@openhands/agent-canvas 1.0.0-alpha.8 → 1.0.0-beta.1

package/dist/api/agent-server-compatibility.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"agent-server-compatibility.cjs","names":[],"sources":["../../src/api/agent-server-compatibility.ts"],"sourcesContent":["import { ServerClient } from \"@openhands/typescript-client/clients\";\nimport type { ServerInfo as BaseServerInfo } from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"#/api/agent-server-client-options\";\nimport { getEffectiveLocalBackend } from \"#/api/backend-registry/active-store\";\n\nconst AGENT_SERVER_INFO_TIMEOUT_MS = 5000;\n\nexport interface AgentServerInfo extends BaseServerInfo {\n  usable_tools?: string[] | null;\n}\n\nlet cachedAgentServerInfo: AgentServerInfo | null = null;\n\nconst getAdvertisedTools = (serverInfo: AgentServerInfo | null) => {\n  if (Array.isArray(serverInfo?.usable_tools)) {\n    return serverInfo.usable_tools;\n  }\n  return null;\n};\n\nexport class AgentServerUnavailableError extends Error {\n  readonly details: string | null;\n\n  constructor(details?: string | null) {\n    super(\n      \"Agent server not found. Could not connect to the configured agent server. Start a compatible agent server and reload the page.\",\n    );\n    this.name = \"AgentServerUnavailableError\";\n    this.details = details ?? null;\n  }\n}\n\nexport const isAgentServerUnavailableError = (\n  error: unknown,\n): error is AgentServerUnavailableError =>\n  error instanceof AgentServerUnavailableError ||\n  (typeof error === \"object\" &&\n    error !== null &&\n    \"name\" in error &&\n    error.name === \"AgentServerUnavailableError\");\n\nexport function clearCachedAgentServerInfo() {\n  cachedAgentServerInfo = null;\n}\n\nexport function isAgentServerToolAvailable(toolName: string) {\n  const availableTools = getAdvertisedTools(cachedAgentServerInfo);\n  if (!Array.isArray(availableTools)) {\n    return true;\n  }\n  return availableTools.includes(toolName);\n}\n\nfunction isSdkHttpError(error: unknown) {\n  return (\n    error instanceof Error &&\n    error.name === \"HttpError\" &&\n    \"status\" in error &&\n    typeof error.status === \"number\"\n  );\n}\n\nexport async function loadAgentServerInfo() {\n  // The probe is a *local* agent-server concern — it verifies the runtime\n  // hosting the GUI is reachable. It must NEVER run against the active\n  // backend when that backend is cloud, because cloud hosts don't\n  // expose /api/server_info and would fail with a CORS error besides.\n  const local = getEffectiveLocalBackend();\n  let serverInfo: AgentServerInfo;\n\n  try {\n    serverInfo = (await new ServerClient(\n      getAgentServerClientOptions({\n        host: local.host,\n        sessionApiKey: local.apiKey || null,\n        timeout: AGENT_SERVER_INFO_TIMEOUT_MS,\n      }),\n    ).getServerInfo()) as AgentServerInfo;\n  } catch (error) {\n    clearCachedAgentServerInfo();\n    if (isSdkHttpError(error)) {\n      throw error;\n    }\n\n    const details = error instanceof Error ? error.message : null;\n    throw new AgentServerUnavailableError(details);\n  }\n\n  cachedAgentServerInfo = serverInfo;\n  return serverInfo;\n}\n"],"mappings":"2OAKA,IAAM,EAA+B,IAMjC,EAAgD,KAE9C,EAAsB,GACtB,MAAM,QAAQ,GAAY,aAAa,CAClC,EAAW,aAEb,KAGI,EAAb,cAAiD,KAAM,CACrD,QAEA,YAAY,EAAyB,CACnC,MACE,iIACD,CACD,KAAK,KAAO,8BACZ,KAAK,QAAU,GAAW,OAIjB,EACX,GAEA,aAAiB,GAChB,OAAO,GAAU,YAChB,GACA,SAAU,GACV,EAAM,OAAS,8BAEnB,SAAgB,GAA6B,CAC3C,EAAwB,KAG1B,SAAgB,EAA2B,EAAkB,CAC3D,IAAM,EAAiB,EAAmB,EAAsB,CAIhE,OAHK,MAAM,QAAQ,EAAe,CAG3B,EAAe,SAAS,EAAS,CAF/B,GAKX,SAAS,EAAe,EAAgB,CACtC,OACE,aAAiB,OACjB,EAAM,OAAS,aACf,WAAY,GACZ,OAAO,EAAM,QAAW,SAI5B,eAAsB,GAAsB,CAK1C,IAAM,EAAQ,EAAA,0BAA0B,CACpC,EAEJ,GAAI,CACF,EAAc,MAAM,IAAI,EAAA,aACtB,EAAA,4BAA4B,CAC1B,KAAM,EAAM,KACZ,cAAe,EAAM,QAAU,KAC/B,QAAS,EACV,CAAC,CACH,CAAC,eAAe,OACV,EAAO,CAOd,MANA,GAA4B,CACxB,EAAe,EAAM,CACjB,EAIF,IAAI,EADM,aAAiB,MAAQ,EAAM,QAAU,KACX,CAIhD,MADA,GAAwB,EACjB"}
+{"version":3,"file":"agent-server-compatibility.cjs","names":[],"sources":["../../src/api/agent-server-compatibility.ts"],"sourcesContent":["import {\n  ServerClient,\n  SettingsClient,\n} from \"@openhands/typescript-client/clients\";\nimport type { ServerInfo as BaseServerInfo } from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"#/api/agent-server-client-options\";\nimport { isAuthRequired } from \"#/api/agent-server-config\";\nimport { getEffectiveLocalBackend } from \"#/api/backend-registry/active-store\";\n\nconst AGENT_SERVER_INFO_TIMEOUT_MS = 5000;\n\nexport interface AgentServerInfo extends BaseServerInfo {\n  usable_tools?: string[] | null;\n}\n\nlet cachedAgentServerInfo: AgentServerInfo | null = null;\n\nconst getAdvertisedTools = (serverInfo: AgentServerInfo | null) => {\n  if (Array.isArray(serverInfo?.usable_tools)) {\n    return serverInfo.usable_tools;\n  }\n  return null;\n};\n\nexport class AgentServerUnavailableError extends Error {\n  readonly details: string | null;\n\n  constructor(details?: string | null) {\n    super(\n      \"Agent server not found. Could not connect to the configured agent server. Start a compatible agent server and reload the page.\",\n    );\n    this.name = \"AgentServerUnavailableError\";\n    this.details = details ?? null;\n  }\n}\n\nexport const isAgentServerUnavailableError = (\n  error: unknown,\n): error is AgentServerUnavailableError =>\n  error instanceof AgentServerUnavailableError ||\n  (typeof error === \"object\" &&\n    error !== null &&\n    \"name\" in error &&\n    error.name === \"AgentServerUnavailableError\");\n\n/**\n * Returns true when the agent-server probe failed with HTTP 401.\n * In public mode this means the stored key is stale (server restarted\n * with a different `LOCAL_BACKEND_API_KEY`). Only meaningful when\n * auth is required — a 401 in local mode is a misconfiguration, not a\n * key-rotation event. Uses {@link isAuthRequired} so both the build-time\n * `VITE_AUTH_REQUIRED` flag and the runtime `window.__AGENT_CANVAS_AUTH_REQUIRED__`\n * injection (used by pre-built static binaries) are honoured.\n */\nexport const isAgentServerAuthError = (error: unknown): boolean =>\n  isAuthRequired() && isSdkHttpStatusError(error, 401);\n\nexport function clearCachedAgentServerInfo() {\n  cachedAgentServerInfo = null;\n}\n\nexport function isAgentServerToolAvailable(toolName: string) {\n  const availableTools = getAdvertisedTools(cachedAgentServerInfo);\n  if (!Array.isArray(availableTools)) {\n    return true;\n  }\n  return availableTools.includes(toolName);\n}\n\nexport function isSdkHttpError(error: unknown) {\n  return (\n    error instanceof Error &&\n    error.name === \"HttpError\" &&\n    \"status\" in error &&\n    typeof error.status === \"number\"\n  );\n}\n\n/**\n * Narrows an SDK HTTP error to a specific status code.\n * Use instead of manually casting `(err as { status: number }).status`.\n */\nexport function isSdkHttpStatusError(error: unknown, status: number): boolean {\n  return (\n    isSdkHttpError(error) && (error as { status: number }).status === status\n  );\n}\n\nexport async function loadAgentServerInfo() {\n  // The probe is a *local* agent-server concern — it verifies the runtime\n  // hosting the GUI is reachable. It must NEVER run against the active\n  // backend when that backend is cloud, because cloud hosts don't\n  // expose /api/server_info and would fail with a CORS error besides.\n  const local = getEffectiveLocalBackend();\n  const clientOptions = getAgentServerClientOptions({\n    host: local.host,\n    sessionApiKey: local.apiKey || null,\n    timeout: AGENT_SERVER_INFO_TIMEOUT_MS,\n  });\n  let serverInfo: AgentServerInfo;\n\n  try {\n    serverInfo = (await new ServerClient(\n      clientOptions,\n    ).getServerInfo()) as AgentServerInfo;\n  } catch (error) {\n    clearCachedAgentServerInfo();\n    if (isSdkHttpError(error)) {\n      throw error;\n    }\n\n    const details = error instanceof Error ? error.message : null;\n    throw new AgentServerUnavailableError(details);\n  }\n\n  // /server_info is unprotected, so a stale session key still gets 200.\n  // In public mode, validate the key against a protected endpoint so a\n  // server restart with a new LOCAL_BACKEND_API_KEY surfaces immediately\n  // instead of letting the app load and fail on every subsequent call.\n  if (isAuthRequired()) {\n    try {\n      await new SettingsClient(clientOptions).getSettings();\n    } catch (error) {\n      // Only rethrow 401 — that means the stored key is invalid /\n      // rotated.  Other HTTP errors (403, 5xx) and non-HTTP errors\n      // (network, timeout) are swallowed: the server *is* up (we just\n      // reached /server_info), so let the app proceed with an\n      // unvalidated key rather than blocking the UI.\n      // NOTE: If the connection drops between the /server_info and\n      // getSettings() probes, the app loads with an unvalidated key and\n      // subsequent 401s won't trigger the auth screen (they come from\n      // React Query hooks, not this bootstrap path). Acceptable for now\n      // since the window is narrow and a page refresh recovers.\n      if (isSdkHttpStatusError(error, 401)) {\n        throw error;\n      }\n\n      console.warn(\n        \"[agent-server] getSettings() probe failed (non-401):\",\n        error,\n      );\n    }\n  }\n\n  cachedAgentServerInfo = serverInfo;\n  return serverInfo;\n}\n"],"mappings":"4WASA,IAAM,EAA+B,IAMjC,EAAgD,KAE9C,EAAsB,GACtB,MAAM,QAAQ,GAAY,aAAa,CAClC,EAAW,aAEb,KAGI,EAAb,cAAiD,KAAM,CACrD,QAEA,YAAY,EAAyB,CACnC,MACE,iIACD,CACD,KAAK,KAAO,8BACZ,KAAK,QAAU,GAAW,OAIjB,EACX,GAEA,aAAiB,GAChB,OAAO,GAAU,YAChB,GACA,SAAU,GACV,EAAM,OAAS,8BAWN,EAA0B,GACrC,EAAA,gBAAgB,EAAI,EAAqB,EAAO,IAAI,CAEtD,SAAgB,GAA6B,CAC3C,EAAwB,KAG1B,SAAgB,EAA2B,EAAkB,CAC3D,IAAM,EAAiB,EAAmB,EAAsB,CAIhE,OAHK,MAAM,QAAQ,EAAe,CAG3B,EAAe,SAAS,EAAS,CAF/B,GAKX,SAAgB,EAAe,EAAgB,CAC7C,OACE,aAAiB,OACjB,EAAM,OAAS,aACf,WAAY,GACZ,OAAO,EAAM,QAAW,SAQ5B,SAAgB,EAAqB,EAAgB,EAAyB,CAC5E,OACE,EAAe,EAAM,EAAK,EAA6B,SAAW,EAItE,eAAsB,GAAsB,CAK1C,IAAM,EAAQ,EAAA,0BAA0B,CAClC,EAAgB,EAAA,4BAA4B,CAChD,KAAM,EAAM,KACZ,cAAe,EAAM,QAAU,KAC/B,QAAS,EACV,CAAC,CACE,EAEJ,GAAI,CACF,EAAc,MAAM,IAAI,EAAA,aACtB,EACD,CAAC,eAAe,OACV,EAAO,CAOd,MANA,GAA4B,CACxB,EAAe,EAAM,CACjB,EAIF,IAAI,EADM,aAAiB,MAAQ,EAAM,QAAU,KACX,CAOhD,GAAI,EAAA,gBAAgB,CAClB,GAAI,CACF,MAAM,IAAI,EAAA,eAAe,EAAc,CAAC,aAAa,OAC9C,EAAO,CAWd,GAAI,EAAqB,EAAO,IAAI,CAClC,MAAM,EAGR,QAAQ,KACN,uDACA,EACD,CAKL,MADA,GAAwB,EACjB"}

package/dist/api/agent-server-compatibility.d.ts

@@ -7,6 +7,22 @@ export declare class AgentServerUnavailableError extends Error {
     constructor(details?: string | null);
 }
 export declare const isAgentServerUnavailableError: (error: unknown) => error is AgentServerUnavailableError;
+/**
+ * Returns true when the agent-server probe failed with HTTP 401.
+ * In public mode this means the stored key is stale (server restarted
+ * with a different `LOCAL_BACKEND_API_KEY`). Only meaningful when
+ * auth is required — a 401 in local mode is a misconfiguration, not a
+ * key-rotation event. Uses {@link isAuthRequired} so both the build-time
+ * `VITE_AUTH_REQUIRED` flag and the runtime `window.__AGENT_CANVAS_AUTH_REQUIRED__`
+ * injection (used by pre-built static binaries) are honoured.
+ */
+export declare const isAgentServerAuthError: (error: unknown) => boolean;
 export declare function clearCachedAgentServerInfo(): void;
 export declare function isAgentServerToolAvailable(toolName: string): boolean;
+export declare function isSdkHttpError(error: unknown): boolean;
+/**
+ * Narrows an SDK HTTP error to a specific status code.
+ * Use instead of manually casting `(err as { status: number }).status`.
+ */
+export declare function isSdkHttpStatusError(error: unknown, status: number): boolean;
 export declare function loadAgentServerInfo(): Promise<AgentServerInfo>;

package/dist/api/agent-server-compatibility.js

@@ -1,37 +1,48 @@
-import { getEffectiveLocalBackend as e } from "./backend-registry/active-store.js";
-import { ServerClient as t } from "../node_modules/@openhands/typescript-client/dist/client/server-client.js";
-import { getAgentServerClientOptions as n } from "./agent-server-client-options.js";
+import { isAuthRequired as e } from "./agent-server-config.js";
+import { getEffectiveLocalBackend as t } from "./backend-registry/active-store.js";
+import { ServerClient as n } from "../node_modules/@openhands/typescript-client/dist/client/server-client.js";
+import { SettingsClient as r } from "../node_modules/@openhands/typescript-client/dist/client/settings-client.js";
+import { getAgentServerClientOptions as i } from "./agent-server-client-options.js";
 //#region src/api/agent-server-compatibility.ts
-var r = 5e3, i = null, a = (e) => Array.isArray(e?.usable_tools) ? e.usable_tools : null, o = class extends Error {
+var a = 5e3, o = null, s = (e) => Array.isArray(e?.usable_tools) ? e.usable_tools : null, c = class extends Error {
 	details;
 	constructor(e) {
 		super("Agent server not found. Could not connect to the configured agent server. Start a compatible agent server and reload the page."), this.name = "AgentServerUnavailableError", this.details = e ?? null;
 	}
-}, s = (e) => e instanceof o || typeof e == "object" && !!e && "name" in e && e.name === "AgentServerUnavailableError";
-function c() {
-	i = null;
+}, l = (e) => e instanceof c || typeof e == "object" && !!e && "name" in e && e.name === "AgentServerUnavailableError", u = (t) => e() && m(t, 401);
+function d() {
+	o = null;
 }
-function l(e) {
-	let t = a(i);
+function f(e) {
+	let t = s(o);
 	return Array.isArray(t) ? t.includes(e) : !0;
 }
-function u(e) {
+function p(e) {
 	return e instanceof Error && e.name === "HttpError" && "status" in e && typeof e.status == "number";
 }
-async function d() {
-	let a = e(), s;
+function m(e, t) {
+	return p(e) && e.status === t;
+}
+async function h() {
+	let s = t(), l = i({
+		host: s.host,
+		sessionApiKey: s.apiKey || null,
+		timeout: a
+	}), u;
 	try {
-		s = await new t(n({
-			host: a.host,
-			sessionApiKey: a.apiKey || null,
-			timeout: r
-		})).getServerInfo();
+		u = await new n(l).getServerInfo();
+	} catch (e) {
+		throw d(), p(e) ? e : new c(e instanceof Error ? e.message : null);
+	}
+	if (e()) try {
+		await new r(l).getSettings();
 	} catch (e) {
-		throw c(), u(e) ? e : new o(e instanceof Error ? e.message : null);
+		if (m(e, 401)) throw e;
+		console.warn("[agent-server] getSettings() probe failed (non-401):", e);
 	}
-	return i = s, s;
+	return o = u, u;
 }
 //#endregion
-export { l as isAgentServerToolAvailable, s as isAgentServerUnavailableError, d as loadAgentServerInfo };
+export { u as isAgentServerAuthError, f as isAgentServerToolAvailable, l as isAgentServerUnavailableError, h as loadAgentServerInfo };
 
 //# sourceMappingURL=agent-server-compatibility.js.map

package/dist/api/agent-server-compatibility.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-server-compatibility.js","names":[],"sources":["../../src/api/agent-server-compatibility.ts"],"sourcesContent":["import { ServerClient } from \"@openhands/typescript-client/clients\";\nimport type { ServerInfo as BaseServerInfo } from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"#/api/agent-server-client-options\";\nimport { getEffectiveLocalBackend } from \"#/api/backend-registry/active-store\";\n\nconst AGENT_SERVER_INFO_TIMEOUT_MS = 5000;\n\nexport interface AgentServerInfo extends BaseServerInfo {\n  usable_tools?: string[] | null;\n}\n\nlet cachedAgentServerInfo: AgentServerInfo | null = null;\n\nconst getAdvertisedTools = (serverInfo: AgentServerInfo | null) => {\n  if (Array.isArray(serverInfo?.usable_tools)) {\n    return serverInfo.usable_tools;\n  }\n  return null;\n};\n\nexport class AgentServerUnavailableError extends Error {\n  readonly details: string | null;\n\n  constructor(details?: string | null) {\n    super(\n      \"Agent server not found. Could not connect to the configured agent server. Start a compatible agent server and reload the page.\",\n    );\n    this.name = \"AgentServerUnavailableError\";\n    this.details = details ?? null;\n  }\n}\n\nexport const isAgentServerUnavailableError = (\n  error: unknown,\n): error is AgentServerUnavailableError =>\n  error instanceof AgentServerUnavailableError ||\n  (typeof error === \"object\" &&\n    error !== null &&\n    \"name\" in error &&\n    error.name === \"AgentServerUnavailableError\");\n\nexport function clearCachedAgentServerInfo() {\n  cachedAgentServerInfo = null;\n}\n\nexport function isAgentServerToolAvailable(toolName: string) {\n  const availableTools = getAdvertisedTools(cachedAgentServerInfo);\n  if (!Array.isArray(availableTools)) {\n    return true;\n  }\n  return availableTools.includes(toolName);\n}\n\nfunction isSdkHttpError(error: unknown) {\n  return (\n    error instanceof Error &&\n    error.name === \"HttpError\" &&\n    \"status\" in error &&\n    typeof error.status === \"number\"\n  );\n}\n\nexport async function loadAgentServerInfo() {\n  // The probe is a *local* agent-server concern — it verifies the runtime\n  // hosting the GUI is reachable. It must NEVER run against the active\n  // backend when that backend is cloud, because cloud hosts don't\n  // expose /api/server_info and would fail with a CORS error besides.\n  const local = getEffectiveLocalBackend();\n  let serverInfo: AgentServerInfo;\n\n  try {\n    serverInfo = (await new ServerClient(\n      getAgentServerClientOptions({\n        host: local.host,\n        sessionApiKey: local.apiKey || null,\n        timeout: AGENT_SERVER_INFO_TIMEOUT_MS,\n      }),\n    ).getServerInfo()) as AgentServerInfo;\n  } catch (error) {\n    clearCachedAgentServerInfo();\n    if (isSdkHttpError(error)) {\n      throw error;\n    }\n\n    const details = error instanceof Error ? error.message : null;\n    throw new AgentServerUnavailableError(details);\n  }\n\n  cachedAgentServerInfo = serverInfo;\n  return serverInfo;\n}\n"],"mappings":";;;;AAKA,IAAM,IAA+B,KAMjC,IAAgD,MAE9C,KAAsB,MACtB,MAAM,QAAQ,GAAY,aAAa,GAClC,EAAW,eAEb,MAGI,IAAb,cAAiD,MAAM;CACrD;CAEA,YAAY,GAAyB;AAKnC,EAJA,MACE,iIACD,EACD,KAAK,OAAO,+BACZ,KAAK,UAAU,KAAW;;GAIjB,KACX,MAEA,aAAiB,KAChB,OAAO,KAAU,cAChB,KACA,UAAU,KACV,EAAM,SAAS;AAEnB,SAAgB,IAA6B;AAC3C,KAAwB;;AAG1B,SAAgB,EAA2B,GAAkB;CAC3D,IAAM,IAAiB,EAAmB,EAAsB;AAIhE,QAHK,MAAM,QAAQ,EAAe,GAG3B,EAAe,SAAS,EAAS,GAF/B;;AAKX,SAAS,EAAe,GAAgB;AACtC,QACE,aAAiB,SACjB,EAAM,SAAS,eACf,YAAY,KACZ,OAAO,EAAM,UAAW;;AAI5B,eAAsB,IAAsB;CAK1C,IAAM,IAAQ,GAA0B,EACpC;AAEJ,KAAI;AACF,MAAc,MAAM,IAAI,EACtB,EAA4B;GAC1B,MAAM,EAAM;GACZ,eAAe,EAAM,UAAU;GAC/B,SAAS;GACV,CAAC,CACH,CAAC,eAAe;UACV,GAAO;AAOd,QANA,GAA4B,EACxB,EAAe,EAAM,GACjB,IAIF,IAAI,EADM,aAAiB,QAAQ,EAAM,UAAU,KACX;;AAIhD,QADA,IAAwB,GACjB"}
+{"version":3,"file":"agent-server-compatibility.js","names":[],"sources":["../../src/api/agent-server-compatibility.ts"],"sourcesContent":["import {\n  ServerClient,\n  SettingsClient,\n} from \"@openhands/typescript-client/clients\";\nimport type { ServerInfo as BaseServerInfo } from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"#/api/agent-server-client-options\";\nimport { isAuthRequired } from \"#/api/agent-server-config\";\nimport { getEffectiveLocalBackend } from \"#/api/backend-registry/active-store\";\n\nconst AGENT_SERVER_INFO_TIMEOUT_MS = 5000;\n\nexport interface AgentServerInfo extends BaseServerInfo {\n  usable_tools?: string[] | null;\n}\n\nlet cachedAgentServerInfo: AgentServerInfo | null = null;\n\nconst getAdvertisedTools = (serverInfo: AgentServerInfo | null) => {\n  if (Array.isArray(serverInfo?.usable_tools)) {\n    return serverInfo.usable_tools;\n  }\n  return null;\n};\n\nexport class AgentServerUnavailableError extends Error {\n  readonly details: string | null;\n\n  constructor(details?: string | null) {\n    super(\n      \"Agent server not found. Could not connect to the configured agent server. Start a compatible agent server and reload the page.\",\n    );\n    this.name = \"AgentServerUnavailableError\";\n    this.details = details ?? null;\n  }\n}\n\nexport const isAgentServerUnavailableError = (\n  error: unknown,\n): error is AgentServerUnavailableError =>\n  error instanceof AgentServerUnavailableError ||\n  (typeof error === \"object\" &&\n    error !== null &&\n    \"name\" in error &&\n    error.name === \"AgentServerUnavailableError\");\n\n/**\n * Returns true when the agent-server probe failed with HTTP 401.\n * In public mode this means the stored key is stale (server restarted\n * with a different `LOCAL_BACKEND_API_KEY`). Only meaningful when\n * auth is required — a 401 in local mode is a misconfiguration, not a\n * key-rotation event. Uses {@link isAuthRequired} so both the build-time\n * `VITE_AUTH_REQUIRED` flag and the runtime `window.__AGENT_CANVAS_AUTH_REQUIRED__`\n * injection (used by pre-built static binaries) are honoured.\n */\nexport const isAgentServerAuthError = (error: unknown): boolean =>\n  isAuthRequired() && isSdkHttpStatusError(error, 401);\n\nexport function clearCachedAgentServerInfo() {\n  cachedAgentServerInfo = null;\n}\n\nexport function isAgentServerToolAvailable(toolName: string) {\n  const availableTools = getAdvertisedTools(cachedAgentServerInfo);\n  if (!Array.isArray(availableTools)) {\n    return true;\n  }\n  return availableTools.includes(toolName);\n}\n\nexport function isSdkHttpError(error: unknown) {\n  return (\n    error instanceof Error &&\n    error.name === \"HttpError\" &&\n    \"status\" in error &&\n    typeof error.status === \"number\"\n  );\n}\n\n/**\n * Narrows an SDK HTTP error to a specific status code.\n * Use instead of manually casting `(err as { status: number }).status`.\n */\nexport function isSdkHttpStatusError(error: unknown, status: number): boolean {\n  return (\n    isSdkHttpError(error) && (error as { status: number }).status === status\n  );\n}\n\nexport async function loadAgentServerInfo() {\n  // The probe is a *local* agent-server concern — it verifies the runtime\n  // hosting the GUI is reachable. It must NEVER run against the active\n  // backend when that backend is cloud, because cloud hosts don't\n  // expose /api/server_info and would fail with a CORS error besides.\n  const local = getEffectiveLocalBackend();\n  const clientOptions = getAgentServerClientOptions({\n    host: local.host,\n    sessionApiKey: local.apiKey || null,\n    timeout: AGENT_SERVER_INFO_TIMEOUT_MS,\n  });\n  let serverInfo: AgentServerInfo;\n\n  try {\n    serverInfo = (await new ServerClient(\n      clientOptions,\n    ).getServerInfo()) as AgentServerInfo;\n  } catch (error) {\n    clearCachedAgentServerInfo();\n    if (isSdkHttpError(error)) {\n      throw error;\n    }\n\n    const details = error instanceof Error ? error.message : null;\n    throw new AgentServerUnavailableError(details);\n  }\n\n  // /server_info is unprotected, so a stale session key still gets 200.\n  // In public mode, validate the key against a protected endpoint so a\n  // server restart with a new LOCAL_BACKEND_API_KEY surfaces immediately\n  // instead of letting the app load and fail on every subsequent call.\n  if (isAuthRequired()) {\n    try {\n      await new SettingsClient(clientOptions).getSettings();\n    } catch (error) {\n      // Only rethrow 401 — that means the stored key is invalid /\n      // rotated.  Other HTTP errors (403, 5xx) and non-HTTP errors\n      // (network, timeout) are swallowed: the server *is* up (we just\n      // reached /server_info), so let the app proceed with an\n      // unvalidated key rather than blocking the UI.\n      // NOTE: If the connection drops between the /server_info and\n      // getSettings() probes, the app loads with an unvalidated key and\n      // subsequent 401s won't trigger the auth screen (they come from\n      // React Query hooks, not this bootstrap path). Acceptable for now\n      // since the window is narrow and a page refresh recovers.\n      if (isSdkHttpStatusError(error, 401)) {\n        throw error;\n      }\n\n      console.warn(\n        \"[agent-server] getSettings() probe failed (non-401):\",\n        error,\n      );\n    }\n  }\n\n  cachedAgentServerInfo = serverInfo;\n  return serverInfo;\n}\n"],"mappings":";;;;;;AASA,IAAM,IAA+B,KAMjC,IAAgD,MAE9C,KAAsB,MACtB,MAAM,QAAQ,GAAY,aAAa,GAClC,EAAW,eAEb,MAGI,IAAb,cAAiD,MAAM;CACrD;CAEA,YAAY,GAAyB;AAKnC,EAJA,MACE,iIACD,EACD,KAAK,OAAO,+BACZ,KAAK,UAAU,KAAW;;GAIjB,KACX,MAEA,aAAiB,KAChB,OAAO,KAAU,cAChB,KACA,UAAU,KACV,EAAM,SAAS,+BAWN,KAA0B,MACrC,GAAgB,IAAI,EAAqB,GAAO,IAAI;AAEtD,SAAgB,IAA6B;AAC3C,KAAwB;;AAG1B,SAAgB,EAA2B,GAAkB;CAC3D,IAAM,IAAiB,EAAmB,EAAsB;AAIhE,QAHK,MAAM,QAAQ,EAAe,GAG3B,EAAe,SAAS,EAAS,GAF/B;;AAKX,SAAgB,EAAe,GAAgB;AAC7C,QACE,aAAiB,SACjB,EAAM,SAAS,eACf,YAAY,KACZ,OAAO,EAAM,UAAW;;AAQ5B,SAAgB,EAAqB,GAAgB,GAAyB;AAC5E,QACE,EAAe,EAAM,IAAK,EAA6B,WAAW;;AAItE,eAAsB,IAAsB;CAK1C,IAAM,IAAQ,GAA0B,EAClC,IAAgB,EAA4B;EAChD,MAAM,EAAM;EACZ,eAAe,EAAM,UAAU;EAC/B,SAAS;EACV,CAAC,EACE;AAEJ,KAAI;AACF,MAAc,MAAM,IAAI,EACtB,EACD,CAAC,eAAe;UACV,GAAO;AAOd,QANA,GAA4B,EACxB,EAAe,EAAM,GACjB,IAIF,IAAI,EADM,aAAiB,QAAQ,EAAM,UAAU,KACX;;AAOhD,KAAI,GAAgB,CAClB,KAAI;AACF,QAAM,IAAI,EAAe,EAAc,CAAC,aAAa;UAC9C,GAAO;AAWd,MAAI,EAAqB,GAAO,IAAI,CAClC,OAAM;AAGR,UAAQ,KACN,wDACA,EACD;;AAKL,QADA,IAAwB,GACjB"}

package/dist/api/agent-server-config.cjs

@@ -1,2 +1,2 @@
-require(`../_virtual/_rolldown/runtime.cjs`);var e=`openhands-agent-server-config`,t=`workspace/project`;function n(){if(typeof window>`u`)return{};try{let t=window.localStorage.getItem(e);return t?JSON.parse(t)??{}:{}}catch{return{}}}function r(e){return e?.trim()||null}function i(e){if(!e)return null;let t=e.trim().replace(/\/$/,``);return t?/^https?:\/\//i.test(t)?t:typeof window<`u`?`${window.location.protocol}//${t}`:`http://${t}`:null}function a(){return i(n().baseUrl)||i(void 0)}function o(){return r(n().sessionApiKey)||r(void 0)}function s(e){if(typeof window>`u`)return!1;try{let t=new URL(e),n=new Set([`127.0.0.1`,`localhost`,`0.0.0.0`]),r=window.location.hostname;return n.has(t.hostname)&&!n.has(r)}catch{return!1}}function c(e){return e?s(e)?window.location.origin:e:null}function l(){return c(a())||(typeof window<`u`?window.location.origin:`http://127.0.0.1:8000`)}function u(){return o()}function d(){return(void 0)?.trim()||n().workingDir?.trim()||t}function f(e){return`${d().replace(/\/+$/,``)}/${e.replace(/-/g,``)}`}function p(){let e=u();return e?{"X-Session-API-Key":e}:{}}function m(){return!0}exports.DEFAULT_WORKING_DIR=t,exports.buildConversationWorkingDir=f,exports.getAgentServerBaseUrl=l,exports.getAgentServerHeaders=p,exports.getAgentServerSessionApiKey=u,exports.getAgentServerWorkingDir=d,exports.shouldLoadPublicSkills=m;
+require(`../_virtual/_rolldown/runtime.cjs`);var e=`openhands-agent-server-config`,t=`workspace/project`;function n(){if(typeof window>`u`)return{};try{let t=window.localStorage.getItem(e);return t?JSON.parse(t)??{}:{}}catch{return{}}}function r(t){if(typeof window>`u`)return;let n=Object.fromEntries(Object.entries(t).flatMap(([e,t])=>{if(typeof t!=`string`)return[];let n=t.trim();return n?[[e,n]]:[]}));if(Object.keys(n).length===0){window.localStorage.removeItem(e);return}window.localStorage.setItem(e,JSON.stringify(n))}function i(e){return e?.trim()||null}function a(e){if(!e)return null;let t=e.trim().replace(/\/$/,``);return t?/^https?:\/\//i.test(t)?t:typeof window<`u`?`${window.location.protocol}//${t}`:`http://${t}`:null}function o(){return a(n().baseUrl)||a(void 0)}function s(){return i(void 0)}function c(){return i(n().sessionApiKey)||s()}function l(){let e=s();if(!e)return;let t=n(),a=i(t.sessionApiKey);a&&a!==e&&r({...t,sessionApiKey:e})}function u(e){if(typeof window>`u`)return!1;try{let t=new URL(e),n=new Set([`127.0.0.1`,`localhost`,`0.0.0.0`]),r=window.location.hostname;return n.has(t.hostname)&&(!n.has(r)||t.hostname!==r)}catch{return!1}}function d(e){return e?u(e)?window.location.origin:e:null}function f(){return d(o())||(typeof window<`u`?window.location.origin:`http://127.0.0.1:8000`)}function p(){return c()}function m(){return(void 0)?.trim()||n().workingDir?.trim()||t}function h(e){return`${m().replace(/\/+$/,``)}/${e.replace(/-/g,``)}`}function g(){let e=p();return e?{"X-Session-API-Key":e}:{}}function _(){return!0}function v(){return typeof window<`u`&&window.__AGENT_CANVAS_AUTH_REQUIRED__===!0}exports.DEFAULT_WORKING_DIR=t,exports.buildConversationWorkingDir=h,exports.getAgentServerBaseUrl=f,exports.getAgentServerHeaders=g,exports.getAgentServerSessionApiKey=p,exports.getAgentServerWorkingDir=m,exports.isAuthRequired=v,exports.shouldLoadPublicSkills=_,exports.syncBakedSessionApiKey=l;
 //# sourceMappingURL=agent-server-config.cjs.map

package/dist/api/agent-server-config.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"agent-server-config.cjs","names":[],"sources":["../../src/api/agent-server-config.ts"],"sourcesContent":["export const AGENT_SERVER_CONFIG_STORAGE_KEY = \"openhands-agent-server-config\";\nexport const DEFAULT_WORKING_DIR = \"workspace/project\";\n\ninterface StoredAgentServerConfig {\n  baseUrl?: string | null;\n  sessionApiKey?: string | null;\n  workingDir?: string | null;\n}\n\nexport interface AgentServerFormDefaults {\n  baseUrl: string;\n  sessionApiKey: string;\n}\n\nfunction readStoredConfig(): StoredAgentServerConfig {\n  if (typeof window === \"undefined\") return {};\n\n  try {\n    const raw = window.localStorage.getItem(AGENT_SERVER_CONFIG_STORAGE_KEY);\n    if (!raw) return {};\n    const parsed = JSON.parse(raw) as StoredAgentServerConfig;\n    return parsed ?? {};\n  } catch {\n    return {};\n  }\n}\n\nfunction writeStoredConfig(config: StoredAgentServerConfig): void {\n  if (typeof window === \"undefined\") return;\n\n  const nextConfig = Object.fromEntries(\n    Object.entries(config).flatMap(([key, value]) => {\n      if (typeof value !== \"string\") return [];\n\n      const trimmed = value.trim();\n      if (!trimmed) return [];\n\n      return [[key, trimmed]];\n    }),\n  ) as StoredAgentServerConfig;\n\n  if (Object.keys(nextConfig).length === 0) {\n    window.localStorage.removeItem(AGENT_SERVER_CONFIG_STORAGE_KEY);\n    return;\n  }\n\n  window.localStorage.setItem(\n    AGENT_SERVER_CONFIG_STORAGE_KEY,\n    JSON.stringify(nextConfig),\n  );\n}\n\nfunction trimToNull(value?: string | null): string | null {\n  return value?.trim() || null;\n}\n\nfunction normalizeBaseUrl(value?: string | null): string | null {\n  if (!value) return null;\n\n  const trimmed = value.trim().replace(/\\/$/, \"\");\n  if (!trimmed) return null;\n\n  if (/^https?:\\/\\//i.test(trimmed)) {\n    return trimmed;\n  }\n\n  if (typeof window !== \"undefined\") {\n    return `${window.location.protocol}//${trimmed}`;\n  }\n\n  return `http://${trimmed}`;\n}\n\nfunction getConfiguredBaseUrl(): string | null {\n  const storedUrl = normalizeBaseUrl(readStoredConfig().baseUrl);\n  if (storedUrl) return storedUrl;\n\n  return normalizeBaseUrl(import.meta.env.VITE_BACKEND_BASE_URL);\n}\n\nfunction getConfiguredSessionApiKey(): string | null {\n  const storedKey = trimToNull(readStoredConfig().sessionApiKey);\n  if (storedKey) return storedKey;\n\n  return trimToNull(import.meta.env.VITE_SESSION_API_KEY);\n}\n\nfunction shouldUseProxyOrigin(baseUrl: string): boolean {\n  if (typeof window === \"undefined\") {\n    return false;\n  }\n\n  try {\n    const configuredUrl = new URL(baseUrl);\n    const localHosts = new Set([\"127.0.0.1\", \"localhost\", \"0.0.0.0\"]);\n    const browserHostname = window.location.hostname;\n\n    return (\n      localHosts.has(configuredUrl.hostname) && !localHosts.has(browserHostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction resolveAgentServerBaseUrl(baseUrl: string | null): string | null {\n  if (!baseUrl) {\n    return null;\n  }\n\n  if (shouldUseProxyOrigin(baseUrl)) {\n    return window.location.origin;\n  }\n\n  return baseUrl;\n}\n\nexport function getAgentServerFormDefaults(): AgentServerFormDefaults {\n  return {\n    baseUrl: getConfiguredBaseUrl() ?? \"\",\n    sessionApiKey: getConfiguredSessionApiKey() ?? \"\",\n  };\n}\n\nexport function saveAgentServerConfig(config: AgentServerFormDefaults): void {\n  const currentConfig = readStoredConfig();\n\n  writeStoredConfig({\n    ...currentConfig,\n    baseUrl: normalizeBaseUrl(config.baseUrl),\n    sessionApiKey: trimToNull(config.sessionApiKey),\n  });\n}\n\nexport function getAgentServerBaseUrl(): string {\n  const configuredUrl = resolveAgentServerBaseUrl(getConfiguredBaseUrl());\n  if (configuredUrl) return configuredUrl;\n\n  if (typeof window !== \"undefined\") {\n    return window.location.origin;\n  }\n\n  return \"http://127.0.0.1:8000\";\n}\n\nexport function getAgentServerSessionApiKey(): string | null {\n  return getConfiguredSessionApiKey();\n}\n\nexport function getAgentServerWorkingDir(): string {\n  const envDir = import.meta.env.VITE_WORKING_DIR?.trim();\n  if (envDir) return envDir;\n\n  const storedDir = readStoredConfig().workingDir?.trim();\n  if (storedDir) return storedDir;\n\n  return DEFAULT_WORKING_DIR;\n}\n\nexport function buildConversationWorkingDir(conversationId: string): string {\n  const base = getAgentServerWorkingDir().replace(/\\/+$/, \"\");\n  const hex = conversationId.replace(/-/g, \"\");\n  return `${base}/${hex}`;\n}\n\nexport function getConfiguredWorkerUrls(): string[] {\n  const raw = import.meta.env.VITE_WORKER_URLS?.trim();\n  if (!raw) return [];\n\n  return raw\n    .split(\",\")\n    .map((url: string) => normalizeBaseUrl(url))\n    .filter((url: string | null): url is string => Boolean(url));\n}\n\nexport function getAgentServerHeaders(): Record<string, string> {\n  const sessionApiKey = getAgentServerSessionApiKey();\n  return sessionApiKey ? { \"X-Session-API-Key\": sessionApiKey } : {};\n}\n\n/**\n * Returns whether public skills from the OpenHands extensions marketplace\n * (https://github.com/OpenHands/extensions) should be loaded.\n *\n * Defaults to true. Set VITE_LOAD_PUBLIC_SKILLS=false to disable.\n */\nexport function shouldLoadPublicSkills(): boolean {\n  return import.meta.env.VITE_LOAD_PUBLIC_SKILLS !== \"false\";\n}\n"],"mappings":"6CAAA,IAAa,EAAkC,gCAClC,EAAsB,oBAanC,SAAS,GAA4C,CACnD,GAAI,OAAO,OAAW,IAAa,MAAO,EAAE,CAE5C,GAAI,CACF,IAAM,EAAM,OAAO,aAAa,QAAQ,EAAgC,CAGxE,OAFK,EACU,KAAK,MAAM,EACnB,EAAU,EAAE,CAFF,EAAE,MAGb,CACN,MAAO,EAAE,EA6Bb,SAAS,EAAW,EAAsC,CACxD,OAAO,GAAO,MAAM,EAAI,KAG1B,SAAS,EAAiB,EAAsC,CAC9D,GAAI,CAAC,EAAO,OAAO,KAEnB,IAAM,EAAU,EAAM,MAAM,CAAC,QAAQ,MAAO,GAAG,CAW/C,OAVK,EAED,gBAAgB,KAAK,EAAQ,CACxB,EAGL,OAAO,OAAW,IACb,GAAG,OAAO,SAAS,SAAS,IAAI,IAGlC,UAAU,IAVI,KAavB,SAAS,GAAsC,CAI7C,OAHkB,EAAiB,GAAkB,CAAC,QAClD,EAEG,EAAA,IAAA,GAAuD,CAGhE,SAAS,GAA4C,CAInD,OAHkB,EAAW,GAAkB,CAAC,cAC5C,EAEG,EAAA,IAAA,GAAgD,CAGzD,SAAS,EAAqB,EAA0B,CACtD,GAAI,OAAO,OAAW,IACpB,MAAO,GAGT,GAAI,CACF,IAAM,EAAgB,IAAI,IAAI,EAAQ,CAChC,EAAa,IAAI,IAAI,CAAC,YAAa,YAAa,UAAU,CAAC,CAC3D,EAAkB,OAAO,SAAS,SAExC,OACE,EAAW,IAAI,EAAc,SAAS,EAAI,CAAC,EAAW,IAAI,EAAgB,MAEtE,CACN,MAAO,IAIX,SAAS,EAA0B,EAAuC,CASxE,OARK,EAID,EAAqB,EAAQ,CACxB,OAAO,SAAS,OAGlB,EAPE,KA2BX,SAAgB,GAAgC,CAQ9C,OAPsB,EAA0B,GAAsB,CAClE,GAEA,OAAO,OAAW,IACb,OAAO,SAAS,OAGlB,yBAGT,SAAgB,GAA6C,CAC3D,OAAO,GAA4B,CAGrC,SAAgB,GAAmC,CAOjD,OANM,IAAA,KAA2C,MAAM,EAGrC,GAAkB,CAAC,YAAY,MAAM,EAGhD,EAGT,SAAgB,EAA4B,EAAgC,CAG1E,MAAO,GAFM,GAA0B,CAAC,QAAQ,OAAQ,GAE9C,CAAK,GADH,EAAe,QAAQ,KAAM,GACvB,GAapB,SAAgB,GAAgD,CAC9D,IAAM,EAAgB,GAA6B,CACnD,OAAO,EAAgB,CAAE,oBAAqB,EAAe,CAAG,EAAE,CASpE,SAAgB,GAAkC,CAChD,MAAO"}
+{"version":3,"file":"agent-server-config.cjs","names":[],"sources":["../../src/api/agent-server-config.ts"],"sourcesContent":["export const AGENT_SERVER_CONFIG_STORAGE_KEY = \"openhands-agent-server-config\";\nexport const DEFAULT_WORKING_DIR = \"workspace/project\";\n\ninterface StoredAgentServerConfig {\n  baseUrl?: string | null;\n  sessionApiKey?: string | null;\n  workingDir?: string | null;\n}\n\nexport interface AgentServerFormDefaults {\n  baseUrl: string;\n  sessionApiKey: string;\n}\n\nfunction readStoredConfig(): StoredAgentServerConfig {\n  if (typeof window === \"undefined\") return {};\n\n  try {\n    const raw = window.localStorage.getItem(AGENT_SERVER_CONFIG_STORAGE_KEY);\n    if (!raw) return {};\n    const parsed = JSON.parse(raw) as StoredAgentServerConfig;\n    return parsed ?? {};\n  } catch {\n    return {};\n  }\n}\n\nfunction writeStoredConfig(config: StoredAgentServerConfig): void {\n  if (typeof window === \"undefined\") return;\n\n  const nextConfig = Object.fromEntries(\n    Object.entries(config).flatMap(([key, value]) => {\n      if (typeof value !== \"string\") return [];\n\n      const trimmed = value.trim();\n      if (!trimmed) return [];\n\n      return [[key, trimmed]];\n    }),\n  ) as StoredAgentServerConfig;\n\n  if (Object.keys(nextConfig).length === 0) {\n    window.localStorage.removeItem(AGENT_SERVER_CONFIG_STORAGE_KEY);\n    return;\n  }\n\n  window.localStorage.setItem(\n    AGENT_SERVER_CONFIG_STORAGE_KEY,\n    JSON.stringify(nextConfig),\n  );\n}\n\nfunction trimToNull(value?: string | null): string | null {\n  return value?.trim() || null;\n}\n\nfunction normalizeBaseUrl(value?: string | null): string | null {\n  if (!value) return null;\n\n  const trimmed = value.trim().replace(/\\/$/, \"\");\n  if (!trimmed) return null;\n\n  if (/^https?:\\/\\//i.test(trimmed)) {\n    return trimmed;\n  }\n\n  if (typeof window !== \"undefined\") {\n    return `${window.location.protocol}//${trimmed}`;\n  }\n\n  return `http://${trimmed}`;\n}\n\nfunction getConfiguredBaseUrl(): string | null {\n  const storedUrl = normalizeBaseUrl(readStoredConfig().baseUrl);\n  if (storedUrl) return storedUrl;\n\n  return normalizeBaseUrl(import.meta.env.VITE_BACKEND_BASE_URL);\n}\n\n/**\n * Return the baked-in session API key from the Vite env or the runtime\n * injection by static-server.mjs.  This represents the *server's* truth\n * and is only set in non-public (local) mode.\n */\nexport function getBakedSessionApiKey(): string | null {\n  return trimToNull(import.meta.env.VITE_SESSION_API_KEY);\n}\n\nfunction getConfiguredSessionApiKey(): string | null {\n  const storedKey = trimToNull(readStoredConfig().sessionApiKey);\n  if (storedKey) return storedKey;\n\n  return getBakedSessionApiKey();\n}\n\n/**\n * Sync the baked-in session API key into `openhands-agent-server-config`\n * localStorage when the stored value has drifted.\n *\n * In non-public (local) mode the dev scripts bake the session key into\n * `VITE_SESSION_API_KEY` (Vite dev) or inject it via `static-server.mjs`\n * (`--session-api-key`). That key represents the *server's* truth — the\n * agent-server was started with the same value as `OH_SESSION_API_KEYS_0`.\n *\n * If a user restarts the stack with a different `LOCAL_BACKEND_API_KEY`,\n * the baked-in key changes but the old value may still be persisted in\n * localStorage (written by the onboarding form, the Settings page, or a\n * previous key injection). Without this sync the stale stored key would\n * shadow the new baked key everywhere (`getConfiguredSessionApiKey()`\n * reads localStorage first), causing 401s.\n *\n * Must run **before** any call to `getConfiguredSessionApiKey()` or\n * `makeDefaultLocalBackend()` — called from `readStoredBackends()` in\n * `storage.ts` which is evaluated at module init time.\n */\nexport function syncBakedSessionApiKey(): void {\n  const bakedKey = getBakedSessionApiKey();\n  if (!bakedKey) return; // public mode or no key baked in\n\n  const storedConfig = readStoredConfig();\n  const storedKey = trimToNull(storedConfig.sessionApiKey);\n  if (storedKey && storedKey !== bakedKey) {\n    writeStoredConfig({ ...storedConfig, sessionApiKey: bakedKey });\n  }\n}\n\nfunction shouldUseProxyOrigin(baseUrl: string): boolean {\n  if (typeof window === \"undefined\") {\n    return false;\n  }\n\n  try {\n    const configuredUrl = new URL(baseUrl);\n    const localHosts = new Set([\"127.0.0.1\", \"localhost\", \"0.0.0.0\"]);\n    const browserHostname = window.location.hostname;\n\n    return (\n      localHosts.has(configuredUrl.hostname) &&\n      (!localHosts.has(browserHostname) ||\n        configuredUrl.hostname !== browserHostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction resolveAgentServerBaseUrl(baseUrl: string | null): string | null {\n  if (!baseUrl) {\n    return null;\n  }\n\n  if (shouldUseProxyOrigin(baseUrl)) {\n    return window.location.origin;\n  }\n\n  return baseUrl;\n}\n\nexport function getAgentServerFormDefaults(): AgentServerFormDefaults {\n  return {\n    baseUrl: getConfiguredBaseUrl() ?? \"\",\n    sessionApiKey: getConfiguredSessionApiKey() ?? \"\",\n  };\n}\n\nexport function saveAgentServerConfig(config: AgentServerFormDefaults): void {\n  const currentConfig = readStoredConfig();\n\n  writeStoredConfig({\n    ...currentConfig,\n    baseUrl: normalizeBaseUrl(config.baseUrl),\n    sessionApiKey: trimToNull(config.sessionApiKey),\n  });\n}\n\nexport function getAgentServerBaseUrl(): string {\n  const configuredUrl = resolveAgentServerBaseUrl(getConfiguredBaseUrl());\n  if (configuredUrl) return configuredUrl;\n\n  if (typeof window !== \"undefined\") {\n    return window.location.origin;\n  }\n\n  return \"http://127.0.0.1:8000\";\n}\n\nexport function getAgentServerSessionApiKey(): string | null {\n  return getConfiguredSessionApiKey();\n}\n\nexport function getAgentServerWorkingDir(): string {\n  const envDir = import.meta.env.VITE_WORKING_DIR?.trim();\n  if (envDir) return envDir;\n\n  const storedDir = readStoredConfig().workingDir?.trim();\n  if (storedDir) return storedDir;\n\n  return DEFAULT_WORKING_DIR;\n}\n\nexport function buildConversationWorkingDir(conversationId: string): string {\n  const base = getAgentServerWorkingDir().replace(/\\/+$/, \"\");\n  const hex = conversationId.replace(/-/g, \"\");\n  return `${base}/${hex}`;\n}\n\nexport function getConfiguredWorkerUrls(): string[] {\n  const raw = import.meta.env.VITE_WORKER_URLS?.trim();\n  if (!raw) return [];\n\n  return raw\n    .split(\",\")\n    .map((url: string) => normalizeBaseUrl(url))\n    .filter((url: string | null): url is string => Boolean(url));\n}\n\nexport function getAgentServerHeaders(): Record<string, string> {\n  const sessionApiKey = getAgentServerSessionApiKey();\n  return sessionApiKey ? { \"X-Session-API-Key\": sessionApiKey } : {};\n}\n\n/**\n * Returns whether public skills from the OpenHands extensions marketplace\n * (https://github.com/OpenHands/extensions) should be loaded.\n *\n * Defaults to true. Set VITE_LOAD_PUBLIC_SKILLS=false to disable.\n */\nexport function shouldLoadPublicSkills(): boolean {\n  return import.meta.env.VITE_LOAD_PUBLIC_SKILLS !== \"false\";\n}\n\n/**\n * Whether the deployment requires an API key from the user (public mode).\n *\n * Checks both the Vite build-time env var (`VITE_AUTH_REQUIRED`) and the\n * runtime flag injected by static-server.mjs (`window.__AGENT_CANVAS_AUTH_REQUIRED__`).\n * The runtime flag is needed for pre-built static binaries where\n * `VITE_AUTH_REQUIRED` was not set at build time.\n */\nexport function isAuthRequired(): boolean {\n  return (\n    import.meta.env.VITE_AUTH_REQUIRED === \"true\" ||\n    (typeof window !== \"undefined\" &&\n      (window as unknown as Record<string, unknown>)\n        .__AGENT_CANVAS_AUTH_REQUIRED__ === true)\n  );\n}\n\n/**\n * Returns true when the server was started in public mode and the user\n * has not yet pasted an API key (nothing in localStorage, nothing baked\n * in via `VITE_SESSION_API_KEY`).\n *\n * Used by `root.tsx` to gate the app behind {@link ApiKeyEntryScreen}\n * before any network request is attempted.\n */\nexport function isAuthRequiredAndMissing(): boolean {\n  if (!isAuthRequired()) return false;\n  return !getConfiguredSessionApiKey();\n}\n"],"mappings":"6CAAA,IAAa,EAAkC,gCAClC,EAAsB,oBAanC,SAAS,GAA4C,CACnD,GAAI,OAAO,OAAW,IAAa,MAAO,EAAE,CAE5C,GAAI,CACF,IAAM,EAAM,OAAO,aAAa,QAAQ,EAAgC,CAGxE,OAFK,EACU,KAAK,MAAM,EACnB,EAAU,EAAE,CAFF,EAAE,MAGb,CACN,MAAO,EAAE,EAIb,SAAS,EAAkB,EAAuC,CAChE,GAAI,OAAO,OAAW,IAAa,OAEnC,IAAM,EAAa,OAAO,YACxB,OAAO,QAAQ,EAAO,CAAC,SAAS,CAAC,EAAK,KAAW,CAC/C,GAAI,OAAO,GAAU,SAAU,MAAO,EAAE,CAExC,IAAM,EAAU,EAAM,MAAM,CAG5B,OAFK,EAEE,CAAC,CAAC,EAAK,EAAQ,CAAC,CAFF,EAAE,EAGvB,CACH,CAED,GAAI,OAAO,KAAK,EAAW,CAAC,SAAW,EAAG,CACxC,OAAO,aAAa,WAAW,EAAgC,CAC/D,OAGF,OAAO,aAAa,QAClB,EACA,KAAK,UAAU,EAAW,CAC3B,CAGH,SAAS,EAAW,EAAsC,CACxD,OAAO,GAAO,MAAM,EAAI,KAG1B,SAAS,EAAiB,EAAsC,CAC9D,GAAI,CAAC,EAAO,OAAO,KAEnB,IAAM,EAAU,EAAM,MAAM,CAAC,QAAQ,MAAO,GAAG,CAW/C,OAVK,EAED,gBAAgB,KAAK,EAAQ,CACxB,EAGL,OAAO,OAAW,IACb,GAAG,OAAO,SAAS,SAAS,IAAI,IAGlC,UAAU,IAVI,KAavB,SAAS,GAAsC,CAI7C,OAHkB,EAAiB,GAAkB,CAAC,QAClD,EAEG,EAAA,IAAA,GAAuD,CAQhE,SAAgB,GAAuC,CACrD,OAAO,EAAA,IAAA,GAAgD,CAGzD,SAAS,GAA4C,CAInD,OAHkB,EAAW,GAAkB,CAAC,cAC5C,EAEG,GAAuB,CAuBhC,SAAgB,GAA+B,CAC7C,IAAM,EAAW,GAAuB,CACxC,GAAI,CAAC,EAAU,OAEf,IAAM,EAAe,GAAkB,CACjC,EAAY,EAAW,EAAa,cAAc,CACpD,GAAa,IAAc,GAC7B,EAAkB,CAAE,GAAG,EAAc,cAAe,EAAU,CAAC,CAInE,SAAS,EAAqB,EAA0B,CACtD,GAAI,OAAO,OAAW,IACpB,MAAO,GAGT,GAAI,CACF,IAAM,EAAgB,IAAI,IAAI,EAAQ,CAChC,EAAa,IAAI,IAAI,CAAC,YAAa,YAAa,UAAU,CAAC,CAC3D,EAAkB,OAAO,SAAS,SAExC,OACE,EAAW,IAAI,EAAc,SAAS,GACrC,CAAC,EAAW,IAAI,EAAgB,EAC/B,EAAc,WAAa,QAEzB,CACN,MAAO,IAIX,SAAS,EAA0B,EAAuC,CASxE,OARK,EAID,EAAqB,EAAQ,CACxB,OAAO,SAAS,OAGlB,EAPE,KA2BX,SAAgB,GAAgC,CAQ9C,OAPsB,EAA0B,GAAsB,CAClE,GAEA,OAAO,OAAW,IACb,OAAO,SAAS,OAGlB,yBAGT,SAAgB,GAA6C,CAC3D,OAAO,GAA4B,CAGrC,SAAgB,GAAmC,CAOjD,OANM,IAAA,KAA2C,MAAM,EAGrC,GAAkB,CAAC,YAAY,MAAM,EAGhD,EAGT,SAAgB,EAA4B,EAAgC,CAG1E,MAAO,GAFM,GAA0B,CAAC,QAAQ,OAAQ,GAE9C,CAAK,GADH,EAAe,QAAQ,KAAM,GACvB,GAapB,SAAgB,GAAgD,CAC9D,IAAM,EAAgB,GAA6B,CACnD,OAAO,EAAgB,CAAE,oBAAqB,EAAe,CAAG,EAAE,CASpE,SAAgB,GAAkC,CAChD,MAAO,GAWT,SAAgB,GAA0B,CACxC,OAEG,OAAO,OAAW,KAChB,OACE,iCAAmC"}

package/dist/api/agent-server-config.d.ts

@@ -4,6 +4,33 @@ export interface AgentServerFormDefaults {
     baseUrl: string;
     sessionApiKey: string;
 }
+/**
+ * Return the baked-in session API key from the Vite env or the runtime
+ * injection by static-server.mjs.  This represents the *server's* truth
+ * and is only set in non-public (local) mode.
+ */
+export declare function getBakedSessionApiKey(): string | null;
+/**
+ * Sync the baked-in session API key into `openhands-agent-server-config`
+ * localStorage when the stored value has drifted.
+ *
+ * In non-public (local) mode the dev scripts bake the session key into
+ * `VITE_SESSION_API_KEY` (Vite dev) or inject it via `static-server.mjs`
+ * (`--session-api-key`). That key represents the *server's* truth — the
+ * agent-server was started with the same value as `OH_SESSION_API_KEYS_0`.
+ *
+ * If a user restarts the stack with a different `LOCAL_BACKEND_API_KEY`,
+ * the baked-in key changes but the old value may still be persisted in
+ * localStorage (written by the onboarding form, the Settings page, or a
+ * previous key injection). Without this sync the stale stored key would
+ * shadow the new baked key everywhere (`getConfiguredSessionApiKey()`
+ * reads localStorage first), causing 401s.
+ *
+ * Must run **before** any call to `getConfiguredSessionApiKey()` or
+ * `makeDefaultLocalBackend()` — called from `readStoredBackends()` in
+ * `storage.ts` which is evaluated at module init time.
+ */
+export declare function syncBakedSessionApiKey(): void;
 export declare function getAgentServerFormDefaults(): AgentServerFormDefaults;
 export declare function saveAgentServerConfig(config: AgentServerFormDefaults): void;
 export declare function getAgentServerBaseUrl(): string;
@@ -19,3 +46,21 @@ export declare function getAgentServerHeaders(): Record<string, string>;
  * Defaults to true. Set VITE_LOAD_PUBLIC_SKILLS=false to disable.
  */
 export declare function shouldLoadPublicSkills(): boolean;
+/**
+ * Whether the deployment requires an API key from the user (public mode).
+ *
+ * Checks both the Vite build-time env var (`VITE_AUTH_REQUIRED`) and the
+ * runtime flag injected by static-server.mjs (`window.__AGENT_CANVAS_AUTH_REQUIRED__`).
+ * The runtime flag is needed for pre-built static binaries where
+ * `VITE_AUTH_REQUIRED` was not set at build time.
+ */
+export declare function isAuthRequired(): boolean;
+/**
+ * Returns true when the server was started in public mode and the user
+ * has not yet pasted an API key (nothing in localStorage, nothing baked
+ * in via `VITE_SESSION_API_KEY`).
+ *
+ * Used by `root.tsx` to gate the app behind {@link ApiKeyEntryScreen}
+ * before any network request is attempted.
+ */
+export declare function isAuthRequiredAndMissing(): boolean;

package/dist/api/agent-server-config.js

@@ -9,21 +9,46 @@ function n() {
 		return {};
 	}
 }
-function r(e) {
-	return e?.trim() || null;
+function r(t) {
+	if (typeof window > "u") return;
+	let n = Object.fromEntries(Object.entries(t).flatMap(([e, t]) => {
+		if (typeof t != "string") return [];
+		let n = t.trim();
+		return n ? [[e, n]] : [];
+	}));
+	if (Object.keys(n).length === 0) {
+		window.localStorage.removeItem(e);
+		return;
+	}
+	window.localStorage.setItem(e, JSON.stringify(n));
 }
 function i(e) {
+	return e?.trim() || null;
+}
+function a(e) {
 	if (!e) return null;
 	let t = e.trim().replace(/\/$/, "");
 	return t ? /^https?:\/\//i.test(t) ? t : typeof window < "u" ? `${window.location.protocol}//${t}` : `http://${t}` : null;
 }
-function a() {
-	return i(n().baseUrl) || i(void 0);
-}
 function o() {
-	return r(n().sessionApiKey) || r(void 0);
+	return a(n().baseUrl) || a(void 0);
+}
+function s() {
+	return i(void 0);
 }
-function s(e) {
+function c() {
+	return i(n().sessionApiKey) || s();
+}
+function l() {
+	let e = s();
+	if (!e) return;
+	let t = n(), a = i(t.sessionApiKey);
+	a && a !== e && r({
+		...t,
+		sessionApiKey: e
+	});
+}
+function u(e) {
 	if (typeof window > "u") return !1;
 	try {
 		let t = new URL(e), n = new Set([
@@ -31,34 +56,37 @@ function s(e) {
 			"localhost",
 			"0.0.0.0"
 		]), r = window.location.hostname;
-		return n.has(t.hostname) && !n.has(r);
+		return n.has(t.hostname) && (!n.has(r) || t.hostname !== r);
 	} catch {
 		return !1;
 	}
 }
-function c(e) {
-	return e ? s(e) ? window.location.origin : e : null;
+function d(e) {
+	return e ? u(e) ? window.location.origin : e : null;
 }
-function l() {
-	return c(a()) || (typeof window < "u" ? window.location.origin : "http://127.0.0.1:8000");
+function f() {
+	return d(o()) || (typeof window < "u" ? window.location.origin : "http://127.0.0.1:8000");
 }
-function u() {
-	return o();
+function p() {
+	return c();
 }
-function d() {
+function m() {
 	return (void 0)?.trim() || n().workingDir?.trim() || t;
 }
-function f(e) {
-	return `${d().replace(/\/+$/, "")}/${e.replace(/-/g, "")}`;
+function h(e) {
+	return `${m().replace(/\/+$/, "")}/${e.replace(/-/g, "")}`;
 }
-function p() {
-	let e = u();
+function g() {
+	let e = p();
 	return e ? { "X-Session-API-Key": e } : {};
 }
-function m() {
+function _() {
 	return !0;
 }
+function v() {
+	return typeof window < "u" && window.__AGENT_CANVAS_AUTH_REQUIRED__ === !0;
+}
 //#endregion
-export { t as DEFAULT_WORKING_DIR, f as buildConversationWorkingDir, l as getAgentServerBaseUrl, p as getAgentServerHeaders, u as getAgentServerSessionApiKey, d as getAgentServerWorkingDir, m as shouldLoadPublicSkills };
+export { t as DEFAULT_WORKING_DIR, h as buildConversationWorkingDir, f as getAgentServerBaseUrl, g as getAgentServerHeaders, p as getAgentServerSessionApiKey, m as getAgentServerWorkingDir, v as isAuthRequired, _ as shouldLoadPublicSkills, l as syncBakedSessionApiKey };
 
 //# sourceMappingURL=agent-server-config.js.map

package/dist/api/agent-server-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-server-config.js","names":[],"sources":["../../src/api/agent-server-config.ts"],"sourcesContent":["export const AGENT_SERVER_CONFIG_STORAGE_KEY = \"openhands-agent-server-config\";\nexport const DEFAULT_WORKING_DIR = \"workspace/project\";\n\ninterface StoredAgentServerConfig {\n  baseUrl?: string | null;\n  sessionApiKey?: string | null;\n  workingDir?: string | null;\n}\n\nexport interface AgentServerFormDefaults {\n  baseUrl: string;\n  sessionApiKey: string;\n}\n\nfunction readStoredConfig(): StoredAgentServerConfig {\n  if (typeof window === \"undefined\") return {};\n\n  try {\n    const raw = window.localStorage.getItem(AGENT_SERVER_CONFIG_STORAGE_KEY);\n    if (!raw) return {};\n    const parsed = JSON.parse(raw) as StoredAgentServerConfig;\n    return parsed ?? {};\n  } catch {\n    return {};\n  }\n}\n\nfunction writeStoredConfig(config: StoredAgentServerConfig): void {\n  if (typeof window === \"undefined\") return;\n\n  const nextConfig = Object.fromEntries(\n    Object.entries(config).flatMap(([key, value]) => {\n      if (typeof value !== \"string\") return [];\n\n      const trimmed = value.trim();\n      if (!trimmed) return [];\n\n      return [[key, trimmed]];\n    }),\n  ) as StoredAgentServerConfig;\n\n  if (Object.keys(nextConfig).length === 0) {\n    window.localStorage.removeItem(AGENT_SERVER_CONFIG_STORAGE_KEY);\n    return;\n  }\n\n  window.localStorage.setItem(\n    AGENT_SERVER_CONFIG_STORAGE_KEY,\n    JSON.stringify(nextConfig),\n  );\n}\n\nfunction trimToNull(value?: string | null): string | null {\n  return value?.trim() || null;\n}\n\nfunction normalizeBaseUrl(value?: string | null): string | null {\n  if (!value) return null;\n\n  const trimmed = value.trim().replace(/\\/$/, \"\");\n  if (!trimmed) return null;\n\n  if (/^https?:\\/\\//i.test(trimmed)) {\n    return trimmed;\n  }\n\n  if (typeof window !== \"undefined\") {\n    return `${window.location.protocol}//${trimmed}`;\n  }\n\n  return `http://${trimmed}`;\n}\n\nfunction getConfiguredBaseUrl(): string | null {\n  const storedUrl = normalizeBaseUrl(readStoredConfig().baseUrl);\n  if (storedUrl) return storedUrl;\n\n  return normalizeBaseUrl(import.meta.env.VITE_BACKEND_BASE_URL);\n}\n\nfunction getConfiguredSessionApiKey(): string | null {\n  const storedKey = trimToNull(readStoredConfig().sessionApiKey);\n  if (storedKey) return storedKey;\n\n  return trimToNull(import.meta.env.VITE_SESSION_API_KEY);\n}\n\nfunction shouldUseProxyOrigin(baseUrl: string): boolean {\n  if (typeof window === \"undefined\") {\n    return false;\n  }\n\n  try {\n    const configuredUrl = new URL(baseUrl);\n    const localHosts = new Set([\"127.0.0.1\", \"localhost\", \"0.0.0.0\"]);\n    const browserHostname = window.location.hostname;\n\n    return (\n      localHosts.has(configuredUrl.hostname) && !localHosts.has(browserHostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction resolveAgentServerBaseUrl(baseUrl: string | null): string | null {\n  if (!baseUrl) {\n    return null;\n  }\n\n  if (shouldUseProxyOrigin(baseUrl)) {\n    return window.location.origin;\n  }\n\n  return baseUrl;\n}\n\nexport function getAgentServerFormDefaults(): AgentServerFormDefaults {\n  return {\n    baseUrl: getConfiguredBaseUrl() ?? \"\",\n    sessionApiKey: getConfiguredSessionApiKey() ?? \"\",\n  };\n}\n\nexport function saveAgentServerConfig(config: AgentServerFormDefaults): void {\n  const currentConfig = readStoredConfig();\n\n  writeStoredConfig({\n    ...currentConfig,\n    baseUrl: normalizeBaseUrl(config.baseUrl),\n    sessionApiKey: trimToNull(config.sessionApiKey),\n  });\n}\n\nexport function getAgentServerBaseUrl(): string {\n  const configuredUrl = resolveAgentServerBaseUrl(getConfiguredBaseUrl());\n  if (configuredUrl) return configuredUrl;\n\n  if (typeof window !== \"undefined\") {\n    return window.location.origin;\n  }\n\n  return \"http://127.0.0.1:8000\";\n}\n\nexport function getAgentServerSessionApiKey(): string | null {\n  return getConfiguredSessionApiKey();\n}\n\nexport function getAgentServerWorkingDir(): string {\n  const envDir = import.meta.env.VITE_WORKING_DIR?.trim();\n  if (envDir) return envDir;\n\n  const storedDir = readStoredConfig().workingDir?.trim();\n  if (storedDir) return storedDir;\n\n  return DEFAULT_WORKING_DIR;\n}\n\nexport function buildConversationWorkingDir(conversationId: string): string {\n  const base = getAgentServerWorkingDir().replace(/\\/+$/, \"\");\n  const hex = conversationId.replace(/-/g, \"\");\n  return `${base}/${hex}`;\n}\n\nexport function getConfiguredWorkerUrls(): string[] {\n  const raw = import.meta.env.VITE_WORKER_URLS?.trim();\n  if (!raw) return [];\n\n  return raw\n    .split(\",\")\n    .map((url: string) => normalizeBaseUrl(url))\n    .filter((url: string | null): url is string => Boolean(url));\n}\n\nexport function getAgentServerHeaders(): Record<string, string> {\n  const sessionApiKey = getAgentServerSessionApiKey();\n  return sessionApiKey ? { \"X-Session-API-Key\": sessionApiKey } : {};\n}\n\n/**\n * Returns whether public skills from the OpenHands extensions marketplace\n * (https://github.com/OpenHands/extensions) should be loaded.\n *\n * Defaults to true. Set VITE_LOAD_PUBLIC_SKILLS=false to disable.\n */\nexport function shouldLoadPublicSkills(): boolean {\n  return import.meta.env.VITE_LOAD_PUBLIC_SKILLS !== \"false\";\n}\n"],"mappings":";AAAA,IAAa,IAAkC,iCAClC,IAAsB;AAanC,SAAS,IAA4C;AACnD,KAAI,OAAO,SAAW,IAAa,QAAO,EAAE;AAE5C,KAAI;EACF,IAAM,IAAM,OAAO,aAAa,QAAQ,EAAgC;AAGxE,SAFK,IACU,KAAK,MAAM,EACnB,IAAU,EAAE,GAFF,EAAE;SAGb;AACN,SAAO,EAAE;;;AA6Bb,SAAS,EAAW,GAAsC;AACxD,QAAO,GAAO,MAAM,IAAI;;AAG1B,SAAS,EAAiB,GAAsC;AAC9D,KAAI,CAAC,EAAO,QAAO;CAEnB,IAAM,IAAU,EAAM,MAAM,CAAC,QAAQ,OAAO,GAAG;AAW/C,QAVK,IAED,gBAAgB,KAAK,EAAQ,GACxB,IAGL,OAAO,SAAW,MACb,GAAG,OAAO,SAAS,SAAS,IAAI,MAGlC,UAAU,MAVI;;AAavB,SAAS,IAAsC;AAI7C,QAHkB,EAAiB,GAAkB,CAAC,QAClD,IAEG,EAAA,KAAA,EAAuD;;AAGhE,SAAS,IAA4C;AAInD,QAHkB,EAAW,GAAkB,CAAC,cAC5C,IAEG,EAAA,KAAA,EAAgD;;AAGzD,SAAS,EAAqB,GAA0B;AACtD,KAAI,OAAO,SAAW,IACpB,QAAO;AAGT,KAAI;EACF,IAAM,IAAgB,IAAI,IAAI,EAAQ,EAChC,IAAa,IAAI,IAAI;GAAC;GAAa;GAAa;GAAU,CAAC,EAC3D,IAAkB,OAAO,SAAS;AAExC,SACE,EAAW,IAAI,EAAc,SAAS,IAAI,CAAC,EAAW,IAAI,EAAgB;SAEtE;AACN,SAAO;;;AAIX,SAAS,EAA0B,GAAuC;AASxE,QARK,IAID,EAAqB,EAAQ,GACxB,OAAO,SAAS,SAGlB,IAPE;;AA2BX,SAAgB,IAAgC;AAQ9C,QAPsB,EAA0B,GAAsB,CAClE,KAEA,OAAO,SAAW,MACb,OAAO,SAAS,SAGlB;;AAGT,SAAgB,IAA6C;AAC3D,QAAO,GAA4B;;AAGrC,SAAgB,IAAmC;AAOjD,SANM,KAAA,IAA2C,MAAM,IAGrC,GAAkB,CAAC,YAAY,MAAM,IAGhD;;AAGT,SAAgB,EAA4B,GAAgC;AAG1E,QAAO,GAFM,GAA0B,CAAC,QAAQ,QAAQ,GAE9C,CAAK,GADH,EAAe,QAAQ,MAAM,GACvB;;AAapB,SAAgB,IAAgD;CAC9D,IAAM,IAAgB,GAA6B;AACnD,QAAO,IAAgB,EAAE,qBAAqB,GAAe,GAAG,EAAE;;AASpE,SAAgB,IAAkC;AAChD,QAAO"}
+{"version":3,"file":"agent-server-config.js","names":[],"sources":["../../src/api/agent-server-config.ts"],"sourcesContent":["export const AGENT_SERVER_CONFIG_STORAGE_KEY = \"openhands-agent-server-config\";\nexport const DEFAULT_WORKING_DIR = \"workspace/project\";\n\ninterface StoredAgentServerConfig {\n  baseUrl?: string | null;\n  sessionApiKey?: string | null;\n  workingDir?: string | null;\n}\n\nexport interface AgentServerFormDefaults {\n  baseUrl: string;\n  sessionApiKey: string;\n}\n\nfunction readStoredConfig(): StoredAgentServerConfig {\n  if (typeof window === \"undefined\") return {};\n\n  try {\n    const raw = window.localStorage.getItem(AGENT_SERVER_CONFIG_STORAGE_KEY);\n    if (!raw) return {};\n    const parsed = JSON.parse(raw) as StoredAgentServerConfig;\n    return parsed ?? {};\n  } catch {\n    return {};\n  }\n}\n\nfunction writeStoredConfig(config: StoredAgentServerConfig): void {\n  if (typeof window === \"undefined\") return;\n\n  const nextConfig = Object.fromEntries(\n    Object.entries(config).flatMap(([key, value]) => {\n      if (typeof value !== \"string\") return [];\n\n      const trimmed = value.trim();\n      if (!trimmed) return [];\n\n      return [[key, trimmed]];\n    }),\n  ) as StoredAgentServerConfig;\n\n  if (Object.keys(nextConfig).length === 0) {\n    window.localStorage.removeItem(AGENT_SERVER_CONFIG_STORAGE_KEY);\n    return;\n  }\n\n  window.localStorage.setItem(\n    AGENT_SERVER_CONFIG_STORAGE_KEY,\n    JSON.stringify(nextConfig),\n  );\n}\n\nfunction trimToNull(value?: string | null): string | null {\n  return value?.trim() || null;\n}\n\nfunction normalizeBaseUrl(value?: string | null): string | null {\n  if (!value) return null;\n\n  const trimmed = value.trim().replace(/\\/$/, \"\");\n  if (!trimmed) return null;\n\n  if (/^https?:\\/\\//i.test(trimmed)) {\n    return trimmed;\n  }\n\n  if (typeof window !== \"undefined\") {\n    return `${window.location.protocol}//${trimmed}`;\n  }\n\n  return `http://${trimmed}`;\n}\n\nfunction getConfiguredBaseUrl(): string | null {\n  const storedUrl = normalizeBaseUrl(readStoredConfig().baseUrl);\n  if (storedUrl) return storedUrl;\n\n  return normalizeBaseUrl(import.meta.env.VITE_BACKEND_BASE_URL);\n}\n\n/**\n * Return the baked-in session API key from the Vite env or the runtime\n * injection by static-server.mjs.  This represents the *server's* truth\n * and is only set in non-public (local) mode.\n */\nexport function getBakedSessionApiKey(): string | null {\n  return trimToNull(import.meta.env.VITE_SESSION_API_KEY);\n}\n\nfunction getConfiguredSessionApiKey(): string | null {\n  const storedKey = trimToNull(readStoredConfig().sessionApiKey);\n  if (storedKey) return storedKey;\n\n  return getBakedSessionApiKey();\n}\n\n/**\n * Sync the baked-in session API key into `openhands-agent-server-config`\n * localStorage when the stored value has drifted.\n *\n * In non-public (local) mode the dev scripts bake the session key into\n * `VITE_SESSION_API_KEY` (Vite dev) or inject it via `static-server.mjs`\n * (`--session-api-key`). That key represents the *server's* truth — the\n * agent-server was started with the same value as `OH_SESSION_API_KEYS_0`.\n *\n * If a user restarts the stack with a different `LOCAL_BACKEND_API_KEY`,\n * the baked-in key changes but the old value may still be persisted in\n * localStorage (written by the onboarding form, the Settings page, or a\n * previous key injection). Without this sync the stale stored key would\n * shadow the new baked key everywhere (`getConfiguredSessionApiKey()`\n * reads localStorage first), causing 401s.\n *\n * Must run **before** any call to `getConfiguredSessionApiKey()` or\n * `makeDefaultLocalBackend()` — called from `readStoredBackends()` in\n * `storage.ts` which is evaluated at module init time.\n */\nexport function syncBakedSessionApiKey(): void {\n  const bakedKey = getBakedSessionApiKey();\n  if (!bakedKey) return; // public mode or no key baked in\n\n  const storedConfig = readStoredConfig();\n  const storedKey = trimToNull(storedConfig.sessionApiKey);\n  if (storedKey && storedKey !== bakedKey) {\n    writeStoredConfig({ ...storedConfig, sessionApiKey: bakedKey });\n  }\n}\n\nfunction shouldUseProxyOrigin(baseUrl: string): boolean {\n  if (typeof window === \"undefined\") {\n    return false;\n  }\n\n  try {\n    const configuredUrl = new URL(baseUrl);\n    const localHosts = new Set([\"127.0.0.1\", \"localhost\", \"0.0.0.0\"]);\n    const browserHostname = window.location.hostname;\n\n    return (\n      localHosts.has(configuredUrl.hostname) &&\n      (!localHosts.has(browserHostname) ||\n        configuredUrl.hostname !== browserHostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction resolveAgentServerBaseUrl(baseUrl: string | null): string | null {\n  if (!baseUrl) {\n    return null;\n  }\n\n  if (shouldUseProxyOrigin(baseUrl)) {\n    return window.location.origin;\n  }\n\n  return baseUrl;\n}\n\nexport function getAgentServerFormDefaults(): AgentServerFormDefaults {\n  return {\n    baseUrl: getConfiguredBaseUrl() ?? \"\",\n    sessionApiKey: getConfiguredSessionApiKey() ?? \"\",\n  };\n}\n\nexport function saveAgentServerConfig(config: AgentServerFormDefaults): void {\n  const currentConfig = readStoredConfig();\n\n  writeStoredConfig({\n    ...currentConfig,\n    baseUrl: normalizeBaseUrl(config.baseUrl),\n    sessionApiKey: trimToNull(config.sessionApiKey),\n  });\n}\n\nexport function getAgentServerBaseUrl(): string {\n  const configuredUrl = resolveAgentServerBaseUrl(getConfiguredBaseUrl());\n  if (configuredUrl) return configuredUrl;\n\n  if (typeof window !== \"undefined\") {\n    return window.location.origin;\n  }\n\n  return \"http://127.0.0.1:8000\";\n}\n\nexport function getAgentServerSessionApiKey(): string | null {\n  return getConfiguredSessionApiKey();\n}\n\nexport function getAgentServerWorkingDir(): string {\n  const envDir = import.meta.env.VITE_WORKING_DIR?.trim();\n  if (envDir) return envDir;\n\n  const storedDir = readStoredConfig().workingDir?.trim();\n  if (storedDir) return storedDir;\n\n  return DEFAULT_WORKING_DIR;\n}\n\nexport function buildConversationWorkingDir(conversationId: string): string {\n  const base = getAgentServerWorkingDir().replace(/\\/+$/, \"\");\n  const hex = conversationId.replace(/-/g, \"\");\n  return `${base}/${hex}`;\n}\n\nexport function getConfiguredWorkerUrls(): string[] {\n  const raw = import.meta.env.VITE_WORKER_URLS?.trim();\n  if (!raw) return [];\n\n  return raw\n    .split(\",\")\n    .map((url: string) => normalizeBaseUrl(url))\n    .filter((url: string | null): url is string => Boolean(url));\n}\n\nexport function getAgentServerHeaders(): Record<string, string> {\n  const sessionApiKey = getAgentServerSessionApiKey();\n  return sessionApiKey ? { \"X-Session-API-Key\": sessionApiKey } : {};\n}\n\n/**\n * Returns whether public skills from the OpenHands extensions marketplace\n * (https://github.com/OpenHands/extensions) should be loaded.\n *\n * Defaults to true. Set VITE_LOAD_PUBLIC_SKILLS=false to disable.\n */\nexport function shouldLoadPublicSkills(): boolean {\n  return import.meta.env.VITE_LOAD_PUBLIC_SKILLS !== \"false\";\n}\n\n/**\n * Whether the deployment requires an API key from the user (public mode).\n *\n * Checks both the Vite build-time env var (`VITE_AUTH_REQUIRED`) and the\n * runtime flag injected by static-server.mjs (`window.__AGENT_CANVAS_AUTH_REQUIRED__`).\n * The runtime flag is needed for pre-built static binaries where\n * `VITE_AUTH_REQUIRED` was not set at build time.\n */\nexport function isAuthRequired(): boolean {\n  return (\n    import.meta.env.VITE_AUTH_REQUIRED === \"true\" ||\n    (typeof window !== \"undefined\" &&\n      (window as unknown as Record<string, unknown>)\n        .__AGENT_CANVAS_AUTH_REQUIRED__ === true)\n  );\n}\n\n/**\n * Returns true when the server was started in public mode and the user\n * has not yet pasted an API key (nothing in localStorage, nothing baked\n * in via `VITE_SESSION_API_KEY`).\n *\n * Used by `root.tsx` to gate the app behind {@link ApiKeyEntryScreen}\n * before any network request is attempted.\n */\nexport function isAuthRequiredAndMissing(): boolean {\n  if (!isAuthRequired()) return false;\n  return !getConfiguredSessionApiKey();\n}\n"],"mappings":";AAAA,IAAa,IAAkC,iCAClC,IAAsB;AAanC,SAAS,IAA4C;AACnD,KAAI,OAAO,SAAW,IAAa,QAAO,EAAE;AAE5C,KAAI;EACF,IAAM,IAAM,OAAO,aAAa,QAAQ,EAAgC;AAGxE,SAFK,IACU,KAAK,MAAM,EACnB,IAAU,EAAE,GAFF,EAAE;SAGb;AACN,SAAO,EAAE;;;AAIb,SAAS,EAAkB,GAAuC;AAChE,KAAI,OAAO,SAAW,IAAa;CAEnC,IAAM,IAAa,OAAO,YACxB,OAAO,QAAQ,EAAO,CAAC,SAAS,CAAC,GAAK,OAAW;AAC/C,MAAI,OAAO,KAAU,SAAU,QAAO,EAAE;EAExC,IAAM,IAAU,EAAM,MAAM;AAG5B,SAFK,IAEE,CAAC,CAAC,GAAK,EAAQ,CAAC,GAFF,EAAE;GAGvB,CACH;AAED,KAAI,OAAO,KAAK,EAAW,CAAC,WAAW,GAAG;AACxC,SAAO,aAAa,WAAW,EAAgC;AAC/D;;AAGF,QAAO,aAAa,QAClB,GACA,KAAK,UAAU,EAAW,CAC3B;;AAGH,SAAS,EAAW,GAAsC;AACxD,QAAO,GAAO,MAAM,IAAI;;AAG1B,SAAS,EAAiB,GAAsC;AAC9D,KAAI,CAAC,EAAO,QAAO;CAEnB,IAAM,IAAU,EAAM,MAAM,CAAC,QAAQ,OAAO,GAAG;AAW/C,QAVK,IAED,gBAAgB,KAAK,EAAQ,GACxB,IAGL,OAAO,SAAW,MACb,GAAG,OAAO,SAAS,SAAS,IAAI,MAGlC,UAAU,MAVI;;AAavB,SAAS,IAAsC;AAI7C,QAHkB,EAAiB,GAAkB,CAAC,QAClD,IAEG,EAAA,KAAA,EAAuD;;AAQhE,SAAgB,IAAuC;AACrD,QAAO,EAAA,KAAA,EAAgD;;AAGzD,SAAS,IAA4C;AAInD,QAHkB,EAAW,GAAkB,CAAC,cAC5C,IAEG,GAAuB;;AAuBhC,SAAgB,IAA+B;CAC7C,IAAM,IAAW,GAAuB;AACxC,KAAI,CAAC,EAAU;CAEf,IAAM,IAAe,GAAkB,EACjC,IAAY,EAAW,EAAa,cAAc;AACxD,CAAI,KAAa,MAAc,KAC7B,EAAkB;EAAE,GAAG;EAAc,eAAe;EAAU,CAAC;;AAInE,SAAS,EAAqB,GAA0B;AACtD,KAAI,OAAO,SAAW,IACpB,QAAO;AAGT,KAAI;EACF,IAAM,IAAgB,IAAI,IAAI,EAAQ,EAChC,IAAa,IAAI,IAAI;GAAC;GAAa;GAAa;GAAU,CAAC,EAC3D,IAAkB,OAAO,SAAS;AAExC,SACE,EAAW,IAAI,EAAc,SAAS,KACrC,CAAC,EAAW,IAAI,EAAgB,IAC/B,EAAc,aAAa;SAEzB;AACN,SAAO;;;AAIX,SAAS,EAA0B,GAAuC;AASxE,QARK,IAID,EAAqB,EAAQ,GACxB,OAAO,SAAS,SAGlB,IAPE;;AA2BX,SAAgB,IAAgC;AAQ9C,QAPsB,EAA0B,GAAsB,CAClE,KAEA,OAAO,SAAW,MACb,OAAO,SAAS,SAGlB;;AAGT,SAAgB,IAA6C;AAC3D,QAAO,GAA4B;;AAGrC,SAAgB,IAAmC;AAOjD,SANM,KAAA,IAA2C,MAAM,IAGrC,GAAkB,CAAC,YAAY,MAAM,IAGhD;;AAGT,SAAgB,EAA4B,GAAgC;AAG1E,QAAO,GAFM,GAA0B,CAAC,QAAQ,QAAQ,GAE9C,CAAK,GADH,EAAe,QAAQ,MAAM,GACvB;;AAapB,SAAgB,IAAgD;CAC9D,IAAM,IAAgB,GAA6B;AACnD,QAAO,IAAgB,EAAE,qBAAqB,GAAe,GAAG,EAAE;;AASpE,SAAgB,IAAkC;AAChD,QAAO;;AAWT,SAAgB,IAA0B;AACxC,QAEG,OAAO,SAAW,OAChB,OACE,mCAAmC"}

package/dist/api/backend-registry/storage.cjs

@@ -1,2 +1,2 @@
-require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`./default-backend.cjs`);var t=`openhands-backends`,n=`openhands-active-backend`;function r(e){return e===`local`||e===`cloud`}function i(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.id==`string`&&t.id.length>0&&typeof t.name==`string`&&typeof t.host==`string`&&typeof t.apiKey==`string`&&r(t.kind)}function a(e){try{return new URL(e).origin}catch{return e.replace(/\/+$/,``)}}function o(t){let n=e.makeDefaultLocalBackend();return t.id!==n.id||t.kind!==`local`||!n.apiKey||a(t.host)!==a(n.host)||t.apiKey===n.apiKey?t:{...t,apiKey:n.apiKey}}function s(e){if(!(typeof window>`u`))try{window.localStorage.setItem(t,JSON.stringify(e))}catch{}}function c(){if(typeof window>`u`)return[];try{let n=window.localStorage.getItem(t);if(n===null){let t=[e.makeDefaultLocalBackend()];return s(t),t}let r=JSON.parse(n);if(!Array.isArray(r))return[];let a=r.filter(i);if(a.length===0){let t=[e.makeDefaultLocalBackend()];return s(t),t}let c=a.map(o);return c.some((e,t)=>e!==a[t])&&s(c),c}catch{return[]}}function l(){if(typeof window>`u`)return null;try{let e=window.localStorage.getItem(n);if(!e)return null;let t=JSON.parse(e);if(typeof t!=`object`||!t||typeof t.backendId!=`string`)return null;let r=t.orgId;return{backendId:t.backendId,orgId:typeof r==`string`&&r.length>0?r:null}}catch{return null}}function u(e){if(!(typeof window>`u`))try{if(!e){window.localStorage.removeItem(n);return}window.localStorage.setItem(n,JSON.stringify({backendId:e.backendId,orgId:e.orgId??null}))}catch{}}exports.readStoredActiveBackend=l,exports.readStoredBackends=c,exports.writeStoredActiveBackend=u,exports.writeStoredBackends=s;
+require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../agent-server-config.cjs`),t=require(`./default-backend.cjs`);var n=`openhands-backends`,r=`openhands-active-backend`;function i(e){return e===`local`||e===`cloud`}function a(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.id==`string`&&t.id.length>0&&typeof t.name==`string`&&typeof t.host==`string`&&typeof t.apiKey==`string`&&i(t.kind)}function o(e){try{return new URL(e).origin}catch{return e.replace(/\/+$/,``)}}function s(e){let n=t.makeDefaultLocalBackend();return e.id!==n.id||e.kind!==`local`||!n.apiKey||o(e.host)!==o(n.host)||e.apiKey===n.apiKey?e:{...e,apiKey:n.apiKey}}function c(e){if(!(typeof window>`u`))try{window.localStorage.setItem(n,JSON.stringify(e))}catch{}}function l(){if(typeof window>`u`)return[];e.syncBakedSessionApiKey();try{let e=window.localStorage.getItem(n);if(e===null){let e=[t.makeDefaultLocalBackend()];return c(e),e}let r=JSON.parse(e);if(!Array.isArray(r))return[];let i=r.filter(a);if(i.length===0){let e=[t.makeDefaultLocalBackend()];return c(e),e}let o=i.map(s);return o.some((e,t)=>e!==i[t])&&c(o),o}catch{return[]}}function u(){if(typeof window>`u`)return null;try{let e=window.localStorage.getItem(r);if(!e)return null;let t=JSON.parse(e);if(typeof t!=`object`||!t||typeof t.backendId!=`string`)return null;let n=t.orgId;return{backendId:t.backendId,orgId:typeof n==`string`&&n.length>0?n:null}}catch{return null}}function d(e){if(!(typeof window>`u`))try{if(!e){window.localStorage.removeItem(r);return}window.localStorage.setItem(r,JSON.stringify({backendId:e.backendId,orgId:e.orgId??null}))}catch{}}exports.readStoredActiveBackend=u,exports.readStoredBackends=l,exports.writeStoredActiveBackend=d,exports.writeStoredBackends=c;
 //# sourceMappingURL=storage.cjs.map

package/dist/api/backend-registry/storage.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"storage.cjs","names":[],"sources":["../../../src/api/backend-registry/storage.ts"],"sourcesContent":["import { makeDefaultLocalBackend } from \"./default-backend\";\nimport type { Backend, BackendKind, BackendSelection } from \"./types\";\n\nexport const BACKENDS_STORAGE_KEY = \"openhands-backends\";\nexport const ACTIVE_BACKEND_STORAGE_KEY = \"openhands-active-backend\";\n\nfunction isValidKind(value: unknown): value is BackendKind {\n  return value === \"local\" || value === \"cloud\";\n}\n\nfunction isValidBackend(value: unknown): value is Backend {\n  if (typeof value !== \"object\" || value === null) return false;\n  const v = value as Partial<Backend>;\n  return (\n    typeof v.id === \"string\" &&\n    v.id.length > 0 &&\n    typeof v.name === \"string\" &&\n    typeof v.host === \"string\" &&\n    typeof v.apiKey === \"string\" &&\n    isValidKind(v.kind)\n  );\n}\n\nfunction normalizeHostForComparison(host: string): string {\n  try {\n    return new URL(host).origin;\n  } catch {\n    return host.replace(/\\/+$/, \"\");\n  }\n}\n\nfunction syncDefaultLocalBackendAuth(backend: Backend): Backend {\n  const defaultBackend = makeDefaultLocalBackend();\n\n  if (\n    backend.id !== defaultBackend.id ||\n    backend.kind !== \"local\" ||\n    !defaultBackend.apiKey ||\n    normalizeHostForComparison(backend.host) !==\n      normalizeHostForComparison(defaultBackend.host)\n  ) {\n    return backend;\n  }\n\n  if (backend.apiKey === defaultBackend.apiKey) {\n    return backend;\n  }\n\n  return {\n    ...backend,\n    apiKey: defaultBackend.apiKey,\n  };\n}\n\nexport function writeStoredBackends(backends: Backend[]): void {\n  if (typeof window === \"undefined\") return;\n  try {\n    window.localStorage.setItem(BACKENDS_STORAGE_KEY, JSON.stringify(backends));\n  } catch {\n    /* ignore quota / serialization errors */\n  }\n}\n\nexport function readStoredBackends(): Backend[] {\n  if (typeof window === \"undefined\") return [];\n  try {\n    const raw = window.localStorage.getItem(BACKENDS_STORAGE_KEY);\n\n    // First install: the storage key has never been written. Seed the\n    // registry with one default local backend derived from the env /\n    // agent-server-config so the user has something to talk to out of\n    // the box.\n    if (raw === null) {\n      const seeded = [makeDefaultLocalBackend()];\n      writeStoredBackends(seeded);\n      return seeded;\n    }\n\n    const parsed = JSON.parse(raw);\n    if (!Array.isArray(parsed)) return [];\n    const valid = parsed.filter(isValidBackend);\n\n    // If the stored array is empty (or everything in it failed validation),\n    // re-seed with the default Local backend so the user always has a\n    // working entry pointing at VITE_SESSION_API_KEY. With the dev scripts\n    // persisting that key to ~/.openhands/agent-canvas/session-api-key.txt,\n    // re-seeding is safe — the seeded entry will keep working across\n    // restarts instead of going stale.\n    if (valid.length === 0) {\n      const seeded = [makeDefaultLocalBackend()];\n      writeStoredBackends(seeded);\n      return seeded;\n    }\n\n    const synced = valid.map(syncDefaultLocalBackendAuth);\n    if (synced.some((backend, index) => backend !== valid[index])) {\n      writeStoredBackends(synced);\n    }\n\n    return synced;\n  } catch {\n    return [];\n  }\n}\n\nexport function readStoredActiveBackend(): BackendSelection | null {\n  if (typeof window === \"undefined\") return null;\n  try {\n    const raw = window.localStorage.getItem(ACTIVE_BACKEND_STORAGE_KEY);\n    if (!raw) return null;\n    const parsed = JSON.parse(raw);\n    if (\n      typeof parsed !== \"object\" ||\n      parsed === null ||\n      typeof (parsed as BackendSelection).backendId !== \"string\"\n    ) {\n      return null;\n    }\n    const orgIdRaw = (parsed as BackendSelection).orgId;\n    return {\n      backendId: (parsed as BackendSelection).backendId,\n      orgId:\n        typeof orgIdRaw === \"string\" && orgIdRaw.length > 0 ? orgIdRaw : null,\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport function writeStoredActiveBackend(\n  selection: BackendSelection | null,\n): void {\n  if (typeof window === \"undefined\") return;\n  try {\n    if (!selection) {\n      window.localStorage.removeItem(ACTIVE_BACKEND_STORAGE_KEY);\n      return;\n    }\n    window.localStorage.setItem(\n      ACTIVE_BACKEND_STORAGE_KEY,\n      JSON.stringify({\n        backendId: selection.backendId,\n        orgId: selection.orgId ?? null,\n      }),\n    );\n  } catch {\n    /* ignore */\n  }\n}\n"],"mappings":"yFAGA,IAAa,EAAuB,qBACvB,EAA6B,2BAE1C,SAAS,EAAY,EAAsC,CACzD,OAAO,IAAU,SAAW,IAAU,QAGxC,SAAS,EAAe,EAAkC,CACxD,GAAI,OAAO,GAAU,WAAY,EAAgB,MAAO,GACxD,IAAM,EAAI,EACV,OACE,OAAO,EAAE,IAAO,UAChB,EAAE,GAAG,OAAS,GACd,OAAO,EAAE,MAAS,UAClB,OAAO,EAAE,MAAS,UAClB,OAAO,EAAE,QAAW,UACpB,EAAY,EAAE,KAAK,CAIvB,SAAS,EAA2B,EAAsB,CACxD,GAAI,CACF,OAAO,IAAI,IAAI,EAAK,CAAC,YACf,CACN,OAAO,EAAK,QAAQ,OAAQ,GAAG,EAInC,SAAS,EAA4B,EAA2B,CAC9D,IAAM,EAAiB,EAAA,yBAAyB,CAgBhD,OAbE,EAAQ,KAAO,EAAe,IAC9B,EAAQ,OAAS,SACjB,CAAC,EAAe,QAChB,EAA2B,EAAQ,KAAK,GACtC,EAA2B,EAAe,KAAK,EAK/C,EAAQ,SAAW,EAAe,OAC7B,EAGF,CACL,GAAG,EACH,OAAQ,EAAe,OACxB,CAGH,SAAgB,EAAoB,EAA2B,CACzD,YAAO,OAAW,KACtB,GAAI,CACF,OAAO,aAAa,QAAQ,EAAsB,KAAK,UAAU,EAAS,CAAC,MACrE,GAKV,SAAgB,GAAgC,CAC9C,GAAI,OAAO,OAAW,IAAa,MAAO,EAAE,CAC5C,GAAI,CACF,IAAM,EAAM,OAAO,aAAa,QAAQ,EAAqB,CAM7D,GAAI,IAAQ,KAAM,CAChB,IAAM,EAAS,CAAC,EAAA,yBAAyB,CAAC,CAE1C,OADA,EAAoB,EAAO,CACpB,EAGT,IAAM,EAAS,KAAK,MAAM,EAAI,CAC9B,GAAI,CAAC,MAAM,QAAQ,EAAO,CAAE,MAAO,EAAE,CACrC,IAAM,EAAQ,EAAO,OAAO,EAAe,CAQ3C,GAAI,EAAM,SAAW,EAAG,CACtB,IAAM,EAAS,CAAC,EAAA,yBAAyB,CAAC,CAE1C,OADA,EAAoB,EAAO,CACpB,EAGT,IAAM,EAAS,EAAM,IAAI,EAA4B,CAKrD,OAJI,EAAO,MAAM,EAAS,IAAU,IAAY,EAAM,GAAO,EAC3D,EAAoB,EAAO,CAGtB,OACD,CACN,MAAO,EAAE,EAIb,SAAgB,GAAmD,CACjE,GAAI,OAAO,OAAW,IAAa,OAAO,KAC1C,GAAI,CACF,IAAM,EAAM,OAAO,aAAa,QAAQ,EAA2B,CACnE,GAAI,CAAC,EAAK,OAAO,KACjB,IAAM,EAAS,KAAK,MAAM,EAAI,CAC9B,GACE,OAAO,GAAW,WAClB,GACA,OAAQ,EAA4B,WAAc,SAElD,OAAO,KAET,IAAM,EAAY,EAA4B,MAC9C,MAAO,CACL,UAAY,EAA4B,UACxC,MACE,OAAO,GAAa,UAAY,EAAS,OAAS,EAAI,EAAW,KACpE,MACK,CACN,OAAO,MAIX,SAAgB,EACd,EACM,CACF,YAAO,OAAW,KACtB,GAAI,CACF,GAAI,CAAC,EAAW,CACd,OAAO,aAAa,WAAW,EAA2B,CAC1D,OAEF,OAAO,aAAa,QAClB,EACA,KAAK,UAAU,CACb,UAAW,EAAU,UACrB,MAAO,EAAU,OAAS,KAC3B,CAAC,CACH,MACK"}
+{"version":3,"file":"storage.cjs","names":[],"sources":["../../../src/api/backend-registry/storage.ts"],"sourcesContent":["import { syncBakedSessionApiKey } from \"../agent-server-config\";\nimport { makeDefaultLocalBackend } from \"./default-backend\";\nimport type { Backend, BackendKind, BackendSelection } from \"./types\";\n\nexport const BACKENDS_STORAGE_KEY = \"openhands-backends\";\nexport const ACTIVE_BACKEND_STORAGE_KEY = \"openhands-active-backend\";\n\nfunction isValidKind(value: unknown): value is BackendKind {\n  return value === \"local\" || value === \"cloud\";\n}\n\nfunction isValidBackend(value: unknown): value is Backend {\n  if (typeof value !== \"object\" || value === null) return false;\n  const v = value as Partial<Backend>;\n  return (\n    typeof v.id === \"string\" &&\n    v.id.length > 0 &&\n    typeof v.name === \"string\" &&\n    typeof v.host === \"string\" &&\n    typeof v.apiKey === \"string\" &&\n    isValidKind(v.kind)\n  );\n}\n\nfunction normalizeHostForComparison(host: string): string {\n  try {\n    return new URL(host).origin;\n  } catch {\n    return host.replace(/\\/+$/, \"\");\n  }\n}\n\nfunction syncDefaultLocalBackendAuth(backend: Backend): Backend {\n  const defaultBackend = makeDefaultLocalBackend();\n\n  if (\n    backend.id !== defaultBackend.id ||\n    backend.kind !== \"local\" ||\n    !defaultBackend.apiKey ||\n    normalizeHostForComparison(backend.host) !==\n      normalizeHostForComparison(defaultBackend.host)\n  ) {\n    return backend;\n  }\n\n  if (backend.apiKey === defaultBackend.apiKey) {\n    return backend;\n  }\n\n  return {\n    ...backend,\n    apiKey: defaultBackend.apiKey,\n  };\n}\n\nexport function writeStoredBackends(backends: Backend[]): void {\n  if (typeof window === \"undefined\") return;\n  try {\n    window.localStorage.setItem(BACKENDS_STORAGE_KEY, JSON.stringify(backends));\n  } catch {\n    /* ignore quota / serialization errors */\n  }\n}\n\nexport function readStoredBackends(): Backend[] {\n  if (typeof window === \"undefined\") return [];\n\n  // Ensure the baked-in session API key (VITE_SESSION_API_KEY) is synced\n  // into the legacy `openhands-agent-server-config` localStorage entry\n  // BEFORE we read the backend registry.  This matters when the user\n  // restarts the stack with a different LOCAL_BACKEND_API_KEY — without\n  // this call the stale key in `openhands-agent-server-config` shadows\n  // the new baked key, making `makeDefaultLocalBackend()` (and the\n  // downstream `syncDefaultLocalBackendAuth`) read the wrong value.\n  syncBakedSessionApiKey();\n\n  try {\n    const raw = window.localStorage.getItem(BACKENDS_STORAGE_KEY);\n\n    // First install: the storage key has never been written. Seed the\n    // registry with one default local backend derived from the env /\n    // agent-server-config so the user has something to talk to out of\n    // the box.\n    if (raw === null) {\n      const seeded = [makeDefaultLocalBackend()];\n      writeStoredBackends(seeded);\n      return seeded;\n    }\n\n    const parsed = JSON.parse(raw);\n    if (!Array.isArray(parsed)) return [];\n    const valid = parsed.filter(isValidBackend);\n\n    // If the stored array is empty (or everything in it failed validation),\n    // re-seed with the default Local backend so the user always has a\n    // working entry pointing at VITE_SESSION_API_KEY. With the dev scripts\n    // persisting that key to ~/.openhands/agent-canvas/session-api-key.txt,\n    // re-seeding is safe — the seeded entry will keep working across\n    // restarts instead of going stale.\n    if (valid.length === 0) {\n      const seeded = [makeDefaultLocalBackend()];\n      writeStoredBackends(seeded);\n      return seeded;\n    }\n\n    const synced = valid.map(syncDefaultLocalBackendAuth);\n    if (synced.some((backend, index) => backend !== valid[index])) {\n      writeStoredBackends(synced);\n    }\n\n    return synced;\n  } catch {\n    return [];\n  }\n}\n\nexport function readStoredActiveBackend(): BackendSelection | null {\n  if (typeof window === \"undefined\") return null;\n  try {\n    const raw = window.localStorage.getItem(ACTIVE_BACKEND_STORAGE_KEY);\n    if (!raw) return null;\n    const parsed = JSON.parse(raw);\n    if (\n      typeof parsed !== \"object\" ||\n      parsed === null ||\n      typeof (parsed as BackendSelection).backendId !== \"string\"\n    ) {\n      return null;\n    }\n    const orgIdRaw = (parsed as BackendSelection).orgId;\n    return {\n      backendId: (parsed as BackendSelection).backendId,\n      orgId:\n        typeof orgIdRaw === \"string\" && orgIdRaw.length > 0 ? orgIdRaw : null,\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport function writeStoredActiveBackend(\n  selection: BackendSelection | null,\n): void {\n  if (typeof window === \"undefined\") return;\n  try {\n    if (!selection) {\n      window.localStorage.removeItem(ACTIVE_BACKEND_STORAGE_KEY);\n      return;\n    }\n    window.localStorage.setItem(\n      ACTIVE_BACKEND_STORAGE_KEY,\n      JSON.stringify({\n        backendId: selection.backendId,\n        orgId: selection.orgId ?? null,\n      }),\n    );\n  } catch {\n    /* ignore */\n  }\n}\n"],"mappings":"iIAIA,IAAa,EAAuB,qBACvB,EAA6B,2BAE1C,SAAS,EAAY,EAAsC,CACzD,OAAO,IAAU,SAAW,IAAU,QAGxC,SAAS,EAAe,EAAkC,CACxD,GAAI,OAAO,GAAU,WAAY,EAAgB,MAAO,GACxD,IAAM,EAAI,EACV,OACE,OAAO,EAAE,IAAO,UAChB,EAAE,GAAG,OAAS,GACd,OAAO,EAAE,MAAS,UAClB,OAAO,EAAE,MAAS,UAClB,OAAO,EAAE,QAAW,UACpB,EAAY,EAAE,KAAK,CAIvB,SAAS,EAA2B,EAAsB,CACxD,GAAI,CACF,OAAO,IAAI,IAAI,EAAK,CAAC,YACf,CACN,OAAO,EAAK,QAAQ,OAAQ,GAAG,EAInC,SAAS,EAA4B,EAA2B,CAC9D,IAAM,EAAiB,EAAA,yBAAyB,CAgBhD,OAbE,EAAQ,KAAO,EAAe,IAC9B,EAAQ,OAAS,SACjB,CAAC,EAAe,QAChB,EAA2B,EAAQ,KAAK,GACtC,EAA2B,EAAe,KAAK,EAK/C,EAAQ,SAAW,EAAe,OAC7B,EAGF,CACL,GAAG,EACH,OAAQ,EAAe,OACxB,CAGH,SAAgB,EAAoB,EAA2B,CACzD,YAAO,OAAW,KACtB,GAAI,CACF,OAAO,aAAa,QAAQ,EAAsB,KAAK,UAAU,EAAS,CAAC,MACrE,GAKV,SAAgB,GAAgC,CAC9C,GAAI,OAAO,OAAW,IAAa,MAAO,EAAE,CAS5C,EAAA,wBAAwB,CAExB,GAAI,CACF,IAAM,EAAM,OAAO,aAAa,QAAQ,EAAqB,CAM7D,GAAI,IAAQ,KAAM,CAChB,IAAM,EAAS,CAAC,EAAA,yBAAyB,CAAC,CAE1C,OADA,EAAoB,EAAO,CACpB,EAGT,IAAM,EAAS,KAAK,MAAM,EAAI,CAC9B,GAAI,CAAC,MAAM,QAAQ,EAAO,CAAE,MAAO,EAAE,CACrC,IAAM,EAAQ,EAAO,OAAO,EAAe,CAQ3C,GAAI,EAAM,SAAW,EAAG,CACtB,IAAM,EAAS,CAAC,EAAA,yBAAyB,CAAC,CAE1C,OADA,EAAoB,EAAO,CACpB,EAGT,IAAM,EAAS,EAAM,IAAI,EAA4B,CAKrD,OAJI,EAAO,MAAM,EAAS,IAAU,IAAY,EAAM,GAAO,EAC3D,EAAoB,EAAO,CAGtB,OACD,CACN,MAAO,EAAE,EAIb,SAAgB,GAAmD,CACjE,GAAI,OAAO,OAAW,IAAa,OAAO,KAC1C,GAAI,CACF,IAAM,EAAM,OAAO,aAAa,QAAQ,EAA2B,CACnE,GAAI,CAAC,EAAK,OAAO,KACjB,IAAM,EAAS,KAAK,MAAM,EAAI,CAC9B,GACE,OAAO,GAAW,WAClB,GACA,OAAQ,EAA4B,WAAc,SAElD,OAAO,KAET,IAAM,EAAY,EAA4B,MAC9C,MAAO,CACL,UAAY,EAA4B,UACxC,MACE,OAAO,GAAa,UAAY,EAAS,OAAS,EAAI,EAAW,KACpE,MACK,CACN,OAAO,MAIX,SAAgB,EACd,EACM,CACF,YAAO,OAAW,KACtB,GAAI,CACF,GAAI,CAAC,EAAW,CACd,OAAO,aAAa,WAAW,EAA2B,CAC1D,OAEF,OAAO,aAAa,QAClB,EACA,KAAK,UAAU,CACb,UAAW,EAAU,UACrB,MAAO,EAAU,OAAS,KAC3B,CAAC,CACH,MACK"}

package/dist/api/backend-registry/storage.js

@@ -1,83 +1,85 @@
-import { makeDefaultLocalBackend as e } from "./default-backend.js";
+import { syncBakedSessionApiKey as e } from "../agent-server-config.js";
+import { makeDefaultLocalBackend as t } from "./default-backend.js";
 //#region src/api/backend-registry/storage.ts
-var t = "openhands-backends", n = "openhands-active-backend";
-function r(e) {
+var n = "openhands-backends", r = "openhands-active-backend";
+function i(e) {
 	return e === "local" || e === "cloud";
 }
-function i(e) {
+function a(e) {
 	if (typeof e != "object" || !e) return !1;
 	let t = e;
-	return typeof t.id == "string" && t.id.length > 0 && typeof t.name == "string" && typeof t.host == "string" && typeof t.apiKey == "string" && r(t.kind);
+	return typeof t.id == "string" && t.id.length > 0 && typeof t.name == "string" && typeof t.host == "string" && typeof t.apiKey == "string" && i(t.kind);
 }
-function a(e) {
+function o(e) {
 	try {
 		return new URL(e).origin;
 	} catch {
 		return e.replace(/\/+$/, "");
 	}
 }
-function o(t) {
-	let n = e();
-	return t.id !== n.id || t.kind !== "local" || !n.apiKey || a(t.host) !== a(n.host) || t.apiKey === n.apiKey ? t : {
-		...t,
+function s(e) {
+	let n = t();
+	return e.id !== n.id || e.kind !== "local" || !n.apiKey || o(e.host) !== o(n.host) || e.apiKey === n.apiKey ? e : {
+		...e,
 		apiKey: n.apiKey
 	};
 }
-function s(e) {
+function c(e) {
 	if (!(typeof window > "u")) try {
-		window.localStorage.setItem(t, JSON.stringify(e));
+		window.localStorage.setItem(n, JSON.stringify(e));
 	} catch {}
 }
-function c() {
+function l() {
 	if (typeof window > "u") return [];
+	e();
 	try {
-		let n = window.localStorage.getItem(t);
-		if (n === null) {
-			let t = [e()];
-			return s(t), t;
+		let e = window.localStorage.getItem(n);
+		if (e === null) {
+			let e = [t()];
+			return c(e), e;
 		}
-		let r = JSON.parse(n);
+		let r = JSON.parse(e);
 		if (!Array.isArray(r)) return [];
-		let a = r.filter(i);
-		if (a.length === 0) {
-			let t = [e()];
-			return s(t), t;
+		let i = r.filter(a);
+		if (i.length === 0) {
+			let e = [t()];
+			return c(e), e;
 		}
-		let c = a.map(o);
-		return c.some((e, t) => e !== a[t]) && s(c), c;
+		let o = i.map(s);
+		return o.some((e, t) => e !== i[t]) && c(o), o;
 	} catch {
 		return [];
 	}
 }
-function l() {
+function u() {
 	if (typeof window > "u") return null;
 	try {
-		let e = window.localStorage.getItem(n);
+		let e = window.localStorage.getItem(r);
 		if (!e) return null;
 		let t = JSON.parse(e);
 		if (typeof t != "object" || !t || typeof t.backendId != "string") return null;
-		let r = t.orgId;
+		let n = t.orgId;
 		return {
 			backendId: t.backendId,
-			orgId: typeof r == "string" && r.length > 0 ? r : null
+			orgId: typeof n == "string" && n.length > 0 ? n : null
 		};
 	} catch {
 		return null;
 	}
 }
-function u(e) {
+function d(e) {
 	if (!(typeof window > "u")) try {
 		if (!e) {
-			window.localStorage.removeItem(n);
+			window.localStorage.removeItem(r);
 			return;
 		}
-		window.localStorage.setItem(n, JSON.stringify({
+		window.localStorage.setItem(r, JSON.stringify({
 			backendId: e.backendId,
 			orgId: e.orgId ?? null
 		}));
 	} catch {}
 }
 //#endregion
-export { l as readStoredActiveBackend, c as readStoredBackends, u as writeStoredActiveBackend, s as writeStoredBackends };
+export { u as readStoredActiveBackend, l as readStoredBackends, d as writeStoredActiveBackend, c as writeStoredBackends };
 
 //# sourceMappingURL=storage.js.map

package/dist/api/backend-registry/storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage.js","names":[],"sources":["../../../src/api/backend-registry/storage.ts"],"sourcesContent":["import { makeDefaultLocalBackend } from \"./default-backend\";\nimport type { Backend, BackendKind, BackendSelection } from \"./types\";\n\nexport const BACKENDS_STORAGE_KEY = \"openhands-backends\";\nexport const ACTIVE_BACKEND_STORAGE_KEY = \"openhands-active-backend\";\n\nfunction isValidKind(value: unknown): value is BackendKind {\n  return value === \"local\" || value === \"cloud\";\n}\n\nfunction isValidBackend(value: unknown): value is Backend {\n  if (typeof value !== \"object\" || value === null) return false;\n  const v = value as Partial<Backend>;\n  return (\n    typeof v.id === \"string\" &&\n    v.id.length > 0 &&\n    typeof v.name === \"string\" &&\n    typeof v.host === \"string\" &&\n    typeof v.apiKey === \"string\" &&\n    isValidKind(v.kind)\n  );\n}\n\nfunction normalizeHostForComparison(host: string): string {\n  try {\n    return new URL(host).origin;\n  } catch {\n    return host.replace(/\\/+$/, \"\");\n  }\n}\n\nfunction syncDefaultLocalBackendAuth(backend: Backend): Backend {\n  const defaultBackend = makeDefaultLocalBackend();\n\n  if (\n    backend.id !== defaultBackend.id ||\n    backend.kind !== \"local\" ||\n    !defaultBackend.apiKey ||\n    normalizeHostForComparison(backend.host) !==\n      normalizeHostForComparison(defaultBackend.host)\n  ) {\n    return backend;\n  }\n\n  if (backend.apiKey === defaultBackend.apiKey) {\n    return backend;\n  }\n\n  return {\n    ...backend,\n    apiKey: defaultBackend.apiKey,\n  };\n}\n\nexport function writeStoredBackends(backends: Backend[]): void {\n  if (typeof window === \"undefined\") return;\n  try {\n    window.localStorage.setItem(BACKENDS_STORAGE_KEY, JSON.stringify(backends));\n  } catch {\n    /* ignore quota / serialization errors */\n  }\n}\n\nexport function readStoredBackends(): Backend[] {\n  if (typeof window === \"undefined\") return [];\n  try {\n    const raw = window.localStorage.getItem(BACKENDS_STORAGE_KEY);\n\n    // First install: the storage key has never been written. Seed the\n    // registry with one default local backend derived from the env /\n    // agent-server-config so the user has something to talk to out of\n    // the box.\n    if (raw === null) {\n      const seeded = [makeDefaultLocalBackend()];\n      writeStoredBackends(seeded);\n      return seeded;\n    }\n\n    const parsed = JSON.parse(raw);\n    if (!Array.isArray(parsed)) return [];\n    const valid = parsed.filter(isValidBackend);\n\n    // If the stored array is empty (or everything in it failed validation),\n    // re-seed with the default Local backend so the user always has a\n    // working entry pointing at VITE_SESSION_API_KEY. With the dev scripts\n    // persisting that key to ~/.openhands/agent-canvas/session-api-key.txt,\n    // re-seeding is safe — the seeded entry will keep working across\n    // restarts instead of going stale.\n    if (valid.length === 0) {\n      const seeded = [makeDefaultLocalBackend()];\n      writeStoredBackends(seeded);\n      return seeded;\n    }\n\n    const synced = valid.map(syncDefaultLocalBackendAuth);\n    if (synced.some((backend, index) => backend !== valid[index])) {\n      writeStoredBackends(synced);\n    }\n\n    return synced;\n  } catch {\n    return [];\n  }\n}\n\nexport function readStoredActiveBackend(): BackendSelection | null {\n  if (typeof window === \"undefined\") return null;\n  try {\n    const raw = window.localStorage.getItem(ACTIVE_BACKEND_STORAGE_KEY);\n    if (!raw) return null;\n    const parsed = JSON.parse(raw);\n    if (\n      typeof parsed !== \"object\" ||\n      parsed === null ||\n      typeof (parsed as BackendSelection).backendId !== \"string\"\n    ) {\n      return null;\n    }\n    const orgIdRaw = (parsed as BackendSelection).orgId;\n    return {\n      backendId: (parsed as BackendSelection).backendId,\n      orgId:\n        typeof orgIdRaw === \"string\" && orgIdRaw.length > 0 ? orgIdRaw : null,\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport function writeStoredActiveBackend(\n  selection: BackendSelection | null,\n): void {\n  if (typeof window === \"undefined\") return;\n  try {\n    if (!selection) {\n      window.localStorage.removeItem(ACTIVE_BACKEND_STORAGE_KEY);\n      return;\n    }\n    window.localStorage.setItem(\n      ACTIVE_BACKEND_STORAGE_KEY,\n      JSON.stringify({\n        backendId: selection.backendId,\n        orgId: selection.orgId ?? null,\n      }),\n    );\n  } catch {\n    /* ignore */\n  }\n}\n"],"mappings":";;AAGA,IAAa,IAAuB,sBACvB,IAA6B;AAE1C,SAAS,EAAY,GAAsC;AACzD,QAAO,MAAU,WAAW,MAAU;;AAGxC,SAAS,EAAe,GAAkC;AACxD,KAAI,OAAO,KAAU,aAAY,EAAgB,QAAO;CACxD,IAAM,IAAI;AACV,QACE,OAAO,EAAE,MAAO,YAChB,EAAE,GAAG,SAAS,KACd,OAAO,EAAE,QAAS,YAClB,OAAO,EAAE,QAAS,YAClB,OAAO,EAAE,UAAW,YACpB,EAAY,EAAE,KAAK;;AAIvB,SAAS,EAA2B,GAAsB;AACxD,KAAI;AACF,SAAO,IAAI,IAAI,EAAK,CAAC;SACf;AACN,SAAO,EAAK,QAAQ,QAAQ,GAAG;;;AAInC,SAAS,EAA4B,GAA2B;CAC9D,IAAM,IAAiB,GAAyB;AAgBhD,QAbE,EAAQ,OAAO,EAAe,MAC9B,EAAQ,SAAS,WACjB,CAAC,EAAe,UAChB,EAA2B,EAAQ,KAAK,KACtC,EAA2B,EAAe,KAAK,IAK/C,EAAQ,WAAW,EAAe,SAC7B,IAGF;EACL,GAAG;EACH,QAAQ,EAAe;EACxB;;AAGH,SAAgB,EAAoB,GAA2B;AACzD,cAAO,SAAW,KACtB,KAAI;AACF,SAAO,aAAa,QAAQ,GAAsB,KAAK,UAAU,EAAS,CAAC;SACrE;;AAKV,SAAgB,IAAgC;AAC9C,KAAI,OAAO,SAAW,IAAa,QAAO,EAAE;AAC5C,KAAI;EACF,IAAM,IAAM,OAAO,aAAa,QAAQ,EAAqB;AAM7D,MAAI,MAAQ,MAAM;GAChB,IAAM,IAAS,CAAC,GAAyB,CAAC;AAE1C,UADA,EAAoB,EAAO,EACpB;;EAGT,IAAM,IAAS,KAAK,MAAM,EAAI;AAC9B,MAAI,CAAC,MAAM,QAAQ,EAAO,CAAE,QAAO,EAAE;EACrC,IAAM,IAAQ,EAAO,OAAO,EAAe;AAQ3C,MAAI,EAAM,WAAW,GAAG;GACtB,IAAM,IAAS,CAAC,GAAyB,CAAC;AAE1C,UADA,EAAoB,EAAO,EACpB;;EAGT,IAAM,IAAS,EAAM,IAAI,EAA4B;AAKrD,SAJI,EAAO,MAAM,GAAS,MAAU,MAAY,EAAM,GAAO,IAC3D,EAAoB,EAAO,EAGtB;SACD;AACN,SAAO,EAAE;;;AAIb,SAAgB,IAAmD;AACjE,KAAI,OAAO,SAAW,IAAa,QAAO;AAC1C,KAAI;EACF,IAAM,IAAM,OAAO,aAAa,QAAQ,EAA2B;AACnE,MAAI,CAAC,EAAK,QAAO;EACjB,IAAM,IAAS,KAAK,MAAM,EAAI;AAC9B,MACE,OAAO,KAAW,aAClB,KACA,OAAQ,EAA4B,aAAc,SAElD,QAAO;EAET,IAAM,IAAY,EAA4B;AAC9C,SAAO;GACL,WAAY,EAA4B;GACxC,OACE,OAAO,KAAa,YAAY,EAAS,SAAS,IAAI,IAAW;GACpE;SACK;AACN,SAAO;;;AAIX,SAAgB,EACd,GACM;AACF,cAAO,SAAW,KACtB,KAAI;AACF,MAAI,CAAC,GAAW;AACd,UAAO,aAAa,WAAW,EAA2B;AAC1D;;AAEF,SAAO,aAAa,QAClB,GACA,KAAK,UAAU;GACb,WAAW,EAAU;GACrB,OAAO,EAAU,SAAS;GAC3B,CAAC,CACH;SACK"}
+{"version":3,"file":"storage.js","names":[],"sources":["../../../src/api/backend-registry/storage.ts"],"sourcesContent":["import { syncBakedSessionApiKey } from \"../agent-server-config\";\nimport { makeDefaultLocalBackend } from \"./default-backend\";\nimport type { Backend, BackendKind, BackendSelection } from \"./types\";\n\nexport const BACKENDS_STORAGE_KEY = \"openhands-backends\";\nexport const ACTIVE_BACKEND_STORAGE_KEY = \"openhands-active-backend\";\n\nfunction isValidKind(value: unknown): value is BackendKind {\n  return value === \"local\" || value === \"cloud\";\n}\n\nfunction isValidBackend(value: unknown): value is Backend {\n  if (typeof value !== \"object\" || value === null) return false;\n  const v = value as Partial<Backend>;\n  return (\n    typeof v.id === \"string\" &&\n    v.id.length > 0 &&\n    typeof v.name === \"string\" &&\n    typeof v.host === \"string\" &&\n    typeof v.apiKey === \"string\" &&\n    isValidKind(v.kind)\n  );\n}\n\nfunction normalizeHostForComparison(host: string): string {\n  try {\n    return new URL(host).origin;\n  } catch {\n    return host.replace(/\\/+$/, \"\");\n  }\n}\n\nfunction syncDefaultLocalBackendAuth(backend: Backend): Backend {\n  const defaultBackend = makeDefaultLocalBackend();\n\n  if (\n    backend.id !== defaultBackend.id ||\n    backend.kind !== \"local\" ||\n    !defaultBackend.apiKey ||\n    normalizeHostForComparison(backend.host) !==\n      normalizeHostForComparison(defaultBackend.host)\n  ) {\n    return backend;\n  }\n\n  if (backend.apiKey === defaultBackend.apiKey) {\n    return backend;\n  }\n\n  return {\n    ...backend,\n    apiKey: defaultBackend.apiKey,\n  };\n}\n\nexport function writeStoredBackends(backends: Backend[]): void {\n  if (typeof window === \"undefined\") return;\n  try {\n    window.localStorage.setItem(BACKENDS_STORAGE_KEY, JSON.stringify(backends));\n  } catch {\n    /* ignore quota / serialization errors */\n  }\n}\n\nexport function readStoredBackends(): Backend[] {\n  if (typeof window === \"undefined\") return [];\n\n  // Ensure the baked-in session API key (VITE_SESSION_API_KEY) is synced\n  // into the legacy `openhands-agent-server-config` localStorage entry\n  // BEFORE we read the backend registry.  This matters when the user\n  // restarts the stack with a different LOCAL_BACKEND_API_KEY — without\n  // this call the stale key in `openhands-agent-server-config` shadows\n  // the new baked key, making `makeDefaultLocalBackend()` (and the\n  // downstream `syncDefaultLocalBackendAuth`) read the wrong value.\n  syncBakedSessionApiKey();\n\n  try {\n    const raw = window.localStorage.getItem(BACKENDS_STORAGE_KEY);\n\n    // First install: the storage key has never been written. Seed the\n    // registry with one default local backend derived from the env /\n    // agent-server-config so the user has something to talk to out of\n    // the box.\n    if (raw === null) {\n      const seeded = [makeDefaultLocalBackend()];\n      writeStoredBackends(seeded);\n      return seeded;\n    }\n\n    const parsed = JSON.parse(raw);\n    if (!Array.isArray(parsed)) return [];\n    const valid = parsed.filter(isValidBackend);\n\n    // If the stored array is empty (or everything in it failed validation),\n    // re-seed with the default Local backend so the user always has a\n    // working entry pointing at VITE_SESSION_API_KEY. With the dev scripts\n    // persisting that key to ~/.openhands/agent-canvas/session-api-key.txt,\n    // re-seeding is safe — the seeded entry will keep working across\n    // restarts instead of going stale.\n    if (valid.length === 0) {\n      const seeded = [makeDefaultLocalBackend()];\n      writeStoredBackends(seeded);\n      return seeded;\n    }\n\n    const synced = valid.map(syncDefaultLocalBackendAuth);\n    if (synced.some((backend, index) => backend !== valid[index])) {\n      writeStoredBackends(synced);\n    }\n\n    return synced;\n  } catch {\n    return [];\n  }\n}\n\nexport function readStoredActiveBackend(): BackendSelection | null {\n  if (typeof window === \"undefined\") return null;\n  try {\n    const raw = window.localStorage.getItem(ACTIVE_BACKEND_STORAGE_KEY);\n    if (!raw) return null;\n    const parsed = JSON.parse(raw);\n    if (\n      typeof parsed !== \"object\" ||\n      parsed === null ||\n      typeof (parsed as BackendSelection).backendId !== \"string\"\n    ) {\n      return null;\n    }\n    const orgIdRaw = (parsed as BackendSelection).orgId;\n    return {\n      backendId: (parsed as BackendSelection).backendId,\n      orgId:\n        typeof orgIdRaw === \"string\" && orgIdRaw.length > 0 ? orgIdRaw : null,\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport function writeStoredActiveBackend(\n  selection: BackendSelection | null,\n): void {\n  if (typeof window === \"undefined\") return;\n  try {\n    if (!selection) {\n      window.localStorage.removeItem(ACTIVE_BACKEND_STORAGE_KEY);\n      return;\n    }\n    window.localStorage.setItem(\n      ACTIVE_BACKEND_STORAGE_KEY,\n      JSON.stringify({\n        backendId: selection.backendId,\n        orgId: selection.orgId ?? null,\n      }),\n    );\n  } catch {\n    /* ignore */\n  }\n}\n"],"mappings":";;;AAIA,IAAa,IAAuB,sBACvB,IAA6B;AAE1C,SAAS,EAAY,GAAsC;AACzD,QAAO,MAAU,WAAW,MAAU;;AAGxC,SAAS,EAAe,GAAkC;AACxD,KAAI,OAAO,KAAU,aAAY,EAAgB,QAAO;CACxD,IAAM,IAAI;AACV,QACE,OAAO,EAAE,MAAO,YAChB,EAAE,GAAG,SAAS,KACd,OAAO,EAAE,QAAS,YAClB,OAAO,EAAE,QAAS,YAClB,OAAO,EAAE,UAAW,YACpB,EAAY,EAAE,KAAK;;AAIvB,SAAS,EAA2B,GAAsB;AACxD,KAAI;AACF,SAAO,IAAI,IAAI,EAAK,CAAC;SACf;AACN,SAAO,EAAK,QAAQ,QAAQ,GAAG;;;AAInC,SAAS,EAA4B,GAA2B;CAC9D,IAAM,IAAiB,GAAyB;AAgBhD,QAbE,EAAQ,OAAO,EAAe,MAC9B,EAAQ,SAAS,WACjB,CAAC,EAAe,UAChB,EAA2B,EAAQ,KAAK,KACtC,EAA2B,EAAe,KAAK,IAK/C,EAAQ,WAAW,EAAe,SAC7B,IAGF;EACL,GAAG;EACH,QAAQ,EAAe;EACxB;;AAGH,SAAgB,EAAoB,GAA2B;AACzD,cAAO,SAAW,KACtB,KAAI;AACF,SAAO,aAAa,QAAQ,GAAsB,KAAK,UAAU,EAAS,CAAC;SACrE;;AAKV,SAAgB,IAAgC;AAC9C,KAAI,OAAO,SAAW,IAAa,QAAO,EAAE;AAS5C,IAAwB;AAExB,KAAI;EACF,IAAM,IAAM,OAAO,aAAa,QAAQ,EAAqB;AAM7D,MAAI,MAAQ,MAAM;GAChB,IAAM,IAAS,CAAC,GAAyB,CAAC;AAE1C,UADA,EAAoB,EAAO,EACpB;;EAGT,IAAM,IAAS,KAAK,MAAM,EAAI;AAC9B,MAAI,CAAC,MAAM,QAAQ,EAAO,CAAE,QAAO,EAAE;EACrC,IAAM,IAAQ,EAAO,OAAO,EAAe;AAQ3C,MAAI,EAAM,WAAW,GAAG;GACtB,IAAM,IAAS,CAAC,GAAyB,CAAC;AAE1C,UADA,EAAoB,EAAO,EACpB;;EAGT,IAAM,IAAS,EAAM,IAAI,EAA4B;AAKrD,SAJI,EAAO,MAAM,GAAS,MAAU,MAAY,EAAM,GAAO,IAC3D,EAAoB,EAAO,EAGtB;SACD;AACN,SAAO,EAAE;;;AAIb,SAAgB,IAAmD;AACjE,KAAI,OAAO,SAAW,IAAa,QAAO;AAC1C,KAAI;EACF,IAAM,IAAM,OAAO,aAAa,QAAQ,EAA2B;AACnE,MAAI,CAAC,EAAK,QAAO;EACjB,IAAM,IAAS,KAAK,MAAM,EAAI;AAC9B,MACE,OAAO,KAAW,aAClB,KACA,OAAQ,EAA4B,aAAc,SAElD,QAAO;EAET,IAAM,IAAY,EAA4B;AAC9C,SAAO;GACL,WAAY,EAA4B;GACxC,OACE,OAAO,KAAa,YAAY,EAAS,SAAS,IAAI,IAAW;GACpE;SACK;AACN,SAAO;;;AAIX,SAAgB,EACd,GACM;AACF,cAAO,SAAW,KACtB,KAAI;AACF,MAAI,CAAC,GAAW;AACd,UAAO,aAAa,WAAW,EAA2B;AAC1D;;AAEF,SAAO,aAAa,QAClB,GACA,KAAK,UAAU;GACb,WAAW,EAAU;GACrB,OAAO,EAAU,SAAS;GAC3B,CAAC,CACH;SACK"}