echo/cat) caused the agent- server to block for 30s in create_mcp_tools() during conversation startup. The MCP client can't init with a non-MCP process, so the conversation never processed the user message (0 events, no LLM calls visible in mock server logs). 2. The events API sort_order parameter was 'TIMESTAMP_ASC' which is invalid (valid values: TIMESTAMP, TIMESTAMP_DESC), returning 422. Fix: - Remove MCP config entirely; send the slash command from the home page instead of clicking the automation card (which requires a working MCP) - Install the slash-command skill via POST /api/skills/install so the agent-server's AgentContext._load_auto_skills picks it up - Verify the agent actually replies before checking events (proves the conversation ran end-to-end) - Poll events API with diagnostic output for debugging - Clean up installed skill + temp files in afterAll The activated_skills FE assertion is preserved — the FE renders it. Co-authored-by: openhands <openhands@all-hands.dev> --------- Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
chuckbutkusandopenhands
|
c0c413f406 |
feat(mcp): render markdown links in helperText; update Slack catalog pin (#1012)
* feat(mcp): render markdown links in helperText; bump extensions to slack field-order PR commit - Add renderHelperText() to install-server-modal.tsx that converts [text](url) patterns into <a> elements with target=_blank, so the Slack workspace-ID helper text (and any future catalog entries) can embed clickable docs links inline. - Bump @openhands/extensions to commit 2d43e9c (branch slack-catalog-field-order-and-helper-links, PR #285) which: • moves SLACK_TEAM_ID before SLACK_BOT_TOKEN in the install modal • replaces the plain SLACK_TEAM_ID helper text with linked copy: 'First visit [here](...#find-your-url) to get your Slack URL and then visit [here](...#find-your-workspace-or-org-id) to get your workspace ID.' - Removes stale integrity hash from package-lock.json for the @openhands/extensions entry; npm install will recompute it. Co-authored-by: openhands <openhands@all-hands.dev> * chore: bump @openhands/extensions to d186872 (SLACK_BOT_TOKEN helperText) Add inline linked helperText for SLACK_BOT_TOKEN in slack.json (PR #285, commit d186872): 'You'll need to create or update a Slack App as shown [here](https://github.com/zencoderai/slack-mcp-server#slack-bot-setup).' Drops the now-redundant helperLink field. Co-authored-by: openhands <openhands@all-hands.dev> * chore: bump @openhands/extensions to b45d3a1 (SLACK_TEAM_ID helperText rewrite) Update SLACK_TEAM_ID helperText to named links: 'First get your [Slack URL](...). Then use that to get your [Workspace ID](...).' Co-authored-by: openhands <openhands@all-hands.dev> * chore: bump @openhands/extensions to 84a0a6e (SLACK_BOT_TOKEN named link) Update SLACK_BOT_TOKEN helperText to: "You'll need to create or update a [Slack App](...#slack-bot-setup)." Co-authored-by: openhands <openhands@all-hands.dev> * chore: bump @openhands/extensions to e07f427 (SLACK_BOT_TOKEN helperText) Update SLACK_BOT_TOKEN helperText to: "You'll need to create or update a [Slack App](...) to get a Bot token" Co-authored-by: openhands <openhands@all-hands.dev> * chore: bump @openhands/extensions to 5efd1b8 Sync to latest commit on slack-catalog-field-order-and-helper-links (PR #285). Co-authored-by: openhands <openhands@all-hands.dev> * chore: bump @openhands/extensions to 952c759 Sync to latest commit on slack-catalog-field-order-and-helper-links (PR #285). Co-authored-by: openhands <openhands@all-hands.dev> * chore: bump @openhands/extensions to f30dbfb Sync to latest commit on slack-catalog-field-order-and-helper-links (PR #285). Co-authored-by: openhands <openhands@all-hands.dev> * chore: bump @openhands/extensions to 02715f4 Sync to latest commit on slack-catalog-field-order-and-helper-links (PR #285). Co-authored-by: openhands <openhands@all-hands.dev> * chore: bump @openhands/extensions to cb092c8 Sync to latest commit on slack-catalog-field-order-and-helper-links (PR #285). Co-authored-by: openhands <openhands@all-hands.dev> * fix(mcp): validate URL scheme in renderHelperText; use matchAll - Guard href against javascript:/data: XSS via /^https?:\/\//i test - Replace exec-in-while with matchAll to drop the eslint-disable comment Addresses review bot feedback on PR #1012. Co-authored-by: openhands <openhands@all-hands.dev> * fix(mcp): use double quotes for fallback href to satisfy Prettier Co-authored-by: openhands <openhands@all-hands.dev> * chore: update @openhands/extensions to latest main (62594156) Co-authored-by: openhands <openhands@all-hands.dev> --------- Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Rohit Malhotraandopenhands
|
449d1fc9e5 |
feat: reuse mock-LLM E2E tests for Docker image validation (#992)
* feat: reuse mock-LLM E2E tests for Docker image validation
Add a Docker-specific Playwright config (playwright.mock-llm-docker.config.ts)
that runs the exact same test specs and helpers against the agent-canvas Docker
image instead of the npm build path (bin/agent-canvas.mjs + uvx).
Key changes:
- Split MOCK_LLM_BASE_URL into two constants in mock-llm-helpers.ts:
- MOCK_LLM_BASE_URL: always host-local, used by tests for admin API
- MOCK_LLM_AGENT_URL: env-overridable, used when configuring the LLM
profile (the URL the agent-server uses for inference). Defaults to
MOCK_LLM_BASE_URL for backward compatibility with the npm path.
- New playwright.mock-llm-docker.config.ts:
- Starts the mock LLM server on the host (same as npm path)
- Runs the Docker container with --network host (Linux CI)
- Points to the same testDir (tests/e2e/mock-llm/) and specs
- Separate output dirs to avoid collision with npm path results
- New CI workflow (.github/workflows/mock-llm-docker-e2e.yml):
- Builds the Docker image from current code (or uses a pre-built image)
- Runs the same specs against the container
- Posts PR comment with differentiated report title
- render-mock-llm-report.mjs: accept --title flag for Docker vs npm reports
- npm run test:e2e:mock-llm:docker script added
- .gitignore updated for docker test output dirs
The npm path (test:e2e:mock-llm) is fully backward-compatible — no env var
override needed since MOCK_LLM_AGENT_URL defaults to MOCK_LLM_BASE_URL.
Co-authored-by: openhands <openhands@all-hands.dev>
* refactor: chain Docker E2E off existing Docker CI via workflow_run
Instead of rebuilding the Docker image in the E2E workflow (duplicating
~10-15 min of Docker build time), use workflow_run to trigger automatically
after the existing 'Docker' workflow completes successfully.
The workflow now:
- Triggers on: workflow_run (Docker completed) + workflow_dispatch (manual)
- Derives the image tag from the Docker build's commit SHA
(ghcr.io/openhands/agent-canvas:sha-<short>-amd64)
- Pulls the already-built image from GHCR — no rebuild needed
- Checks out code at the same SHA as the Docker build
- Extracts PR number from workflow_run.pull_requests[] for comments
Removed: Docker build steps, Buildx setup, build-arg resolution.
All image building stays in docker.yml where it belongs.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: replace flaky 1s timeout with polling for Active badge assertion
The 'Active badge' check in step 2 used a hardcoded 1-second
waitForTimeout before reloading. On a loaded CI runner the profile
activation mutation may not persist in time, causing the reload to
show stale state. This is a pre-existing flake (identical test code
passed on the first push and failed on the second).
Replace with expect.poll() that retries the reload+check cycle with
increasing intervals (1s, 2s, 3s) up to 15 seconds total.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: add pull_request trigger for Docker E2E (workflow_run bootstrap)
workflow_run only fires when the workflow file exists on the default
branch (main). Since mock-llm-docker-e2e.yml is new and only on the
PR branch, GitHub doesn't recognize it as a workflow_run listener yet.
Add pull_request trigger (gated by 'e2e-tests' label, skip forks) that
polls the Docker workflow via gh API until it completes for the PR's
head SHA, then pulls the already-built image from GHCR and runs tests.
After merge, workflow_run takes over as the primary automatic trigger.
The pull_request path remains as a fallback for label-gated runs.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: add FILE_STORE, AUTOMATION_BASE_URL, AUTOMATION_WORKSPACE_BASE to Docker entrypoint
The Docker entrypoint was missing several environment variables that the npm
path (dev-with-automation.mjs) sets for the automation backend:
- FILE_STORE=local — without this, the automation backend may fall back to
cloud storage (S3/GCS) which fails without credentials, causing tarball-
based presets (preset/prompt, preset/plugin) to silently error
- LOCAL_STORAGE_PATH — where to store files on the local filesystem
- AUTOMATION_BASE_URL — publicly-reachable base URL for callback URLs
- AUTOMATION_WORKSPACE_BASE — where automation runs unpack tarballs
This explains the Docker E2E failure: the agent's curl to create an automation
via /api/automation/v1/preset/prompt returned an error (likely 500 from missing
storage config), but the mock LLM doesn't care about terminal output and
proceeded to return the scripted final reply. The test then found 0 automations.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: exclude auth-modes spec from Docker E2E tests
The mock-llm-auth-modes.spec.ts tests npm-binary-specific --auth-required
behaviour (a second static-server instance on port 18301). The Docker image
doesn't provide this second server — it has its own auth handling. Exclude
the spec from the Docker test run via testIgnore.
Co-authored-by: openhands <openhands@all-hands.dev>
* feat: run auth-modes tests inside Docker via PUBLIC_MODE_PORT
Instead of excluding the auth-modes spec from the Docker E2E run or
spinning up a host-side static server with a duplicate build/ directory,
the Docker entrypoint now supports an optional PUBLIC_MODE_PORT env var.
When set, entrypoint.sh starts a second static-server instance from the
same baked-in frontend assets with --auth-required (no session key
injected). This tests the actual Docker image's auth gate behaviour —
not a host-side approximation.
The Playwright Docker config passes -e PUBLIC_MODE_PORT=18301 to the
container and exports MOCK_LLM_PUBLIC_MODE_URL so the auth-modes spec
can reach it. With --network host the port is accessible from the host.
Co-authored-by: openhands <openhands@all-hands.dev>
* address review feedback: drop unlabeled trigger, improve error messages, document env vars
- Drop 'unlabeled' from pull_request trigger types to avoid wasted
workflow runs when any label is removed (the job-level if: condition
would skip immediately anyway)
- Distinguish 'no Docker run found' vs 'didn't complete in time' in
the polling loop's final error message
- Add comment explaining /api/automation/v1 probe returns 200 without
auth so the readiness check won't spin for 180s
- Document FILE_STORE, LOCAL_STORAGE_PATH, AUTOMATION_BASE_URL, and
AUTOMATION_WORKSPACE_BASE in the entrypoint header — these affect
production deployments, not just E2E tests
Co-authored-by: openhands <openhands@all-hands.dev>
---------
Co-authored-by: openhands <openhands@all-hands.dev>
|
||
|
Tim O'Farrellandopenhands
|
cd03d9cf9c |
chore: bump version to 1.0.0-alpha.10 (#990)
Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Tim O'Farrellandopenhands
|
07b53a756f |
chore: bump version to 1.0.0-alpha.9 (#948)
Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Tim O'Farrellandopenhands
|
99e7bb06cb |
Upgraded public extensions (#933)
Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Vasco Schiavo
|
49d73a69d7 | fix(skills): load repository skills into conversations and scope skill menus to the conversation workspace (#707) | ||
|
Rohit Malhotraandopenhands
|
7c7d78900e |
chore: bump version to 1.0.0-alpha.8 (#920)
Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Rohit Malhotraandopenhands
|
c76d855149 |
fix: include tools/ in npm package files (#904)
The tools/ directory containing canvas_ui_tool.py was missing from the package.json 'files' list, so it was not shipped in the published npm tarball. Users running the released 'agent-canvas' CLI would get: KeyError: "ToolDefinition 'canvas_ui' is not registered" Failed to import module 'canvas_ui_tool': No module named 'canvas_ui_tool' because the agent-server couldn't find the Python module that dev-safe.mjs exposes via OH_EXTRA_PYTHON_PATH. Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Rohit Malhotraandopenhands
|
bd894b0708 |
feat: add mock-LLM E2E test infrastructure (#833)
* feat: add mock-LLM E2E test infrastructure Add a new category of E2E tests that exercise the full UI → agent-server → LLM stack using a scripted mock LLM server instead of real LLM credentials. The mock server uses openhands-sdk's TestLLM to serve deterministic OpenAI- compatible responses (tool calls and text replies) over HTTP, so these tests are fully reproducible and need no API keys. The Playwright test drives the real UI: 1. Creates an LLM profile via Settings > LLM Profiles 2. Sets the profile as active (points at the mock server) 3. Starts a new conversation from the home page 4. Sends a user message and verifies the agent responds Verification is three-layered: - Events API: polls for a successful terminal observation - Chat UI: asserts the bash output token appears in rendered messages - Chat UI: asserts the agent's final reply token appears New files: - tests/e2e/mock-llm/scripts/mock-llm-server.py (TestLLM HTTP server) - tests/e2e/mock-llm/utils/mock-llm-helpers.ts (shared Playwright helpers) - tests/e2e/mock-llm/mock-llm-conversation.spec.ts (the test spec) - playwright.mock-llm.config.ts (dedicated Playwright config) Run with: npm run test:e2e:mock-llm Co-authored-by: openhands <openhands@all-hands.dev> * fix: make mock-LLM E2E assertions real + add CI workflow Fixes three broken verification checks in the mock-LLM test: 1. User message no longer contains BASH_TOKEN or REPLY_TOKEN. The mock LLM ignores the prompt anyway (TestLLM pops scripted responses from a deque), so embedding tokens in the prompt just caused the UI assertions to pass vacuously from the user's own message text. 2. waitForNonUserMessageText now searches only agent/environment output containers (agent-message, environment-message, model-messages, event-group) instead of the whole document body. This is a positive selector strategy — no risk of false positives from sidebar text, nav labels, or user input. 3. Error banner assertion no longer swallows failures. The previous .catch(() => {}) meant the step could never fail even when an error banner was visible. Also adds .github/workflows/mock-llm-e2e.yml — triggered on PRs with the 'e2e-tests' label or manual workflow_dispatch. No secrets needed (the mock LLM server is self-contained). Co-authored-by: openhands <openhands@all-hands.dev> * feat: add PR comment with test results to mock-LLM E2E workflow The CI workflow now: 1. Captures test exit code without failing the step (so later steps run) 2. Renders a markdown report from Playwright's JSON output showing each test name with pass/fail/skip status, duration, and retry count 3. Posts (or updates) a PR comment via the existing upsert-pr-comment.mjs script, using a dedicated '<!-- mock-llm-e2e-report -->' marker 4. Expands failure details in a collapsible section with the error message 5. Writes the same report to the GitHub Actions step summary 6. Links to the workflow run and uploaded test artifacts 7. Fails the job at the end if the test exit code was non-zero Also adds the json reporter to playwright.mock-llm.config.ts. Co-authored-by: openhands <openhands@all-hands.dev> * fix: use venv for openhands-sdk in CI to avoid PEP 668 error Ubuntu 24.04's system Python is externally managed (PEP 668), so `uv pip install --system` fails. Fix by creating a dedicated venv for the mock LLM server and passing the venv's python path via MOCK_LLM_PYTHON env var. The Playwright config reads `MOCK_LLM_PYTHON` (default: 'python3') for the webServer command, so local usage is unchanged. Co-authored-by: openhands <openhands@all-hands.dev> * fix: retry loop for mock LLM server verification in CI The litellm import takes ~7 seconds on CI, so the fixed 'sleep 3' was too short. Replace with a 30-second retry loop that polls the server every second until it responds, then performs the JSON validation. Co-authored-by: openhands <openhands@all-hands.dev> * fix: add GET / health check to mock LLM server Playwright's webServer readiness probe sends GET / to the configured URL. The mock server only handled POST, returning 501 for everything else. Playwright interpreted this as 'not ready' and timed out after 30 seconds. Add a do_GET handler that returns 200 with a simple JSON status. Co-authored-by: openhands <openhands@all-hands.dev> * ci: post fresh PR comment per run + cache Playwright browsers - Post PR comment: switch from upsert-pr-comment.mjs (which found and updated a single marker-tagged comment) to `gh pr comment` so each CI trigger leaves its own comment with full test results history. Remove the COMMENT_MARKER from render-mock-llm-report.mjs since it was only used for the dedup lookup. - Cache Playwright: add actions/cache for ~/.cache/ms-playwright keyed on package-lock.json hash. On cache hit, only install system deps (fast apt layer) instead of re-downloading the full Chromium binary. Co-authored-by: openhands <openhands@all-hands.dev> * ci: remove Playwright cache (caused extraction hang) The actions/cache@v4 step for ~/.cache/ms-playwright reproducibly caused npx playwright install to hang during Chrome zip extraction (7+ min with no output, vs 24s without caching). The uncached install completes in ~24s which is fast enough — remove caching for now. Co-authored-by: openhands <openhands@all-hands.dev> * ci: move Playwright install before uv/openhands-sdk setup Playwright's Chrome zip extraction hangs reproducibly when run after the uv venv + openhands-sdk install steps (7+ min with no output). The snapshot-tests workflow, which installs Playwright right after npm ci, completes in ~21s on the same commit at the same time. Move Playwright install immediately after npm ci — before uv, SDK, and mock-server verification — to match the working step order. Co-authored-by: openhands <openhands@all-hands.dev> * ci: split Playwright install into deps + browser download Split 'npx playwright install --with-deps chromium' into two steps: 1. install-deps (apt packages only, no browser download) 2. install (browser download + extraction only) This isolates which phase is hanging: the combined --with-deps flag runs both in a single process, and the extraction hangs reproducibly in this workflow despite identical config to snapshot-tests (which works in 21s). Splitting may avoid whatever interaction causes the extraction to stall. Co-authored-by: openhands <openhands@all-hands.dev> * ci: pin Node 24.15 to fix Playwright install hang Node 24.16.0 introduced a zip-extraction regression (nodejs/node#63487) that causes 'playwright install' to hang indefinitely after download completes for Playwright < 1.60.0. This repo uses Playwright 1.59.1. The hang was reproduced 4 times on this workflow — download finishes in ~3s but extraction never completes (7+ minutes of silence). Meanwhile snapshot-tests (same config) worked because its runner resolved to Node 24.15.0. Pin to 24.15.x until the project upgrades to Playwright >= 1.60.0, which includes a fix for the extract-zip interaction. Also revert the split install-deps / install experiment back to the original single 'npx playwright install --with-deps chromium' command. Ref: microsoft/playwright#41000, microsoft/playwright#40724 Co-authored-by: openhands <openhands@all-hands.dev> * ci: tighten mock-LLM test timeouts and remove CI retries Mock LLM responses are instant, so the generous timeouts were causing CI to hang for 10+ minutes when a test fails: - retries: 1→0 in CI (mock tests should be deterministic) - test timeout: 120s→60s (mock responses are instant) - polling timeouts: 60s→30s for bash observation and chat text checks Before: 3 tests × 120s timeout × 2 attempts (retry) = up to 12 min After: 3 tests × 60s timeout × 1 attempt = up to 3 min on failure Co-authored-by: openhands <openhands@all-hands.dev> * fix: step 3 conversation creation + add global timeout Step 3 was clicking the home-chat-launcher container div (a passive wrapper) instead of using the chat input to create a conversation. The div click did nothing, and the test timed out waiting for navigation to /conversations/<id>. Fix: type into the home-page chat input and click submit — this is how real users create conversations from the home page. Also: - Add globalTimeout (10 min in CI) to cap the entire Playwright run so teardown hangs don't waste CI time - Reduce job timeout-minutes from 20 to 15 Co-authored-by: openhands <openhands@all-hands.dev> * fix: teardown hang via exec + add diagnostic logging 1. Prefix webServer command with 'exec env' so the shell is replaced by the npm process. Without exec, Playwright's SIGTERM kills the shell but npm's children (uvx, agent-server, vite) survive as orphans, causing the step to hang for 6+ minutes after tests finish. 2. Add diagnostic logging to waitForSuccessfulBashObservation — on timeout, the error message now includes the count and kinds of events the API actually returned, so we can tell whether the conversation never started vs the observation format changed. 3. Add a pre-flight API check in step 3 that verifies the mock-LLM profile's base_url is active in server settings before creating a conversation. If steps 1+2 didn't persist correctly, this fails fast with a clear message instead of timing out on empty events. Co-authored-by: openhands <openhands@all-hands.dev> * fix: profile check via /api/profiles + timeout wrapper for teardown 1. The pre-flight check was querying /api/settings which doesn't contain profile-based LLM config. Fix: query /api/profiles and assert active_profile matches the expected profile name. 2. Wrap the Playwright command in 'timeout --kill-after=30 8m' so if webServer teardown hangs (orphaned agent-server/vite processes ignoring SIGTERM), the entire process tree gets SIGKILL'd after 8.5 minutes instead of waiting for the 15-min job timeout. Co-authored-by: openhands <openhands@all-hands.dev> * debug: dump first observation's raw structure on failure The events API is returning events (agent-server logs show the bash command was executed), but isSuccessfulBashObservation can't find a match. Dump the first observation's full JSON structure so the next CI run shows exactly what fields the API returns. Co-authored-by: openhands <openhands@all-hands.dev> * debug: dump raw event structures to discover API format Previous diagnostic showed 8 events all with 'unknown' kind — meaning the events don't have action.kind or observation.kind properties. Dump the full JSON of the first 3 events to discover the actual field structure. Co-authored-by: openhands <openhands@all-hands.dev> * debug: dump ALL event kinds + first non-stats event structure Previous dump only showed first 3 events (all stats/state updates). The observation events are likely in positions [3]-[7]. New diagnostic shows all event kinds and dumps the first non-stats event so we can see the actual action/observation format. Co-authored-by: openhands <openhands@all-hands.dev> * fix: use correct APIs for mock-LLM E2E verification The agent-server's conversation events API returns MessageEvents (not nested ActionEvent/ObservationEvent), and tool executions live in the separate bash events API (/api/bash/bash_events/search). Changes: - waitForSuccessfulBashObservation: now queries /api/bash/bash_events/search with kind__eq=BashOutput, checks stdout/stderr for BASH_TOKEN - waitForAgentMessageContaining: new helper that checks conversation events API for agent MessageEvents containing a given token - Step 3 verification now: 1. Bash tool execution via bash events API 2. Agent reply via conversation events API 3. Reply token in chat UI (proves full round-trip) (Removed BASH_TOKEN UI check — it may not render in chat) Co-authored-by: openhands <openhands@all-hands.dev> * perf: cache Playwright browser binaries in CI Split 'playwright install --with-deps chromium' into two steps: 1. 'playwright install chromium' (only on cache miss) — downloads ~200MB of browser binaries, cached via actions/cache keyed on PW version + OS 2. 'playwright install-deps chromium' (always) — installs apt system libraries needed by the browser (fast, mostly pre-installed on runner) This should save ~30-60s on cache-hit runs since the browser download is the slowest part of the Playwright setup. Co-authored-by: openhands <openhands@all-hands.dev> * fix: accept BashOutput with null stdout (exit_code=0 proves execution) The bash events API returns BashOutput events where stdout can be null even for successful commands (order:0 event with exit_code:0). Accept null stdout with exit_code 0 as proof of successful execution. Also dump all bash events (not just first) for CI diagnostics. Co-authored-by: openhands <openhands@all-hands.dev> * fix: don't fail CI when tests pass but teardown hangs The Playwright webServer teardown can hang when the agent-server process doesn't respond to SIGTERM (a known issue with uvicorn child processes). The timeout wrapper kills the process tree after 8 min, but this was incorrectly mapped to test failure. Now when timeout triggers: 1. Check if test-results-mock-llm/results.json exists (Playwright writes this before teardown starts) 2. Parse it: if every spec/test has status 'passed', mark as success 3. Only fail if results.json is missing or has actual test failures Also includes the Playwright cache and bash events API fix. Co-authored-by: openhands <openhands@all-hands.dev> * fix: background Playwright so shell survives teardown timeout The previous 'timeout' wrapper killed the entire process group including our bash shell, so the results.json check never ran. Now: 1. Run Playwright in background (&) 2. Poll every 2s up to 8 min 3. If still running, SIGTERM then SIGKILL the process group 4. Our shell is still alive → check results.json 5. If all tests passed, mark as success despite teardown hang Co-authored-by: openhands <openhands@all-hands.dev> * fix: poll for results.json during run, not after kill Playwright's JSON reporter writes results.json after all tests complete but before webServer teardown. Poll for the file appearance during the run (Phase 1), then only kill the hanging process if tests are done (Phase 2). This way we catch results.json while Playwright is still alive but stuck in teardown, and can correctly determine pass/fail. Co-authored-by: openhands <openhands@all-hands.dev> * fix: parse Playwright stdout for pass/fail (not results.json) Playwright's JSON reporter only writes results.json on process exit, which is blocked by the webServer teardown hang. The line reporter prints test results to stdout in real-time BEFORE teardown starts. New approach: - Capture stdout with tee to a log file - Poll the log for 'N passed' summary line - After killing the hanging process, check the log: if 'N passed' exists and no 'N failed' or 'N timed out', mark success This lets us correctly report passing tests even when the agent-server process doesn't respond to SIGTERM during webServer teardown. Co-authored-by: openhands <openhands@all-hands.dev> * fix: write PW output to file directly, add debug logging Process substitution >(tee ...) is fragile with background kills — the tee process might be killed alongside npm, leaving an incomplete log. Write directly to file and tail separately for CI output. Added explicit debug logging: - 'Checking PW_LOG for pass/fail...' - grep output showing what matched - Different message for failure vs success Co-authored-by: openhands <openhands@all-hands.dev> * debug: add verbose logging to post-kill check Need to see: does PW_LOG exist? What size is it? What does grep find? Which branch of the if/else is taken? Where exactly does it stop? Co-authored-by: openhands <openhands@all-hands.dev> * fix: use marker file written by test to detect pass/fail Playwright's JSON reporter only flushes on clean process exit, and stdout redirection is unreliable with backgrounded process trees. Instead, the test itself writes a .all-passed marker file after all assertions succeed. The CI wrapper polls for this file to detect test completion, then safely kills the hanging teardown process. Co-authored-by: openhands <openhands@all-hands.dev> * chore: clean up debug diagnostics from helpers Remove per-event JSON dumps and verbose diagnostic logging from waitForSuccessfulBashObservation. Keep concise error messages. Co-authored-by: openhands <openhands@all-hands.dev> * fix: detect test completion immediately via custom reporter Playwright's reporter onEnd() fires AFTER all tests complete but BEFORE webServer teardown starts. A custom DoneMarkerReporter writes: .tests-done — always (content: 'passed' or 'failed') .all-passed — only when all tests pass The CI wrapper polls for .tests-done, so it detects completion immediately on both pass AND fail. Previously it only polled for .all-passed, meaning test failures wasted the full 5-min polling timeout before the step could finish. This also moves the marker logic out of the test spec and into the reporter, which is cleaner — the test code doesn't need to know about CI infrastructure. Co-authored-by: openhands <openhands@all-hands.dev> * fix: write marker files outside Playwright's outputDir Playwright clears its outputDir at the start of each run. Writing markers to a separate .mock-llm-markers/ directory avoids interference. Also wrapped onEnd() in try/catch and resolved paths via import.meta.url to be robust against working directory changes. Co-authored-by: openhands <openhands@all-hands.dev> * debug: add console.log to reporter, use process.cwd() import.meta.url may not work in Playwright's CJS reporter context. Use process.cwd() instead. Add console.log in onBegin/onEnd to verify the reporter is loaded and executing. Co-authored-by: openhands <openhands@all-hands.dev> * fix: write markers in onTestEnd, not onEnd Playwright's lifecycle: onBegin → tests → onTestEnd → onEnd → cleanup. WebServer teardown happens during 'cleanup', which hangs indefinitely. onEnd() fires AFTER cleanup, so it never executes when teardown hangs. onTestEnd() fires immediately after each test completes, before any cleanup begins. Track total/completed test counts and write markers after the last test finishes. This gives both pass and fail signals before the teardown hang blocks everything. Co-authored-by: openhands <openhands@all-hands.dev> * fix: report script falls back to marker files when results.json missing Playwright's JSON reporter only flushes results.json on clean process exit. When the webServer teardown hangs and the process is killed, results.json never gets written, so the report showed 0/0 tests. The render script now checks .mock-llm-markers/.tests-done (written by DoneMarkerReporter in onTestEnd, before teardown) as a fallback. This gives correct pass/fail status in the PR comment even without results.json. Co-authored-by: openhands <openhands@all-hands.dev> * fix: proper teardown and accurate test durations in PR comment Two fixes: 1. **Teardown hang resolved**: The webServer command now bypasses npm and `exec`s directly into `node scripts/dev-safe.mjs`. Previously `exec ... npm run dev:minimal` was used, but npm does NOT forward SIGTERM to its child processes. When Playwright sent SIGTERM during teardown, npm died but node/uvx/vite survived as orphans, causing the hang. Now SIGTERM goes straight to dev-safe.mjs's signal handler which kills children via process groups and exits cleanly. 2. **Accurate durations**: DoneMarkerReporter now writes a `.results.json` with per-test title, status, duration, and error data (from `TestResult.duration` in onTestEnd). The report script reads this instead of showing 0ms. Falls back to `.tests-done` (pass/fail only) if the JSON is missing. Co-authored-by: openhands <openhands@all-hands.dev> * chore: reduce teardown grace period from 10s to 5s The marker-based detection is immediate (onTestEnd fires before teardown), so we don't need a long grace period. The remaining hang is Playwright waiting for the multi-process agent-server tree to fully exit — expected behavior, not a bug. Co-authored-by: openhands <openhands@all-hands.dev> --------- Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Tim O'Farrellandopenhands
|
d1813c6cfe |
refactor: update @openhands/extensions from MCP to integrations (#875)
* refactor: update @openhands/extensions from MCP to integrations Migrate from @openhands/extensions/mcps to @openhands/extensions/integrations following the upstream rename in OpenHands/extensions. Key changes: - MCP_CATALOG -> INTEGRATION_CATALOG - McpCatalogEntry -> IntegrationCatalogEntry - MarketplaceTemplate -> IntegrationTransport - MCP_LOGOS/MCP_FALLBACK_LOGO -> INTEGRATION_LOGOS/INTEGRATION_FALLBACK_LOGO - entry.template -> entry.connectionOptions[].transport (via getDefaultTemplate helper) - automation.requiredMcpIds -> automation.requiredIntegrationIds The new integration catalog structure supports multiple connection options per entry (e.g., OAuth + stdio fallback). A getDefaultTemplate() helper extracts the transport config from the default connection option. Co-authored-by: openhands <openhands@all-hands.dev> * Set correct version * fix: resolve lint errors - Replace Date.now() with useId() for pure render function compliance - Use optional chaining in handleStdioSubmit - Remove unused eslint-disable directive - Fix prettier formatting issues Co-authored-by: openhands <openhands@all-hands.dev> * fix: add getInstallableTemplate for stdio-preferred MCP installations Integration entries like GitHub and Slack now default to OAuth transport, but the UI doesn't support OAuth yet. Add getInstallableTemplate() that prefers stdio (API key-based) connection options over OAuth defaults. - Add getInstallableTemplate() that finds stdio options first - Update install-server-modal.tsx to use getInstallableTemplate - Update recommended-automations-*.tsx to use getInstallableTemplate - Update findCatalogEntryForServer to check ALL connection options This ensures the install modal shows the correct input fields (e.g., GITHUB_PERSONAL_ACCESS_TOKEN) and correctly detects installed servers. Co-authored-by: openhands <openhands@all-hands.dev> --------- Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
|
665a258b80 |
feat(acp): inline live model picker for ACP conversations (#769) (#832)
* feat(acp): inline live model picker for ACP conversations (#769) Converge ACP model selection onto the native LLM-profile inline picker UX with live mid-conversation switching, replacing the display-only popover. - Bump @openhands/typescript-client 1.23.3 -> 1.24.0 (adds switchAcpModel). - AgentServerConversationService.switchAcpModel(conversationId, model): POST /switch_acp_model via ConversationClient, with switchProfile's local-only guard. - useSwitchAcpModel hook: live switch for a running ACP session; for the home/no-session case, persist the choice as the agent-settings default (agent_settings_diff { acp_model }) so the next conversation inherits it. - ChatInputModel popover becomes a picker over the provider's available_models (check on the effective model), local backend only; cloud / custom-provider / native surfaces keep the display + Settings link. - New i18n key MODEL$AVAILABLE_MODELS. - Tests for the hook (live vs settings-default branches) and the picker. Local backend only (matches native switching); custom/unknown providers and any app_server route remain out of scope per #769. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(acp): open the model picker on click (don't self-close via click-outside) The inline picker's trigger button sits outside the popover element, so the document click-outside handler (useClickOutsideElement) treated the opening click as an "outside" click and closed the popover in the same interaction — clicking the chip appeared to do nothing. (A programmatic el.click() worked by fluke: the popover isn't rendered yet when that click bubbles, so the ref is null and the close is skipped.) Pass the trigger button as the hook's ignoreOutsideClickRef so a click on the chip toggles the popover instead of being treated as an outside click. Validated end-to-end against a local agent-server 1.24.0: the picker opens and lists the provider's available_models, and selecting one writes the default via PATCH /settings (home case), with the chip updating to the new model. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(acp): drop disableToast in useSwitchAcpModel so switch errors surface useSwitchLlmProfile sets meta.disableToast because it's wrapped by useSwitchLlmProfileAndLog, which re-surfaces errors via its own onError. useSwitchAcpModel is called directly (no such wrapper / no onError), so disableToast was silently swallowing failed switches and settings writes (e.g. a 409 before the first message, network errors, the cloud guard). Remove it and let the global mutation error toast report failures — simpler and gives the user feedback when a switch doesn't take. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(acp): share chat input model picker state * chore: address PR review feedback (#832) - Add unit test for useChatInputModelState pinning its branching contract, incl. the active-ACP getAcpProvider lookup (was home-only in old component). - Document why the overflow model submenu uses overflow-y-auto (scroll long model lists) rather than overflow-visible — no floating children to clip. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: address PR review feedback (#832) - Wrap the 'Available models' section label in a presentational <li> so it is a valid child of the ContextMenu <ul> (was a bare <div>). - Drop unnecessary 'as never' casts in use-switch-acp-model tests now that the real return types (Promise<void>, Promise<boolean>) are honored. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(acp): bump agent-server pin to 1.24.0 for /switch_acp_model The inline ACP model picker POSTs to /api/conversations/{id}/switch_acp_model, which is new in openhands-agent-server 1.24.0. The PR description already lists agent-server:1.24.0 as a dependency, but config/defaults.json was left at 1.23.1, so local dev (npm run dev) and Docker installs would 404 on every model switch attempt. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(settings): always land on /settings/agent from /settings The fallback order in ``getFirstAvailablePath`` put ``/settings/llm`` first whenever ``hide_llm_settings`` was off, so clicking Settings sent the user to the LLM page. For ACP users that page is disabled and ``redirectIfAcpActive`` only catches them when the *personal* settings already say ``agent_kind === "acp"`` — being in an ACP conversation with non-ACP personal settings (the common case during the inline picker flow) bypassed the guard and dumped them on /settings/llm. Make ``/settings/agent`` the unconditional first fallback. It is always available (no feature flag hides it), houses the agent-kind picker, and the left nav still gets OpenHands users to LLM in one click — so one extra click for non-ACP users buys a much simpler routing surface and kills the ACP misroute. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(settings/agent): clear command when switching to Custom preset Selecting "Custom" in the agent preset dropdown reset ``acpModel`` and flipped ``isCustomAcpModel`` but left ``commandText`` untouched. On the next render, ``detectPreset(commandText, ACP_PROVIDERS)`` still matched the previous provider's ``default_command`` and snapped the dropdown back off "Custom" — the toggle never stayed on Custom. Clear ``commandText`` in the Custom branch so ``detectPreset`` falls through to ``ACP_CUSTOM_PRESET_KEY`` on the next render and the dropdown stays where the user put it. Empty command also matches the intended "user supplies their own" semantics of the preset. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(settings): mark Verification page as disabledByAcp The Verification page writes ``confirmation_mode`` and ``security_analyzer`` into ``conversation_settings_diff``. The ACP agent loop never reads either: ``openhands/sdk/agent/acp_agent.py`` has zero references to ``confirmation_policy`` or ``security_analyzer``, and the only runtime readers (``openhands/sdk/agent/agent.py:844,855``) live on the native ``Agent`` class — not on ``ACPAgent``. The backend accepts the values and stores them on conversation state, but the ACP subprocess never consults them. So the page presents real-looking knobs that silently do nothing for ACP users. Mark it ``disabledByAcp: true`` — same pattern as ``/settings/llm`` and ``/settings/condenser`` — so it greys out in the nav and the existing route guard at ``src/routes/settings.tsx:47-51`` bounces direct visits to ``/settings/agent``. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(ci): bump doc/script SDK version examples to 1.24.0 The docs-version-sync test enforces that every documented agent-server version example matches ``config/defaults.json:versions.agentServer``. The previous commit bumped that pin from 1.23.1 to 1.24.0 for the ``/switch_acp_model`` route, but left the example references in AGENTS.md, ``scripts/dev-safe.mjs``, and ``scripts/check-sdk-version-sync.mjs`` behind — the drift-detector caught it as ``test-and-build`` failure. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(ci): bump remaining hard-coded 1.23.1 to 1.24.0 ``__tests__/scripts/dev-safe.test.ts`` asserts ``buildAgentServerCommand``'s default ``uvx`` args literally include ``openhands-agent-server==1.23.1`` and matching ``openhands-{sdk,tools,workspace}==1.23.1``. The CI fix in the prior commit only updated docs and example references; the central pin bump in ``config/defaults.json`` flowed through to this test's runtime expectation but the literal expectations were never updated. Bump them. Also bump the ``MOCK_AGENT_SERVER_VERSION`` placeholder in ``src/mocks/settings-handlers.ts`` for consistency with the central pin — no test asserts on it, but leaving the mock at 1.23.1 invites future drift confusion. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Debug Agent <debug@example.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Rohit Malhotraandopenhands
|
b6380f6e55 |
chore: bump version to 1.0.0-alpha.7 (#822)
Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Rohit Malhotraandopenhands
|
907d6bde76 |
chore: bump version to 1.0.0-alpha.6 (#793)
Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Rohit Malhotraandopenhands
|
cb831b2860 |
fix: include config/ in npm package files (#791)
The `config/` directory (containing `defaults.json`) was missing from the `files` allowlist in package.json, so it was excluded from the published npm tarball. The CLI entry point imports `scripts/dev-with-automation.mjs` which reads `config/defaults.json` at startup, causing an ENOENT crash. Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Rohit Malhotraandopenhands
|
603ed9d66d |
chore: bump version to 1.0.0-alpha.5 (#789)
Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Tim O'Farrellandopenhands
|
eb7c983169 |
feat: bump @openhands/extensions to include github-repo-monitor and slack-channel-monitor (#781)
Pins @openhands/extensions from 7b33f64 (May 19) to b8c1869 (May 23), which adds two new automation catalog entries: - github-repo-monitor: watches GitHub repos for @OpenHands mentions - slack-channel-monitor: watches Slack channels for @openhands mentions Updates the popularity-order unit test to reflect the new 7-entry catalog ranking (github-repo-monitor at rank 98 sits between github-pr-reviewer at 100 and slack-standup-digest at 94). Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Rohit Malhotraandopenhands
|
43c10810da |
fix: switch @openhands/typescript-client from git dep to npm registry (#779)
* fix: switch @openhands/typescript-client from git dep to npm registry Replace the git+https dependency with the published npm package (v1.23.3). Git dependencies break `npm install -g` because npm clones the repo and runs the prepare script, but devDependencies like rimraf aren't available during global installs. Co-authored-by: openhands <openhands@all-hands.dev> * test: add guard against git dependencies in package.json Git dependencies break `npm install -g` because npm clones the repo and runs the prepare script without devDependencies. Add a test that fails if any dependency uses a git URL, with an allowlist for @openhands/extensions (not yet published to npm). Co-authored-by: openhands <openhands@all-hands.dev> * test: also catch bare owner/repo GitHub shorthand in git dep guard Co-authored-by: openhands <openhands@all-hands.dev> --------- Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
|
cc63f48a07 |
refactor(acp): source ACP model lists from typescript-client (closes #740) (#775)
* refactor(acp): source model lists from typescript-client registry Replace the hand-mined CLAUDE_MODELS / CODEX_MODELS / GEMINI_MODELS lists (and the duplicated provider metadata) with the @openhands/typescript-client ACP registry, which mirrors the Python SDK source of truth (openhands.sdk.settings.acp_providers). acp-providers.ts becomes a thin adapter: it enriches each upstream record with Canvas-only UI fields (brand icon + onboarding description) and keeps the helper functions + public export surface unchanged, so no consumers change. - Bump the @openhands/typescript-client pin to the #187 merge commit (082d4d46), which adds available_models / default_model to the registry. - Delete the three hardcoded model lists; build ACP_PROVIDERS from getAcpProvider() + a small ACP_PROVIDER_UI map. - Incidentally corrects the Gemini default to auto-gemini-2.5 (the CLI's auto-router default), matching the merged SDK/client. Closes #740. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore(acp): pin typescript-client to v1.23.2 tag (was SHA) Now that typescript-client v1.23.2 is tagged/released (includes #187's ACP registry, mirroring SDK #3389), pin to the tag instead of the raw #187 merge SHA. v1.23.2 tracks the SDK's v1.23.2 patch line. Resolves to the same commit as the prior SHA, so no resolved-content change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * ci(acp): remove obsolete ACP providers sync check The acp-providers-sync workflow + scripts/check-acp-providers-sync.mjs existed to keep Canvas's hand-kept ACP registry mirror in sync with the SDK source (agent-canvas#587). That mirror is gone — acp-providers.ts now sources its model data from @openhands/typescript-client, which carries its own SDK-drift check (check-acp-drift.py). So this canvas-side check is redundant and was failing on the refactored ACP_PROVIDERS (no longer a literal array). - Delete .github/workflows/acp-providers-sync.yml + the script. - Drop the docs-version-sync test case that asserted the script's example. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Debug Agent <debug@example.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Rohit Malhotraandopenhands
|
3e0d915526 |
chore: bump version to 1.0.0-alpha.4 (#771)
Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Graham Neubigandneubig
|
8cab54e0b1 |
Show agent-server version errors for workspaces (#742)
* Show workspace version errors in canvas * Use current agent server version in mocks * Pin merged typescript client dependency * Use typescript client v1.23 release * Clarify typescript client release pinning guidance --------- Co-authored-by: neubig <398875+neubig@users.noreply.github.com> |
||
|
Rohit Malhotra
|
eee7fe1b7a | feat: use async conversations and interrupt endpoint for local mode (#670) | ||
|
Rohit Malhotraandopenhands
|
979e64fe19 |
feat: add Docker CI to build all-in-one image with agent-server + automation + frontend (#634)
* feat: add Docker CI to build all-in-one image with agent-server + automation + frontend
Adds a GitHub Actions workflow (.github/workflows/docker.yml) that builds and
publishes ghcr.io/openhands/agent-canvas — a single Docker image combining:
1. Agent Server (ghcr.io/openhands/agent-server base image from SDK repo)
2. Automation server (pip-installed from openhands-automation)
3. agent-canvas frontend (static build from this repo)
The automation server is pip-installed rather than copied from its Docker image
because both services share openhands-sdk, fastapi, uvicorn, pydantic, httpx
etc. — installing into the agent-server's Python 3.13 deduplicates all shared
packages. Only automation-specific deps (asyncpg, sqlalchemy, boto3, …) are
added on top.
An entrypoint script starts all three services and a static-server proxy that
unifies them behind a single port (default 8000):
/api/automation/* → automation backend (:18001)
/api/* → agent-server (:18000)
/* → static frontend + SPA fallback
Workflow triggers:
- Push to main: builds and pushes with branch + SHA tags
- v* tags (releases): also pushes semver tags (1.2.3, 1.2, 1, latest)
- PRs: builds, pushes SHA-tagged image, updates PR description with
pull/run instructions (same pattern as the SDK repo)
- workflow_dispatch: supports overriding base image and automation version
Files added:
- docker/Dockerfile (multi-stage: frontend build + agent-server base)
- docker/entrypoint.sh (process manager for all three services)
- .dockerignore
- .github/workflows/docker.yml
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: build multi-arch Docker images (amd64 + arm64)
Adds QEMU setup for cross-compilation and defaults the platform matrix
to linux/amd64,linux/arm64 so the image works on both Intel and Apple
Silicon machines.
Co-authored-by: openhands <openhands@all-hands.dev>
* refactor: rewrite Docker workflow to match SDK repo structure
Replace the single-job QEMU approach with the same architecture-matrix
pattern used by the SDK repo's server.yml:
1. build-and-push-image — matrix over {amd64, arm64} with native runners
(ubuntu-24.04 for amd64, ubuntu-24.04-arm for arm64). Each job pushes
arch-suffixed tags (e.g. sha-abc1234-amd64) and uploads build-info
artifacts.
2. merge-manifests — downloads both arch build-infos, strips the -amd64
suffix from amd64 tags to derive manifest tags, and creates multi-arch
manifests via `docker buildx imagetools create`.
3. consolidate-build-info — aggregates all build-info and manifest-info
artifacts into a single JSON summary (PR-only).
4. update-pr-description — renders the summary into the PR body between
AGENT_CANVAS_DOCKER_START/END markers.
Native runners avoid the 3-5× slowdown of QEMU emulation for arm64
builds.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: sanitize branch names in Docker tags (/ is not allowed)
Branch names like 'feat/docker-ci' produce invalid Docker tags because
'/' is forbidden in tag names. Replace '/' with '-' so the tag becomes
'feat-docker-ci-amd64'.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: default automation to SQLite and fix wait blocking proxy startup
Two bugs:
1. The automation server defaults to PostgreSQL on localhost, which
doesn't exist in the all-in-one container. Default AUTOMATION_DB_URL
to sqlite+aiosqlite:// so it works out of the box. Users can override
with a real Postgres URL for production.
2. The bare 'wait' command waited for ALL background children — including
the long-running agent-server and automation processes — so the
static-server/proxy on port 8000 never started. Fix by waiting only
for the wait_for_port subshell PIDs.
Verified locally: all three services start, endpoints respond correctly,
no more scheduler ConnectionRefusedError.
Co-authored-by: openhands <openhands@all-hands.dev>
* feat: add VOLUME directives for persistence and project mounts
Declare /home/openhands/.openhands (settings, secrets, conversations,
automation SQLite DB) and /projects (user code) as Docker volumes so
data survives container restarts by default. Users should bind-mount
these for durable persistence:
docker run -v ~/.openhands:/home/openhands/.openhands \
-v ~/projects:/projects \
-p 8000:8000 ghcr.io/openhands/agent-canvas
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: set OH_SECRET_KEY default and pre-create persistence dirs
Three issues fixed:
1. OH_SECRET_KEY was not set → agent-server refused to return encrypted
secrets → conversation creation failed with 503. Set the same static
default used by dev-safe.mjs / dev-docker.mjs.
2. Persistence dirs (conversations, bash_events, automation DB) were not
pre-created → the openhands user got PermissionError when the VOLUME
directive created them as root. Pre-create with correct ownership
before the USER switch in the Dockerfile.
3. Set OH_PERSISTENCE_DIR, OH_CONVERSATIONS_PATH, OH_BASH_EVENTS_DIR
defaults in the entrypoint (matching dev-docker.mjs) so data lands
under the well-known ~/.openhands tree.
Verified locally: all three services start clean, no warnings about
OH_SECRET_KEY, SQLite migrations apply successfully.
Co-authored-by: openhands <openhands@all-hands.dev>
* chore: merge main and remove stale dev-docker.mjs references
Main removed scripts/dev-docker.mjs (Docker is no longer a dependency of
the npm package flow). Update comments in docker.yml, entrypoint.sh, and
AGENTS.md that referenced the deleted file.
Co-authored-by: openhands <openhands@all-hands.dev>
* feat: centralize config into config/defaults.json (single source of truth)
All version pins, port defaults, persistence paths, package names, and
the dev secret key now live in config/defaults.json. Consumers read from
it instead of hardcoding values:
- scripts/dev-safe.mjs: reads via JSON.parse(readFileSync(...))
- scripts/dev-with-automation.mjs: same
- scripts/check-sdk-version-sync.mjs: same (no longer regex-parses JS)
- docker/Dockerfile: config-gen build stage converts JSON to
/opt/agent-canvas/defaults.env (shell-sourceable)
- docker/entrypoint.sh: sources defaults.env at startup; also adds
session API key auto-generation so the image doesn't run wide-open
- .github/workflows/docker.yml: reads versions from JSON in a setup
step (no more hardcoded env vars)
To bump a version, edit config/defaults.json only.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: address PR review feedback (#634)
- Fix PID tracking bug: move PIDS+=($!) inside if/elif branches so the
else (automation-not-found) path doesn't add a stale PID
- chmod 600 session API key file to prevent credential leak
- Warn when using insecure default OH_SECRET_KEY in Docker entrypoint
- Add try/catch + field validation for config/defaults.json loading in
check-sdk-version-sync.mjs
- Fix semver tag parsing: strip pre-release/build metadata, only create
abbreviated tags (major.minor, major, latest) for stable releases
- Sanitize branch names for Docker tags (tr invalid chars, strip leading
dot/dash) to handle branches with #, @, spaces, etc.
- Add arch validation before manifest merge (assert both amd64.json and
arm64.json exist)
- Remove $schema reference to non-existent defaults.schema.json
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: remove hardcoded version defaults from Dockerfile
Replace hardcoded ARG defaults (AGENT_SERVER_IMAGE, AUTOMATION_VERSION)
with empty ARGs. Values are always derived from config/defaults.json:
- CI: reads JSON in the workflow config step, passes --build-arg
- Local: new scripts/docker-build.mjs helper reads JSON and invokes
docker build with the correct --build-arg values
Added npm run build:docker convenience script.
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: stabilize snapshot tests and auto-generate Docker secret key
Two fixes:
1. **Flaky snapshot tests**: The 'Local pagination fixture' mock conversation
used a fixed absolute timestamp (PAGINATION_BASE_TIME = May 13, 2026) for
its created_at/updated_at, while 'Errored Project' used a relative
timestamp (now - 7d). As real time progressed past the crossover point,
their sort order in the sidebar flipped, causing 30/73 snapshot diffs on
every PR. Fix: use relative timestamps (now - 6d) for the pagination
fixture's conversation listing fields. The internal event timestamps
(used by pagination tests) still use PAGINATION_BASE_TIME — only the
sidebar ordering is affected.
2. **Docker OH_SECRET_KEY**: The entrypoint used a static insecure default
for OH_SECRET_KEY and warned about it. Now mirrors the session API key
pattern: auto-generate a cryptographic random key on first run, persist
it to ~/.openhands/agent-canvas/secret-key.txt, and reuse on restart.
Users can still override via the OH_SECRET_KEY env var. Removed the
now-unused CONFIG_SECRET_KEY from the Docker defaults.env generation.
Also deduped STATE_DIR computation (was repeated for session key path).
Co-authored-by: openhands <openhands@all-hands.dev>
* docs: update AGENTS.md with mock timestamp and Docker secret key notes
Co-authored-by: openhands <openhands@all-hands.dev>
* fix: include canvas_ui tool in Docker image
The Docker image was missing the tools/ directory and OH_EXTRA_PYTHON_PATH,
so the agent-server couldn't import canvas_ui_tool.py when the frontend
sent canvas_ui in the conversation tools list. This caused:
HTTP 500: ToolDefinition 'canvas_ui' is not registered
Fix: COPY tools/ into the image and set OH_EXTRA_PYTHON_PATH in the
entrypoint, matching what scripts/dev-safe.mjs already does for local dev.
Co-authored-by: openhands <openhands@all-hands.dev>
---------
Co-authored-by: openhands <openhands@all-hands.dev>
|
||
|
Engel Nystandopenhands
|
1a6e629fda |
fix: sync MCP marketplace with extensions catalog (#645)
Update the extensions dependency to the commit that removes deprecated MCP entries, assert those entries stay absent from the marketplace, and keep legacy installed servers visible/searchable in the MCP settings UI. Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Engel Nystandopenhands
|
7b9c2fec33 |
Update Slack MCP catalog entry (#641)
* Update Slack MCP catalog entry Co-authored-by: openhands <openhands@all-hands.dev> * Apply suggestion from @enyst * Pin extensions to merged Slack MCP fix --------- Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
Rohit Malhotraandopenhands
|
edb998220a |
Remove Docker dependency from dev workflow (#635)
- Delete scripts/dev-docker.mjs and its test - Simplify package.json: 'npm run dev' now runs local uvx stack directly (agent-server + automation + Vite + ingress), no Docker needed - Remove dev:docker, dev:docker:dynamic, dev:dangerously-dockerless scripts - Add dev:static for production-build frontend variant - Update bin/agent-canvas.mjs CLI to use uvx-based stack - Rename Docker-specific variables: DOCKER_PROJECTS_PATH → PROJECTS_PATH, shouldDefaultToDockerProjects → shouldDefaultToProjectsPath - Update i18n: HOST_HOME_NOT_MOUNTED_HINT no longer references Docker - Update all docs (README, DEVELOPMENT, SELF_HOSTING, AGENTS.md, CHANGELOG) - Rename e2e snapshot: docker-workspace-browser → projects-workspace-browser - Fix all tests to reflect new script names and remove Docker references Co-authored-by: openhands <openhands@all-hands.dev> |
||
|
|
90ad71dbd9 |
Add recommended automations and MCP marketplace setup flow (#504)
* Add recommended automations marketplace flow Co-authored-by: openhands <openhands@all-hands.dev> * Update GitHub MCP QA findings Co-authored-by: openhands <openhands@all-hands.dev> * Polish MCP and automation marketplace UI Add a shared MCP logo badge, make marketplace cards more compact, and show required MCP logos prominently on recommended automation cards. Update the extensions package lock to the per-entry catalog split and save QA screenshots/results in .pr/. Co-authored-by: openhands <openhands@all-hands.dev> * Align recommended automations styling Remove the custom gradient treatment and match the recommended automation cards and setup modal to the existing Automations and MCP page surfaces, spacing, borders, and typography. Co-authored-by: openhands <openhands@all-hands.dev> * Show existing automations before recommendations Move the recommended automations section below the current automation list and creation guidance so the page prioritizes the user existing automation state. Co-authored-by: openhands <openhands@all-hands.dev> * Add recommendations to onboarding Show recommended automations below the Say Hello input so new users can launch a curated automation from the final onboarding step. Co-authored-by: openhands <openhands@all-hands.dev> * Use extensions MCP marketplace exports Remove the local MCP marketplace wrapper and consume MCP catalog data plus logo mappings directly from @openhands/extensions/mcps. Co-authored-by: openhands <openhands@all-hands.dev> * Archive previous PR QA and add refreshed artifacts Co-authored-by: openhands <openhands@all-hands.dev> * Add scheduled automation QA evidence Co-authored-by: openhands <openhands@all-hands.dev> * Streamline recommended automation launch Co-authored-by: openhands <openhands@all-hands.dev> * Refresh QA evidence and remove old artifacts Co-authored-by: openhands <openhands@all-hands.dev> * Ensure canvas tools are on Python path * Require MCP installs before launching recommendations * Remove archived PR artifacts * Drop redundant PYTHONPATH launcher changes * Inline recommended automation catalog * Point extensions dependency at main * Augment recommended automation prompts with explicit API instructions When a recommended automation is selected, the pre-filled prompt now includes backend-specific API instructions so the agent calls the correct endpoint: - Local backends: directs the agent to use the local automation API from <RUNTIME_SERVICES> with $OPENHANDS_AUTOMATION_API_KEY auth, and explicitly tells it NOT to call the cloud API at app.all-hands.dev. - Cloud backends: directs the agent to use the OpenHands Cloud Automations API at app.all-hands.dev with Bearer $OPENHANDS_API_KEY. The buildAutomationPrompt() helper is exported for testability. Three new unit tests cover both backend kinds and prompt preservation. Co-authored-by: openhands <openhands@all-hands.dev> * Fix recommended automation launch regressions Co-authored-by: openhands <openhands@all-hands.dev> * Expose local automation API key to agent terminals Co-authored-by: openhands <openhands@all-hands.dev> * Stabilize conversation panel stop menu test Co-authored-by: openhands <openhands@all-hands.dev> * chore: Remove PR-only artifacts * fix: pin @openhands/extensions to specific commit for reproducibility Updates the dependency from #main to the exact commit SHA (3bba8e3b) that contains the MCP and automation catalogs added in extensions#237. This ensures reproducible builds since npm ci will use the locked SHA instead of potentially picking up a newer main. * Address final automation marketplace review comments Co-authored-by: openhands <openhands@all-hands.dev> --------- Co-authored-by: openhands <openhands@all-hands.dev> Co-authored-by: allhands-bot <allhands-bot@users.noreply.github.com> |
||
|
|
f0c36bac8f |
feat(acp): Settings → Agent + onboarding + chat-UI gating for ACP-driven conversations (#416)
* feat(acp): add minimal ACP agent UI (parity with OpenHands#14401) Adds a Settings → Agent page so users can switch the conversation between the built-in OpenHands agent and an external ACP (Agent Client Protocol) subprocess (Claude Code, Codex, Gemini CLI, or custom command) without hand-editing settings. Discriminates in agent-server-adapter: when `agent_settings.agent_kind === "acp"`, build an `ACPAgent` payload (kind, acp_command, acp_model) instead of the LLM-shaped Agent, and skip the LLM defaults that would otherwise be rejected as extras. Stamps the provider key onto `tags.acpserver` so the chip can resolve a brand name from a single source. Tag-key constant note: the conventional `acp_server` form is invalid — agent-server validates tag keys against `^[a-z0-9]+$` and returns 422. The flattened `acpserver` form survives validation; the named constant `ACP_SERVER_TAG_KEY` keeps the regex and the key colocated. Gates the LLM and Condenser nav items behind a `disabledByAcp` flag, greys them out with a tooltip, and redirects to `/settings/agent` in the settings loader (not a per-route useEffect, so there is no one- frame flash of the LLM page before bouncing). E2E validated against `ghcr.io/openhands/agent-server:fa29ae2-python`: - PATCH /api/settings with `agent_kind: "acp"` round-trips - POST /api/conversations with the adapter's ACP payload returns 201, `agent.kind=ACPAgent`, `acp_command` preserved, tags stamped. Closes #412 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(acp): wire onboarding ChooseAgent step into ACP settings Drops the "Support for other agents coming soon!" banner now that the support exists. Enables the Claude Code / Codex tiles and adds a Gemini CLI tile so the four options here match ``ACP_PROVIDERS`` from the Settings → Agent page. Selecting an ACP option and clicking Next persists ``agent_kind:"acp"`` plus the registry provider key (``acp_server``) via ``useSaveSettings``, mirroring the diff the Settings page emits. The advance only happens on save success — a failed PATCH stays on the step and surfaces a toast. Skips the embedded LLM-setup step (index 2) on both forward and back navigation when an ACP agent is active: the subprocess owns its own LLM and authenticates through Secrets, so the form has nothing to configure. OpenHands path is untouched. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(acp): seamless Claude Code + Codex CLI auth via dev-docker Live-validated against `ghcr.io/openhands/agent-server:1.22.1-python` (the canvas's default pin, which now ships ACPAgent natively — no SHA override needed). Two changes surfaced by the run: 1. **Mount `~/.claude.json` in dev:docker.** Recent Claude Code CLI versions persist auth + workspace state in `~/.claude.json` next to (not inside) `~/.claude/`. Without this single-file mount, `@agentclientprotocol/claude-agent-acp` can't see the user's existing login and prompts to re-auth inside the sandbox. 2. **Use the new ACP package name in `ACP_PROVIDERS`.** Upstream renamed `@zed-industries/claude-code-acp` → `@agentclientprotocol/ claude-agent-acp`. The old name still works but emits an npm deprecation warning; the agent-server's own OpenAPI example uses the new name. Test fixtures pinning the legacy name updated to match. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(acp): import ACP_PROVIDERS from typescript-client Canvas was carrying its own copy of the ACP provider registry, which drifted out of sync with the canonical Python SDK source and ended up encoding an invalid Codex invocation (``@openai/codex acp`` — codex CLI has no ``acp`` subcommand, so the spawn deadlocked silently with ``Error: stdin is not a terminal`` and no log line). This change deletes ``src/constants/acp-providers.ts`` and imports the registry from ``@openhands/typescript-client`` instead, which now mirrors the Python SDK (see OpenHands/typescript-client#167). The TS SDK pin in ``package.json`` is bumped to the PR-branch SHA (``45a803c``) for now; once #167 merges and a new tagged release is cut, the pin can flip to the tag in a follow-up commit. Shape changes consumers needed to absorb: - ``ACPProviderConfig[]`` → ``Record<string, ACPProviderInfo>`` (lookup by key replaces ``.find``; ``Object.values`` where an array is needed) - ``display_name`` → ``displayName`` (camelCase matches TS conventions) - ``default_command`` → ``defaultCommand`` (and now ``readonly string[]``; components spread into a fresh array before passing to consumers that expect mutability) ``ACP_CUSTOM_PRESET_KEY`` is the only ACP-related constant that stays canvas-local — it's a synthetic sentinel for the "Custom" dropdown option, not a real provider, so it has no SDK counterpart. Moved to ``src/constants/acp-presets.ts``. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * revert(acp): keep ACP_PROVIDERS local to canvas Reverts the brief detour through `@openhands/typescript-client` for the ACP provider registry. Splitting the registry across two repos adds publish-coordination friction and doesn't actually eliminate the drift problem — it just moves it from "canvas vs. python-sdk" to "ts-sdk vs. python-sdk", with extra steps. Now: - `src/constants/acp-providers.ts` is the canvas-local copy again, with the corrected `codex` command (`@zed-industries/codex-acp`, the real ACP-protocol stdio server — not `@openai/codex acp`, which is the codex CLI's interactive mode and deadlocks the agent handshake when spawned without a TTY). - The package.json pin reverts to `v0.6.0` (the typescript-client release that does not include the unmerged `ACP_PROVIDERS` export from #167, which is now closed). - The split `acp-presets.ts` file is folded back in. Drift risk between this file and the Python SDK source is tracked in #587, with a longer-term plan to address it (TS-SDK mirror, code-gen, or runtime endpoint). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(acp): resolve empty acp_command from registry in adapter PR #416 ships the Settings → Agent page (and onboarding) with a "default preset" shortcut that stores ``acp_command: []`` and trusts the agent-server to resolve it from ``acp_server``. It doesn't. The agent-server's ``ACPAgent`` model has no ``acp_server`` field and no registry resolution — it just hands ``acp_command`` straight to a subprocess spawn. Empty list trips ``acp_agent.py:1013`` with ``IndexError: list index out of range``, the agent loop dies silently inside the agent-server's run thread, and the conversation hangs in ``idle`` with the user's message persisted but never answered. No error reaches the UI; from the user's perspective they sent a message and nothing happened. Caught while exercising the live ``dev:safe`` stack: a fresh conversation seeded from the onboarding "Claude Code" tile produced ``Failed to start ACP server: list / IndexError: list index out of range`` in the agent-server log. The fix is purely client-side — expand ``acp_command`` against ``ACP_PROVIDERS`` (canvas's local mirror of the Python SDK registry, see #587) before the payload leaves the adapter, when the user picked a built-in preset. ``acp_server: "custom"`` and any unknown key are left untouched — those genuinely depend on the user's explicit command, and silently inventing one would mask a real config bug. Three new adapter tests cover: - ``acp_command: []`` + ``acp_server: "claude-code"`` → command resolved to ``["npx","-y","@agentclientprotocol/claude-agent-acp"]`` - ``acp_command`` omitted entirely + ``acp_server: "codex"`` → same resolution path - ``acp_command: []`` + ``acp_server: "custom"`` → left untouched 2273 tests pass, lint + typecheck clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(acp): pass disabled state into SettingsDesktopSidebar When ACP is the active agent, ``useSettingsNavItems`` correctly tags the LLM and Condenser entries with ``disabled: true``. The mobile drawer (rendered via ``SettingsNavLink``) already respected that. The desktop sidebar (rendered via ``SidebarNavLink``, came in with the recent sidebar refactor) was constructing the link without forwarding the flag, so both items stayed fully clickable / styled as enabled while the conversation was running on an ACP subprocess. Two tiny changes: 1. ``SettingsDesktopSidebar`` passes ``renderedItem.disabled`` through to ``SidebarNavLink``. That alone gives the right visual state (``opacity-50``, ``pointer-events-none``) and keyboard behaviour (``tabIndex=-1`` + ``onClick preventDefault``) — both already implemented by ``SidebarNavLink``. 2. ``SidebarNavLink`` additionally sets ``aria-disabled="true"`` when ``disabled``, closing a screen-reader gap that existed independently of this regression (the link sounded actionable to assistive tech even though it wasn't). The ``clientLoader`` redirect in ``routes/settings.tsx`` continues to handle direct URL navigation to a disabled-by-ACP page, so even if someone bookmarks ``/settings/condenser`` and lands there while ACP is active, they get bounced to ``/settings/agent``. Two new tests in ``settings-navigation.test.tsx``: - Disabled-by-ACP items in the desktop sidebar carry ``aria-disabled``. - Enabled items don't. 2275 tests pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(acp): address PR #416 review feedback Addresses both human and all-hands-bot review comments on #416: **Critical bugs fixed** - ``acp_args`` duplication on load (bot critical #1): the textarea is the single source of truth for the launch tokens, but save only wrote ``acp_command`` — any API-set ``acp_args`` survived and concatenated at spawn time. Save now always writes ``acp_args: []``. - ``tokenizeCommand`` corrupted quoted Custom commands (human bug #2): ``bash -c "echo hello"`` got split into ``["bash","-c","\"echo","hello\""]`` and silently misbehaved. New ``src/utils/acp-command.ts`` wraps ``shell-quote`` with selective re-quoting (so ``npx -y @org/pkg`` renders verbatim, not ``\@org/pkg``) and filters non-string entries (redirects, env-var refs) out of the parsed argv. Round-trip tests pin the contract. - Loader/component settings cache mismatch (bot critical #4): loader used ``SETTINGS_QUERY_KEYS.byScope("personal")``; ``useSettings`` used ``[...byScope("personal"), backend.id, orgId]``. They didn't share cache. Aligned + set ``staleTime: 0`` on the loader read so cross-tab kind flips are picked up immediately (the in-render hook keeps its 5-minute stale window). - ``getFirstAvailablePath`` ignored the new agent route (human bug #3): ``/settings/agent`` now precedes the others in the fallback list, so first-time / hide_llm_settings users land on the agent picker rather than ``/settings/app``. - ``ACP_SETTINGS_KEYS`` documentation (human #4): pre-empts the "why not trim this list to UI-visible fields" question by spelling out that it serves as both the ACP allow-list and the OpenHands deny-list — trimming would silently leak API-set ``acp_*`` state. **Refactor (human #2 + #3)** - ``description_key`` moves into ``ACP_PROVIDERS``; the onboarding ``AGENT_OPTIONS`` is now derived from the registry so adding a new provider only needs one edit. - One ``buildAcpAgentSettingsDiff`` helper replaces the two near-copies in ``choose-agent-step.tsx`` and ``agent-settings.tsx``; both call sites are now under a single contract for the agent_settings_diff shape. **UX (bot)** - Onboarding progress bar shows the actual visited-step count when the LLM step is skipped (3 segments for ACP, 4 for OpenHands). Previously segment 2 popped "completed" on a slide the user never visited. **Test coverage (bot)** - New ``__tests__/utils/acp-command.test.ts`` covers parseCommand / formatCommand round-trips, quoted args, embedded escapes, shell- operator filtering, package-style tokens. - Adapter: empty ``acp_model: ""``, unknown ``acp_server`` key, ACP→OH→ACP round trip (no field leakage either direction). - agent-settings: cleared input keeps Save disabled, whitespace-only same, full Custom command with quoted args round-trips through shell-quote. - choose-agent-step: provider switching (claude-code → codex) rebuilds the diff cleanly, no leak from the prior selection. **Acknowledged (no action)** - Bot critical #2 (supply chain drift) — same problem as the existing agent-canvas#587, already tracked. - Bot critical #3 (desktop sidebar disabled) — fixed in 27a3e79 a few commits before this review was written; review snapshot was stale. - Translation duplication (human #1) — matches the existing ``translation.json`` convention (every key has all 15 locales). - Option-bag → split functions (human #5) — cosmetic; defer. 2292 tests pass, lint + typecheck clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(acp): pre-bundle shell-quote so the Vite dev server can load it ``shell-quote`` is a CommonJS module that does ``module.exports = { parse, quote }``. The previous commit wired it into ``src/utils/ acp-command.ts`` with a named ESM import, which the dev server rejected on the first ``agent-settings.tsx`` load: SyntaxError: The requested module '/node_modules/shell-quote/ index.js?v=...' does not provide an export named 'parse' Switching to a namespace import (``import * as shellQuote from "shell-quote"; const { parse, quote } = shellQuote;``) makes the named-export check pass, but Vite then served the raw CJS file to the browser unchanged and the next request died with: ReferenceError: exports is not defined This second failure is because ``vite.config.ts`` sets ``optimizeDeps.noDiscovery: true`` — new dependencies must be listed in ``optimizeDeps.include`` or Vite won't run them through its CJS-to-ESM prebundler. Adding ``"shell-quote"`` there fixes it; the existing entry has a comment block explaining the same constraint for other deps. The Rollup-based prod build was unaffected. Verified: dev server boots clean, ``GET /settings/agent`` returns 200, no ``exports is not defined`` in the Vite client log, 9 unit tests in ``__tests__/utils/acp-command.test.ts`` pass on the Node test runner (vitest) where the CJS interop already worked. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(acp): address second-pass review on PR #416 Addresses the second all-hands-bot review's critical + improvements: **Critical: load path mis-merged acp_command + acp_args** Settings stored with the registry-default shortcut (``acp_command: []``, ``acp_server: "claude-code"``) plus a non-empty ``acp_args`` showed only the args in the textarea — no registry prefix. Saving then sent ``acp_command: ["--extra-arg"]`` and flipped the preset to ``custom``, silently losing the ``npx -y @agentclientprotocol/ claude-agent-acp`` prefix. The fix expands the registry default *before* concatenating with args, so the textarea always shows the full launch command and round-trips cleanly. **Improvement: formatCommand drops empty-string args** ``formatCommand(["bash", "-c", ""])`` rendered as ``"bash -c "`` which parsed back to ``["bash", "-c"]``, silently losing the empty slot. Now quotes empty tokens explicitly so they survive. **Improvement: desktop sidebar disabled tooltip parity** Mobile drawer's ``SettingsNavLink`` already showed "Disabled while {agentName} is active" on greyed-out items; the desktop ``SidebarNavLink`` had no explanation. Added a ``disabledReason`` prop (i18n-agnostic; the caller formats the string) and wrap with ``StyledTooltip`` when disabled-with-reason. ``SettingsDesktopSidebar`` now forwards the formatted message — same UX on both surfaces. **Test coverage gaps the bot flagged** - ``agent-settings``: new regression guard for ``acp_command:[]`` + non-empty ``acp_args`` load (would have caught the critical bug above). - ``acp-command``: empty-string round-trip case + explicit assertion; five more shell-operator filters (pipe, ``;``, ``&&``, ``||``, ``>>``). - ``settings-navigation``: desktop sidebar wraps disabled items in StyledTooltip when ``disabledReason`` is supplied; not when omitted. Plus a clean merge from ``origin/main`` (one-line import conflict in ``agent-server-adapter.ts``). 2350 tests pass, lint + typecheck clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(acp): address third-pass review on PR #416 - parseCommand: try/catch around shell-quote.parse so a malformed command in the textarea can't crash Settings → Agent mid-render - Rewrite shell-metasyntax tests to pin the *actual* shell-quote behaviour (it's a parser, not a security filter) — operators, globs, and comments are dropped; backticks / $VAR / $(...) survive as literal tokens but are NOT expanded at parse time - Add npm URLs + verification date (2026-05-19) to each ACP_PROVIDERS entry so future maintainers can re-check upstream packages - Document the silent preset-switch behaviour on detectPreset (the dropdown follows the textarea; the textarea is the source of truth) - Use the exported ACP_SERVER_TAG_KEY constant in the adapter test so a rename surfaces as a compile error rather than a runtime schema mismatch - Restore the canonical typescript-client lock entry (drop the git+ssh:// + SHA bump that crept in from a local npm install) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(acp): don't expose LLM-switch UI on ACP conversations The SDK's ACPAgent carries a sentinel ``llm`` (``acp-managed``) for cost-attribution only — the real model lives on the ACP subprocess via ``acp_model`` and isn't visible on ``agent.llm.model``. Without this fix, ``toAppConversation`` surfaced the sentinel as the conversation's ``llm_model``, and the chat header's SwitchProfileButton happily let users "change the model" while the running Claude-Code / Codex / Gemini subprocess kept its own. A confusing silent no-op. Two layers of defence so no future consumer has to re-derive the rule: 1. Boundary normalisation: ``toAppConversation`` reads the pydantic discriminator (``info.agent.kind === "ACPAgent"``), surfaces it as ``agent_kind: "acp" | "openhands"`` on AppConversation, and nulls ``llm_model`` for ACP. Mirrors OpenHands PR #14401. 2. UI gate: SwitchProfileButton returns null when ``conversation.agent_kind === "acp"``. The right control for ACP model switching is the ``acp_model`` field on Settings → Agent, not this picker. Tests cover both: a new ``toAppConversation`` case asserts ``agent_kind === "acp"`` + ``llm_model === null`` for an ``{kind: "ACPAgent"}`` payload, and a new SwitchProfileButton case asserts the button hides for an ``agent_kind: "acp"`` conversation even when profiles are present. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(acp): bridge Settings → Secrets into the ACP subprocess env The bare ``payload.secrets`` channel lands in the agent-server's ``secret_registry`` server-side, which the OpenHands ``Agent`` reads directly — but ``ACPAgent._start_acp_server`` builds its subprocess env from ``agent_context.secrets``, not from the registry. Without a bridge, a Settings → Secrets entry like ``ANTHROPIC_API_KEY`` is silently invisible to the ACP CLI (Claude Code, Codex, Gemini), so users hit "authentication failed" with no on-screen hint that their configured secret never reached the subprocess. Mirror the same LookupSecret map onto ``payload.agent.agent_context.secrets`` when ``acpMode === true``, so the agent-server's existing env-injection loop picks them up. The bare ``payload.secrets`` channel is also kept (it serves other consumers + remains the canonical "conversation secrets" wire). The mirroring fires only when there's something to bridge; non-ACP payloads are unchanged. This is a shim. Once canvas pins to an agent-server build that includes software-agent-sdk PR #3299 (which teaches ACPAgent to also read from ``state.secret_registry``), the ``if (acpMode)`` branch can be deleted with no behaviour change. Tests: - New: ACP payload mirrors customSecrets onto agent_context.secrets - New: empty customSecrets does NOT synthesize an empty bridge map - New: non-ACP payload does NOT get an agent_context.secrets bridge - All 42 adapter tests pass Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(acp): hide MCP nav + cloud LLM-model fallback while ACP is active Two ACP-leak fixes the review surfaced: MCP page reachable + editable under ACP - The SDK's ``ACPAgent`` rejects ``mcp_config`` on init (acp_agent.py:845) and the canvas adapter already strips it from start payloads, but the /mcp route and the Extensions nav still let users add / edit / delete MCP servers — silent no-ops against the running subprocess. - Add a ``clientLoader`` on /mcp that bounces to /settings/agent when ``agent_kind === "acp"``. Grey out the MCP item in ExtensionsNavigation with the same explanatory tooltip the LLM / Condenser items already use under ACP. - Extract the redirect into ``utils/acp-route-guard.redirectIfAcpActive`` so /settings and /mcp share one cache-key + redirect-target definition. settings.tsx's clientLoader now calls into it. Cloud chat ``ChatInputModel`` falls back to ``settings.llm_model`` for ACP - ``toAppConversation`` writes ``llm_model: null`` on ACP conversations (commit 8f0efe62), but ChatInputModel did ``conversation?.llm_model ?? settings?.llm_model``, resurrecting the user's default OpenHands model on a Claude-Code conversation and linking to /settings (which is itself ACP-disabled). Gate on ``conversation?.agent_kind === "acp"`` and return null instead. Tests: - New: ExtensionsNavigation greys MCP under ACP, leaves Skills + non-ACP clickable - New: /mcp clientLoader redirects under ACP, returns null otherwise + on settings-fetch errors (no redirect-loop) - New: ChatInputModel returns null for ACP even when settings has a model - All 18 affected tests pass Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(acp): preserve unknown acp_server on no-op saves + reviewer cleanups Fourth-pass review (PR #416 review comment 4486154133). Triage: Fixed: - **Unknown ``acp_server`` demoted to ``"custom"`` on save** (P1, real data corruption). A user with ``acp_server`` set out-of-band to a provider canvas's registry doesn't carry yet (e.g. a future provider, or one removed from the local mirror) would open Settings → Agent and lose the original key on the next Save — ``detectPreset`` routes every unknown server to ``ACP_CUSTOM_PRESET_KEY``. Now we capture the loaded ``acp_server`` + textarea at load time, and on save — when both are unchanged and the loaded key is non-empty, non-``"custom"``, and absent from ``ACP_PROVIDERS`` — pass it back verbatim via a new ``allowUnknownServer`` opt on ``buildAcpAgentSettingsDiff``. Editing the command still demotes to ``"custom"`` (user is configuring a new thing, so the preset name follows the command). - **Dead ``...existingContext`` spread** in the ACP secret bridge. ``createAgentFromSettings`` never populates ``agent_context`` on the ACP branch, so the spread always merged into ``{}``. Direct assignment — and a comment explaining why a deep-merge would be the wrong direction (ACPAgent only treats ``secrets`` as acp_compatible). - **Misleading ``$VAR`` test comment**. Reworded to lead with the no-leak contract (host env values must not end up in the persisted ``acp_command``) rather than the implementation-detail tangent. Documented but not changed: - **``acp_args: []`` "data loss" concern** — false alarm. Load merges ``acp_command + acp_args`` into the textarea before render; save persists the merged tokens as ``acp_command`` with ``acp_args: []``. Round-trip is correct. Added an inline comment on the load merge so the next reviewer doesn't re-flag the reset. - **Silent preset migration without user feedback** — by design. The dropdown re-derives from the textarea so it always reflects what will be saved; adding a toast on every keystroke would be noise. Already documented as intentional on ``detectPreset``. Tracked elsewhere: - Supply-chain drift / npm verification: agent-canvas#587. - Gemini onboarding icon: agent-canvas#621. Tests: - New: ``preserves an unknown loaded acp_server when the user saves without editing`` - New: ``demotes an unknown loaded acp_server to 'custom' when the user edits the command`` - All 73 affected tests pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(acp): stop silently corrupting argv, restore AgentContext, fix home-screen gating Three real review findings, all wired: 1. ``parseCommand`` silently dropped URL tokens with ``?`` query strings (and any other shell-glob metacharacter). Reproducer: node acp.js --endpoint https://example.com/acp?tenant=abc ``shell-quote.parse`` read ``?tenant=abc`` as a glob pattern and emitted a non-string AST node; the ``.filter(string)`` then dropped the URL entirely, persisting ``["node","acp.js","--endpoint"]``. Replaced ``shell-quote.parse`` with a small custom argv tokenizer that handles single/double quotes + backslash escapes and treats every other character — ``?``, ``*``, ``$``, ``|``, ``>``, ``#``, ``&``, ``;``, ``(``, ``)``, backticks — as literal. The agent-server passes the argv straight to ``subprocess.create_subprocess_exec`` anyway (no shell intermediary), so the literal-only model matches what actually happens at spawn time. ``shell-quote.quote`` is still used by ``formatCommand`` for output. 2. The ACP path skipped the ``agent_context`` block that the OpenHands path seeded with ``load_public_skills`` / ``load_user_skills`` / optional ``system_message_suffix``. All three are marked ``acp_compatible: true`` on the SDK ``AgentContext`` model — the ACP CLI renders them via ``ACPAgent._render_suffix`` — so ACP conversations were silently shipping a smaller system prompt than OpenHands ones. ``createAgentFromSettings`` now seeds the same block on both branches. The secret bridge below merges into that block (was overwriting it) so ``{ secrets }`` no longer wipes the skill flags. 3. ``ChatInputModel`` and ``SwitchProfileButton`` only checked ``conversation?.agent_kind``. On the home screen (and during the task-startup window) ``conversation`` is undefined, so the per-conversation check missed and both surfaces fell back to ``settings.llm_model`` / the LLM-profile picker — even when ``settings.agent_settings.agent_kind === "acp"`` made it clear the next-created conversation would be ACP. Added a settings fallback so both controls hide consistently with the rest of the ACP nav gating. Tests: - parseCommand: new "preserves URLs with query strings" + "preserves URLs with multiple query params" + "preserves shell metacharacters as literal argv tokens" cases; the old "filters operator" cases flipped to "preserves operator as literal". 17 parseCommand cases pass. - adapter: assertion on the ACP payload's ``agent_context`` updated to expect the skill flags instead of ``undefined``. - chat-input-model + switch-profile-button: new "hides on the home page when ACP is the default agent" cases. - 83 tests pass across the 5 affected files. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(acp): two chat-rendering UX glitches on streaming ACP tool calls 1. Half-formed ACP tool-call cards flashed in the chat before the final state arrived. ACP servers stream multiple events per ``tool_call_id`` (status flips ``in_progress`` → ``completed`` / ``failed``); the intermediate events carry partial ``raw_input`` / ``raw_output`` / ``title``. The previous gate suppressed only ``in_progress`` and let ``null`` through (a "backwards compat" carve-out for older agent-server builds that no longer apply at our pinned version). Streaming intermediates often arrive without a status set yet, so they leaked. Tighten ``shouldRenderEvent`` to require ``status === "completed" || "failed"``. ``handleEventForUI`` already collapses by ``tool_call_id`` in place, so the terminal event lands at the original position once it arrives — no flash, no double-render. 2. "Reading Read /Users/foo/bar" — Claude Code emits titles like ``"Read /Users/foo/bar"`` for a read tool, and our i18n template ``"Reading <cmd>{{title}}</cmd>"`` then doubles up the verb. Add ``stripRedundantTitlePrefix`` keyed by ``tool_kind``: read → strip ``"Read"``, edit → strip ``"Edit"`` / ``"Write"``, execute → strip ``"Bash"`` / ``"Run"``, fetch → strip ``"Fetch"`` / ``"WebFetch"``. Boundary-checked via trailing whitespace so a token like ``"Reads-from"`` is left alone. English-only on purpose: ACP servers are anglophone and emit english titles regardless of the user's canvas locale; matching translated verbs would go stale the moment a new server is added. Titles already lacking a redundant prefix (the OpenHands ACP wrapper, future servers) round-trip verbatim — the strip is a no-op there. Tests: - ``shouldRenderEvent``: ``null`` status now flips to false + comment explains why (treated as in-flight, not legacy). - New ``stripRedundantTitlePrefix`` describe block covers the four tool kinds, the no-op case, the word-boundary guard, ``tool_kind: null`` (no strip), and empty titles. - 53 tests pass across the conversation-events helpers. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(acp): drop React Router type import on /mcp clientLoader (CI build) CI's ``build:lib`` failed with: src/routes/mcp.tsx(3,23): error TS6059: File '.../.react-router/types/ src/routes/+types/mcp.ts' is not under 'rootDir' '/src'. ``tsconfig.lib.json`` sets ``rootDir: "src"`` and pulls in ``src/components/**/*.tsx``. ``src/components/settings/index.ts`` re-exports from ``routes/mcp-settings``, which imports ``routes/mcp`` — so the lib's typecheck graph reaches ``routes/mcp.tsx`` and trips on the generated ``./+types/mcp`` import that lives under ``.react-router/types/``, outside the lib's rootDir. (``routes/ settings.tsx`` uses the same import pattern but isn't reachable from the lib graph, which is why local typecheck passed.) Drop the type import and declare the loader with no parameters — matches the existing ``index-redirect`` and ``mcp-settings-redirect`` loader pattern. Test calls collapsed to ``clientLoader()`` to match the new signature. ``npm run build:lib`` now passes locally; 248 tests pass across the affected suites. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(acp): tighten adapter comments around SDK refs Two reviewer-flagged comment fixes: - ``ACP_SETTINGS_KEYS`` docblock no longer claims there's a matching ``ACP_SETTINGS_KEYS`` constant in the Python SDK (there isn't; the fields are model attributes on ``ACPAgentSettings``). Reworded to "Keep aligned with the ``acp_*`` fields on ``ACPAgentSettings`` in ``openhands-sdk/openhands/sdk/settings/model.py``" with an explicit "no matching SDK constant — hand-maintained" note, and cross-linked to the existing #587 drift tracker. - ``createAgentFromSettings`` now spells out where the ``acp_compatible`` markers live on each of the three fields we set (``system_message_suffix`` L66, ``load_user_skills`` L80, ``load_public_skills`` L89 in ``openhands-sdk/openhands/sdk/context/agent_context.py``) plus what happens when a future SDK bump drops one (422 at conversation start → drop the demoted field, don't wrap a workaround). Line refs are brittle by design — they're the tripwire that surfaces a regression here rather than in production. No behaviour change; lint + 42 adapter tests pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Debug Agent <debug@example.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |