@openhands/agent-canvas 1.4.0 → 1.5.0

package/dist/api/device-flow-client.d.ts

@@ -1,59 +1,5 @@
-/**
- * OAuth 2.0 Device Flow client implementation (RFC 8628).
- *
- * Used for one-click authentication with cloud backends.
- * The flow allows users to authenticate in their browser while the
- * application polls for the resulting API key.
- *
- * Device flow requests go directly to the configured OpenHands Cloud host.
- */
-export declare class DeviceFlowError extends Error {
-    readonly code?: string | undefined;
-    constructor(message: string, code?: string | undefined);
-}
-export interface DeviceAuthorizationResponse {
-    device_code: string;
-    user_code: string;
-    verification_uri: string;
-    verification_uri_complete: string;
-    expires_in: number;
-    interval: number;
-}
-export interface DeviceTokenResponse {
-    access_token: string;
-    token_type: string;
-    expires_in?: number;
-}
-/**
- * Check if a host is a known OpenHands Cloud domain.
- * Uses hostname extraction to prevent substring matching attacks.
- */
-export declare function isOpenHandsCloudHost(host: string): boolean;
-/**
- * Start the OAuth 2.0 Device Flow by requesting a device code.
- * Requests are sent directly to the cloud host.
- *
- * @param host - The cloud backend host URL (e.g., "https://app.all-hands.dev")
- * @returns DeviceAuthorizationResponse with device_code, user_code, verification URLs, etc.
- * @throws DeviceFlowError if the request fails
- */
+import type { DeviceAuthorizationResponse, DeviceTokenResponse, PollDeviceTokenOptions } from "@openhands/typescript-client/client/device-flow-client";
+export { DeviceFlowError, isOpenHandsCloudHost, } from "@openhands/typescript-client/client/device-flow-client";
 export declare function startDeviceFlow(host: string): Promise<DeviceAuthorizationResponse>;
-export interface PollOptions {
-    /** Polling interval in seconds (from device authorization response) */
-    interval: number;
-    /** Maximum time to wait for authorization in milliseconds */
-    timeout?: number;
-    /** Abort signal to cancel polling */
-    signal?: AbortSignal;
-}
-/**
- * Poll for the API key after user authorization.
- * Requests are sent directly to the cloud host.
- *
- * @param host - The cloud backend host URL
- * @param deviceCode - The device code from startDeviceFlow
- * @param options - Polling options including interval, timeout, and abort signal
- * @returns DeviceTokenResponse containing the access_token (API key)
- * @throws DeviceFlowError if polling fails, user denies access, or timeout expires
- */
-export declare function pollForToken(host: string, deviceCode: string, options: PollOptions): Promise<DeviceTokenResponse>;
+export declare function pollForToken(host: string, deviceCode: string, options: PollDeviceTokenOptions): Promise<DeviceTokenResponse>;
+export type { DeviceAuthorizationResponse, DeviceTokenResponse, PollDeviceTokenOptions as PollOptions, } from "@openhands/typescript-client/client/device-flow-client";

package/dist/api/device-flow-client.js

@@ -1,106 +1,16 @@
+import { pollForToken as e, startDeviceFlow as t } from "../node_modules/@openhands/typescript-client/dist/client/device-flow-client.js";
+import { AGENT_CANVAS_CLIENT_HEADERS as n } from "./client-source.js";
 //#region src/api/device-flow-client.ts
-var e = class extends Error {
-	constructor(e, t) {
-		super(e), this.code = t, this.name = "DeviceFlowError";
-	}
-}, t = 6e5, n = 3e4;
 function r(e) {
-	try {
-		let t = e.trim().toLowerCase(), n = /^https?:\/\//i.test(t) ? t : `https://${t}`, r = new URL(n).hostname;
-		return r.endsWith(".all-hands.dev") || r === "all-hands.dev" || r.endsWith(".openhands.dev") || r === "openhands.dev";
-	} catch {
-		return !1;
-	}
+	return t(e, { headers: n });
 }
-async function i(e, t, n, r, i, a) {
-	let o = r === void 0 ? void 0 : typeof r == "string" || r instanceof Blob || r instanceof FormData || r instanceof URLSearchParams ? r : JSON.stringify(r);
-	return await fetch(`${e.replace(/\/+$/, "")}${n}`, {
-		method: t,
-		headers: { ...i ? { "Content-Type": i } : {} },
-		body: o,
-		signal: a
-	});
-}
-async function a(t) {
-	let n = t.replace(/\/+$/, "");
-	try {
-		let t = await i(n, "POST", "/oauth/device/authorize", {}, "application/json");
-		if (!t.ok) throw new e(`Failed to start device flow: Server returned ${t.status}`);
-		let r = await t.json();
-		if (!r.device_code || !r.user_code || !r.verification_uri) throw new e("Invalid response from device authorization endpoint: missing required fields");
-		let a = r.verification_uri_complete ?? `${r.verification_uri}?user_code=${encodeURIComponent(r.user_code)}`;
-		return {
-			device_code: r.device_code,
-			user_code: r.user_code,
-			verification_uri: r.verification_uri,
-			verification_uri_complete: a,
-			expires_in: r.expires_in ?? 600,
-			interval: r.interval ?? 5
-		};
-	} catch (t) {
-		throw t instanceof e ? t : new e(`Failed to start device flow: ${t instanceof Error ? t.message : String(t)}`);
-	}
-}
-async function o(r, a, o) {
-	let c = r.replace(/\/+$/, ""), l = o.timeout ?? t, u = Math.max(1, o.interval) * 1e3, d = Date.now();
-	for (; Date.now() - d < l;) {
-		if (o.signal?.aborted) throw new e("Authorization cancelled", "cancelled");
-		try {
-			let t = await i(c, "POST", "/oauth/device/token", new URLSearchParams({
-				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-				device_code: a
-			}).toString(), "application/x-www-form-urlencoded", o.signal);
-			if (t.ok) {
-				let n = await t.json();
-				if (!n.access_token) throw new e("Invalid token response: missing access_token");
-				return {
-					access_token: n.access_token,
-					token_type: n.token_type ?? "Bearer",
-					expires_in: n.expires_in
-				};
-			}
-			let r;
-			try {
-				r = await t.json();
-			} catch {
-				throw new e(`Unexpected response from server: ${t.status}`);
-			}
-			let { error: s, error_description: l } = r;
-			switch (s) {
-				case "authorization_pending": break;
-				case "slow_down":
-					u = typeof r.interval == "number" && isFinite(r.interval) && r.interval > 0 ? Math.max(1, Math.min(r.interval, 30)) * 1e3 : Math.min(u + 5e3, n);
-					break;
-				case "expired_token": throw new e("Device code has expired. Please try again.", "expired_token");
-				case "access_denied": throw new e("Authorization request was denied.", "access_denied");
-				default: throw new e(`Authorization error: ${s}${l ? ` - ${l}` : ""}`, s);
-			}
-		} catch (t) {
-			if (t instanceof e) throw t;
-			if (t instanceof DOMException && t.name === "AbortError") throw new e("Authorization cancelled", "cancelled");
-			console.warn("Network error during polling, retrying:", t);
-		}
-		try {
-			await s(u, o.signal);
-		} catch (t) {
-			throw t instanceof DOMException && t.name === "AbortError" ? new e("Authorization cancelled", "cancelled") : t;
-		}
-	}
-	throw new e("Timeout waiting for authorization. Please try again.", "timeout");
-}
-function s(e, t) {
-	return new Promise((n, r) => {
-		if (t?.aborted) {
-			r(new DOMException("Aborted", "AbortError"));
-			return;
-		}
-		let i = setTimeout(n, e);
-		t?.addEventListener("abort", () => {
-			clearTimeout(i), r(new DOMException("Aborted", "AbortError"));
-		}, { once: !0 });
+function i(t, r, i) {
+	return e(t, r, {
+		...i,
+		headers: n
 	});
 }
 //#endregion
-export { e as DeviceFlowError, r as isOpenHandsCloudHost, o as pollForToken, a as startDeviceFlow };
+export { i as pollForToken, r as startDeviceFlow };
 
 //# sourceMappingURL=device-flow-client.js.map

package/dist/api/device-flow-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"device-flow-client.js","names":[],"sources":["../../src/api/device-flow-client.ts"],"sourcesContent":["/**\n * OAuth 2.0 Device Flow client implementation (RFC 8628).\n *\n * Used for one-click authentication with cloud backends.\n * The flow allows users to authenticate in their browser while the\n * application polls for the resulting API key.\n *\n * Device flow requests go directly to the configured OpenHands Cloud host.\n */\n\nexport class DeviceFlowError extends Error {\n  constructor(\n    message: string,\n    public readonly code?: string,\n  ) {\n    super(message);\n    this.name = \"DeviceFlowError\";\n  }\n}\n\nexport interface DeviceAuthorizationResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete: string;\n  expires_in: number;\n  interval: number;\n}\n\nexport interface DeviceTokenResponse {\n  access_token: string;\n  token_type: string;\n  expires_in?: number;\n}\n\ninterface DeviceTokenErrorResponse {\n  error: string;\n  error_description?: string;\n  interval?: number;\n}\n\nconst DEFAULT_TIMEOUT_MS = 600_000; // 10 minutes\nconst MAX_INTERVAL_MS = 30_000; // 30 seconds max polling interval\n\n/**\n * Check if a host is a known OpenHands Cloud domain.\n * Uses hostname extraction to prevent substring matching attacks.\n */\nexport function isOpenHandsCloudHost(host: string): boolean {\n  try {\n    // Extract hostname from URL or treat as hostname if no protocol\n    const trimmed = host.trim().toLowerCase();\n    const withProtocol = /^https?:\\/\\//i.test(trimmed)\n      ? trimmed\n      : `https://${trimmed}`;\n    const url = new URL(withProtocol);\n    const hostname = url.hostname;\n\n    // Check if hostname ends with known domains (exact suffix match)\n    return (\n      hostname.endsWith(\".all-hands.dev\") ||\n      hostname === \"all-hands.dev\" ||\n      hostname.endsWith(\".openhands.dev\") ||\n      hostname === \"openhands.dev\"\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Make a direct request to the OpenHands Cloud device-flow endpoint.\n */\nasync function makeCloudRequest(\n  upstreamHost: string,\n  method: \"GET\" | \"POST\",\n  path: string,\n  body?: unknown,\n  contentType?: string,\n  signal?: AbortSignal,\n): Promise<Response> {\n  const requestBody =\n    body === undefined\n      ? undefined\n      : typeof body === \"string\" ||\n          body instanceof Blob ||\n          body instanceof FormData ||\n          body instanceof URLSearchParams\n        ? body\n        : JSON.stringify(body);\n\n  const response = await fetch(`${upstreamHost.replace(/\\/+$/, \"\")}${path}`, {\n    method,\n    headers: {\n      ...(contentType ? { \"Content-Type\": contentType } : {}),\n    },\n    body: requestBody,\n    signal,\n  });\n\n  return response;\n}\n\n/**\n * Start the OAuth 2.0 Device Flow by requesting a device code.\n * Requests are sent directly to the cloud host.\n *\n * @param host - The cloud backend host URL (e.g., \"https://app.all-hands.dev\")\n * @returns DeviceAuthorizationResponse with device_code, user_code, verification URLs, etc.\n * @throws DeviceFlowError if the request fails\n */\nexport async function startDeviceFlow(\n  host: string,\n): Promise<DeviceAuthorizationResponse> {\n  const normalizedHost = host.replace(/\\/+$/, \"\");\n\n  try {\n    const response = await makeCloudRequest(\n      normalizedHost,\n      \"POST\",\n      \"/oauth/device/authorize\",\n      {},\n      \"application/json\",\n    );\n\n    if (!response.ok) {\n      // Avoid exposing sensitive server error details\n      throw new DeviceFlowError(\n        `Failed to start device flow: Server returned ${response.status}`,\n      );\n    }\n\n    const data = await response.json();\n\n    // Validate required fields per RFC 8628 Section 3.2\n    // verification_uri_complete is OPTIONAL per RFC\n    if (!data.device_code || !data.user_code || !data.verification_uri) {\n      throw new DeviceFlowError(\n        \"Invalid response from device authorization endpoint: missing required fields\",\n      );\n    }\n\n    // Build verification_uri_complete if not provided (optional per RFC)\n    const verificationUriComplete =\n      data.verification_uri_complete ??\n      `${data.verification_uri}?user_code=${encodeURIComponent(data.user_code)}`;\n\n    return {\n      device_code: data.device_code,\n      user_code: data.user_code,\n      verification_uri: data.verification_uri,\n      verification_uri_complete: verificationUriComplete,\n      expires_in: data.expires_in ?? 600,\n      interval: data.interval ?? 5,\n    };\n  } catch (error) {\n    if (error instanceof DeviceFlowError) {\n      throw error;\n    }\n    throw new DeviceFlowError(\n      `Failed to start device flow: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n\nexport interface PollOptions {\n  /** Polling interval in seconds (from device authorization response) */\n  interval: number;\n  /** Maximum time to wait for authorization in milliseconds */\n  timeout?: number;\n  /** Abort signal to cancel polling */\n  signal?: AbortSignal;\n}\n\n/**\n * Poll for the API key after user authorization.\n * Requests are sent directly to the cloud host.\n *\n * @param host - The cloud backend host URL\n * @param deviceCode - The device code from startDeviceFlow\n * @param options - Polling options including interval, timeout, and abort signal\n * @returns DeviceTokenResponse containing the access_token (API key)\n * @throws DeviceFlowError if polling fails, user denies access, or timeout expires\n */\nexport async function pollForToken(\n  host: string,\n  deviceCode: string,\n  options: PollOptions,\n): Promise<DeviceTokenResponse> {\n  const normalizedHost = host.replace(/\\/+$/, \"\");\n  const timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;\n  let interval = Math.max(1, options.interval) * 1000; // At least 1 second\n  const startTime = Date.now();\n\n  while (Date.now() - startTime < timeout) {\n    // Check if cancelled\n    if (options.signal?.aborted) {\n      throw new DeviceFlowError(\"Authorization cancelled\", \"cancelled\");\n    }\n\n    try {\n      // RFC 8628 Section 3.4 requires grant_type parameter\n      const tokenRequestBody = new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        device_code: deviceCode,\n      }).toString();\n\n      const response = await makeCloudRequest(\n        normalizedHost,\n        \"POST\",\n        \"/oauth/device/token\",\n        tokenRequestBody,\n        \"application/x-www-form-urlencoded\",\n        options.signal,\n      );\n\n      if (response.ok) {\n        const data = await response.json();\n        if (!data.access_token) {\n          throw new DeviceFlowError(\n            \"Invalid token response: missing access_token\",\n          );\n        }\n        return {\n          access_token: data.access_token,\n          token_type: data.token_type ?? \"Bearer\",\n          expires_in: data.expires_in,\n        };\n      }\n\n      // Handle error responses\n      let errorData: DeviceTokenErrorResponse;\n      try {\n        errorData = await response.json();\n      } catch {\n        throw new DeviceFlowError(\n          `Unexpected response from server: ${response.status}`,\n        );\n      }\n\n      const { error, error_description } = errorData;\n\n      switch (error) {\n        case \"authorization_pending\":\n          // User hasn't finished yet; continue polling\n          break;\n\n        case \"slow_down\":\n          // Server asks us to poll less frequently\n          // RFC 8628 Section 3.5: \"the client MUST increase its polling interval by 5 seconds\"\n          // Validate server-provided interval to prevent DoS (must be number, finite, positive)\n          if (\n            typeof errorData.interval === \"number\" &&\n            isFinite(errorData.interval) &&\n            errorData.interval > 0\n          ) {\n            interval = Math.max(1, Math.min(errorData.interval, 30)) * 1000;\n          } else {\n            // RFC 8628 mandates incrementing by 5 seconds\n            interval = Math.min(interval + 5000, MAX_INTERVAL_MS);\n          }\n          break;\n\n        case \"expired_token\":\n          throw new DeviceFlowError(\n            \"Device code has expired. Please try again.\",\n            \"expired_token\",\n          );\n\n        case \"access_denied\":\n          throw new DeviceFlowError(\n            \"Authorization request was denied.\",\n            \"access_denied\",\n          );\n\n        default:\n          throw new DeviceFlowError(\n            `Authorization error: ${error}${error_description ? ` - ${error_description}` : \"\"}`,\n            error,\n          );\n      }\n    } catch (error) {\n      // DeviceFlowError means a definitive error (denied, expired, etc.) - rethrow\n      if (error instanceof DeviceFlowError) {\n        throw error;\n      }\n      // User cancelled - rethrow\n      if (error instanceof DOMException && error.name === \"AbortError\") {\n        throw new DeviceFlowError(\"Authorization cancelled\", \"cancelled\");\n      }\n      // Network errors during polling should continue until timeout, not fail immediately\n      // Brief network hiccups shouldn't abort 10-minute flows\n      console.warn(\"Network error during polling, retrying:\", error);\n    }\n\n    // Wait before next poll (wrap in try-catch for consistent abort handling)\n    try {\n      await sleep(interval, options.signal);\n    } catch (error) {\n      if (error instanceof DOMException && error.name === \"AbortError\") {\n        throw new DeviceFlowError(\"Authorization cancelled\", \"cancelled\");\n      }\n      throw error;\n    }\n  }\n\n  throw new DeviceFlowError(\n    \"Timeout waiting for authorization. Please try again.\",\n    \"timeout\",\n  );\n}\n\n/**\n * Sleep for a given duration, respecting an optional abort signal.\n */\nfunction sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(new DOMException(\"Aborted\", \"AbortError\"));\n      return;\n    }\n\n    const timeoutId = setTimeout(resolve, ms);\n\n    signal?.addEventListener(\n      \"abort\",\n      () => {\n        clearTimeout(timeoutId);\n        reject(new DOMException(\"Aborted\", \"AbortError\"));\n      },\n      { once: true },\n    );\n  });\n}\n"],"mappings":";AAUA,IAAa,IAAb,cAAqC,MAAM;CACzC,YACE,GACA,GACA;AAEA,EADA,MAAM,EAAQ,EAFE,KAAA,OAAA,GAGhB,KAAK,OAAO;;GAyBV,IAAqB,KACrB,IAAkB;AAMxB,SAAgB,EAAqB,GAAuB;AAC1D,KAAI;EAEF,IAAM,IAAU,EAAK,MAAM,CAAC,aAAa,EACnC,IAAe,gBAAgB,KAAK,EAAQ,GAC9C,IACA,WAAW,KAET,IAAW,IADD,IAAI,EACH,CAAI;AAGrB,SACE,EAAS,SAAS,iBAAiB,IACnC,MAAa,mBACb,EAAS,SAAS,iBAAiB,IACnC,MAAa;SAET;AACN,SAAO;;;AAOX,eAAe,EACb,GACA,GACA,GACA,GACA,GACA,GACmB;CACnB,IAAM,IACJ,MAAS,KAAA,IACL,KAAA,IACA,OAAO,KAAS,YACd,aAAgB,QAChB,aAAgB,YAChB,aAAgB,kBAChB,IACA,KAAK,UAAU,EAAK;AAW5B,QAAO,MATgB,MAAM,GAAG,EAAa,QAAQ,QAAQ,GAAG,GAAG,KAAQ;EACzE;EACA,SAAS,EACP,GAAI,IAAc,EAAE,gBAAgB,GAAa,GAAG,EAAE,EACvD;EACD,MAAM;EACN;EACD,CAAC;;AAaJ,eAAsB,EACpB,GACsC;CACtC,IAAM,IAAiB,EAAK,QAAQ,QAAQ,GAAG;AAE/C,KAAI;EACF,IAAM,IAAW,MAAM,EACrB,GACA,QACA,2BACA,EAAE,EACF,mBACD;AAED,MAAI,CAAC,EAAS,GAEZ,OAAM,IAAI,EACR,gDAAgD,EAAS,SAC1D;EAGH,IAAM,IAAO,MAAM,EAAS,MAAM;AAIlC,MAAI,CAAC,EAAK,eAAe,CAAC,EAAK,aAAa,CAAC,EAAK,iBAChD,OAAM,IAAI,EACR,+EACD;EAIH,IAAM,IACJ,EAAK,6BACL,GAAG,EAAK,iBAAiB,aAAa,mBAAmB,EAAK,UAAU;AAE1E,SAAO;GACL,aAAa,EAAK;GAClB,WAAW,EAAK;GAChB,kBAAkB,EAAK;GACvB,2BAA2B;GAC3B,YAAY,EAAK,cAAc;GAC/B,UAAU,EAAK,YAAY;GAC5B;UACM,GAAO;AAId,QAHI,aAAiB,IACb,IAEF,IAAI,EACR,gCAAgC,aAAiB,QAAQ,EAAM,UAAU,OAAO,EAAM,GACvF;;;AAuBL,eAAsB,EACpB,GACA,GACA,GAC8B;CAC9B,IAAM,IAAiB,EAAK,QAAQ,QAAQ,GAAG,EACzC,IAAU,EAAQ,WAAW,GAC/B,IAAW,KAAK,IAAI,GAAG,EAAQ,SAAS,GAAG,KACzC,IAAY,KAAK,KAAK;AAE5B,QAAO,KAAK,KAAK,GAAG,IAAY,IAAS;AAEvC,MAAI,EAAQ,QAAQ,QAClB,OAAM,IAAI,EAAgB,2BAA2B,YAAY;AAGnE,MAAI;GAOF,IAAM,IAAW,MAAM,EACrB,GACA,QACA,uBARuB,IAAI,gBAAgB;IAC3C,YAAY;IACZ,aAAa;IACd,CAAC,CAAC,UAMD,EACA,qCACA,EAAQ,OACT;AAED,OAAI,EAAS,IAAI;IACf,IAAM,IAAO,MAAM,EAAS,MAAM;AAClC,QAAI,CAAC,EAAK,aACR,OAAM,IAAI,EACR,+CACD;AAEH,WAAO;KACL,cAAc,EAAK;KACnB,YAAY,EAAK,cAAc;KAC/B,YAAY,EAAK;KAClB;;GAIH,IAAI;AACJ,OAAI;AACF,QAAY,MAAM,EAAS,MAAM;WAC3B;AACN,UAAM,IAAI,EACR,oCAAoC,EAAS,SAC9C;;GAGH,IAAM,EAAE,UAAO,yBAAsB;AAErC,WAAQ,GAAR;IACE,KAAK,wBAEH;IAEF,KAAK;AAIH,KAQE,IAPA,OAAO,EAAU,YAAa,YAC9B,SAAS,EAAU,SAAS,IAC5B,EAAU,WAAW,IAEV,KAAK,IAAI,GAAG,KAAK,IAAI,EAAU,UAAU,GAAG,CAAC,GAAG,MAGhD,KAAK,IAAI,IAAW,KAAM,EAAgB;AAEvD;IAEF,KAAK,gBACH,OAAM,IAAI,EACR,8CACA,gBACD;IAEH,KAAK,gBACH,OAAM,IAAI,EACR,qCACA,gBACD;IAEH,QACE,OAAM,IAAI,EACR,wBAAwB,IAAQ,IAAoB,MAAM,MAAsB,MAChF,EACD;;WAEE,GAAO;AAEd,OAAI,aAAiB,EACnB,OAAM;AAGR,OAAI,aAAiB,gBAAgB,EAAM,SAAS,aAClD,OAAM,IAAI,EAAgB,2BAA2B,YAAY;AAInE,WAAQ,KAAK,2CAA2C,EAAM;;AAIhE,MAAI;AACF,SAAM,EAAM,GAAU,EAAQ,OAAO;WAC9B,GAAO;AAId,SAHI,aAAiB,gBAAgB,EAAM,SAAS,eAC5C,IAAI,EAAgB,2BAA2B,YAAY,GAE7D;;;AAIV,OAAM,IAAI,EACR,wDACA,UACD;;AAMH,SAAS,EAAM,GAAY,GAAqC;AAC9D,QAAO,IAAI,SAAS,GAAS,MAAW;AACtC,MAAI,GAAQ,SAAS;AACnB,KAAO,IAAI,aAAa,WAAW,aAAa,CAAC;AACjD;;EAGF,IAAM,IAAY,WAAW,GAAS,EAAG;AAEzC,KAAQ,iBACN,eACM;AAEJ,GADA,aAAa,EAAU,EACvB,EAAO,IAAI,aAAa,WAAW,aAAa,CAAC;KAEnD,EAAE,MAAM,IAAM,CACf;GACD"}
+{"version":3,"file":"device-flow-client.js","names":[],"sources":["../../src/api/device-flow-client.ts"],"sourcesContent":["import {\n  pollForToken as sdkPollForToken,\n  startDeviceFlow as sdkStartDeviceFlow,\n} from \"@openhands/typescript-client/client/device-flow-client\";\nimport type {\n  DeviceAuthorizationResponse,\n  DeviceTokenResponse,\n  PollDeviceTokenOptions,\n} from \"@openhands/typescript-client/client/device-flow-client\";\nimport { AGENT_CANVAS_CLIENT_HEADERS } from \"./client-source\";\n\nexport {\n  DeviceFlowError,\n  isOpenHandsCloudHost,\n} from \"@openhands/typescript-client/client/device-flow-client\";\n\nexport function startDeviceFlow(\n  host: string,\n): Promise<DeviceAuthorizationResponse> {\n  return sdkStartDeviceFlow(host, { headers: AGENT_CANVAS_CLIENT_HEADERS });\n}\n\nexport function pollForToken(\n  host: string,\n  deviceCode: string,\n  options: PollDeviceTokenOptions,\n): Promise<DeviceTokenResponse> {\n  return sdkPollForToken(host, deviceCode, {\n    ...options,\n    headers: AGENT_CANVAS_CLIENT_HEADERS,\n  });\n}\n\nexport type {\n  DeviceAuthorizationResponse,\n  DeviceTokenResponse,\n  PollDeviceTokenOptions as PollOptions,\n} from \"@openhands/typescript-client/client/device-flow-client\";\n"],"mappings":";;;AAgBA,SAAgB,EACd,GACsC;AACtC,QAAO,EAAmB,GAAM,EAAE,SAAS,GAA6B,CAAC;;AAG3E,SAAgB,EACd,GACA,GACA,GAC8B;AAC9B,QAAO,EAAgB,GAAM,GAAY;EACvC,GAAG;EACH,SAAS;EACV,CAAC"}

package/dist/api/git-service/agent-server-git-service.api.cjs

@@ -1,2 +1,2 @@
-require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../backend-registry/active-store.cjs`),t=require(`../agent-server-client-options.cjs`),n=require(`../cloud/proxy.cjs`),r=require(`../../node_modules/@openhands/typescript-client/dist/workspace/remote-workspace.cjs`),i=require(`../../utils/git-status-mapper.cjs`);function a(e){return e.startsWith(`/`)?e:`/${e}`}var o=class{static async getGitChanges(o,s,c,l){let u=e.getActiveBackend().backend;if(u.kind===`cloud`&&o){let e=new URLSearchParams;e.set(`path`,a(l));let t=await n.callCloudProxy({backend:u,method:`GET`,path:`/api/v1/app-conversations/${o}/git/changes?${e.toString()}`});if(!Array.isArray(t))throw Error(`Invalid response from runtime - runtime may be unavailable`);return t.map(e=>({status:i.mapAnyGitStatusToClientStatus(String(e.status)),path:e.path}))}let d=await new r.RemoteWorkspace(t.getAgentServerClientOptions({conversationUrl:s,sessionApiKey:c})).gitChanges(l);if(!Array.isArray(d))throw Error(`Invalid response from runtime - runtime may be unavailable`);return d.map(e=>({status:i.mapAnyGitStatusToClientStatus(String(e.status)),path:e.path}))}static async getGitChangeDiff(i,o,s,c){let l=e.getActiveBackend().backend;if(l.kind===`cloud`&&i){let e=new URLSearchParams;e.set(`path`,a(c));let t=await n.callCloudProxy({backend:l,method:`GET`,path:`/api/v1/app-conversations/${i}/git/diff?${e.toString()}`});return{modified:t?.modified??``,original:t?.original??``,...t?.diff?{diff:t.diff}:{}}}let u=await new r.RemoteWorkspace(t.getAgentServerClientOptions({conversationUrl:o,sessionApiKey:s})).gitDiff(c);return{modified:u.modified??``,original:u.original??``,...u.diff?{diff:u.diff}:{}}}};exports.default=o;
+require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../../utils/websocket-url.cjs`),t=require(`../backend-registry/active-store.cjs`),n=require(`../agent-server-client-options.cjs`),r=require(`../agent-server-compatibility.cjs`),i=require(`../../node_modules/axios/index.cjs`),a=require(`../cloud/proxy.cjs`),o=require(`../../node_modules/@openhands/typescript-client/dist/workspace/remote-workspace.cjs`),s=require(`../../utils/git-status-mapper.cjs`);function c(e){return e.startsWith(`/`)?e:`/${e}`}async function l(r,i,s,l){let u=t.getActiveBackend().backend;if(u.kind===`cloud`&&r){let t=new URLSearchParams({...l,path:c(l.path)});return a.callCloudProxy({backend:u,method:`GET`,hostOverride:e.buildHttpBaseUrl(r),path:`${s}?${t.toString()}`,authMode:`session-api-key`,sessionApiKey:i??void 0})}return(await new o.RemoteWorkspace(n.getAgentServerClientOptions({conversationUrl:r,sessionApiKey:i})).client.get(s,{params:l})).data}function u(e){return r.isSdkHttpStatusError(e,404)||i.isAxiosError(e)&&e.response?.status===404}var d=class{static async getGitChanges(e,r,i,l){let u=t.getActiveBackend().backend;if(u.kind===`cloud`&&e){let t=new URLSearchParams;t.set(`path`,c(l));let n=await a.callCloudProxy({backend:u,method:`GET`,path:`/api/v1/app-conversations/${e}/git/changes?${t.toString()}`});if(!Array.isArray(n))throw Error(`Invalid response from runtime - runtime may be unavailable`);return n.map(e=>({status:s.mapAnyGitStatusToClientStatus(String(e.status)),path:e.path}))}let d=await new o.RemoteWorkspace(n.getAgentServerClientOptions({conversationUrl:r,sessionApiKey:i})).gitChanges(l);if(!Array.isArray(d))throw Error(`Invalid response from runtime - runtime may be unavailable`);return d.map(e=>({status:s.mapAnyGitStatusToClientStatus(String(e.status)),path:e.path}))}static async getGitCommits(e,t,n,r=50){try{let i=await l(e,t,`/api/git/commits`,{path:n,limit:String(r)});return{commits:(i?.commits??[]).map(e=>({sha:e.sha,shortSha:e.short_sha,subject:e.subject,author:e.author,timestamp:e.timestamp})),hasMore:!!i?.has_more}}catch(e){if(u(e))return null;throw e}}static async getCommitChanges(e,t,n,r){let i=await l(e,t,`/api/git/commits/${encodeURIComponent(r)}/changes`,{path:n});if(!Array.isArray(i))throw Error(`Invalid response from runtime - runtime may be unavailable`);return i.map(e=>({status:s.mapAnyGitStatusToClientStatus(String(e.status)),path:e.path}))}static async getGitChangeDiff(e,r,i,s,u){if(u){let e=await l(r,i,`/api/git/diff`,{path:s,commit:u});return{modified:e?.modified??``,original:e?.original??``,...e?.diff?{diff:e.diff}:{}}}let d=t.getActiveBackend().backend;if(d.kind===`cloud`&&e){let t=new URLSearchParams;t.set(`path`,c(s));let n=await a.callCloudProxy({backend:d,method:`GET`,path:`/api/v1/app-conversations/${e}/git/diff?${t.toString()}`});return{modified:n?.modified??``,original:n?.original??``,...n?.diff?{diff:n.diff}:{}}}let f=await new o.RemoteWorkspace(n.getAgentServerClientOptions({conversationUrl:r,sessionApiKey:i})).gitDiff(s);return{modified:f.modified??``,original:f.original??``,...f.diff?{diff:f.diff}:{}}}};exports.default=d;
 //# sourceMappingURL=agent-server-git-service.api.cjs.map

package/dist/api/git-service/agent-server-git-service.api.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"agent-server-git-service.api.cjs","names":[],"sources":["../../../src/api/git-service/agent-server-git-service.api.ts"],"sourcesContent":["import { RemoteWorkspace } from \"@openhands/typescript-client/workspace/remote-workspace\";\nimport { mapAnyGitStatusToClientStatus } from \"#/utils/git-status-mapper\";\nimport type { GitChange, GitChangeDiff } from \"../open-hands.types\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport { callCloudProxy } from \"../cloud/proxy\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\n\ninterface AgentServerGitChange {\n  status: string;\n  path: string;\n}\n\n/**\n * Git operations for agent-server conversations.\n *\n * In **local** mode the runtime is reachable directly from the browser\n * (it's `127.0.0.1:18000`); the SDK's `RemoteWorkspace` calls land\n * fine. In **cloud** mode the runtime is at\n * `*.prod-runtime.all-hands.dev`, which doesn't allow CORS from\n * `localhost`. So cloud-mode calls hit the cloud API's\n * `GET /api/v1/app-conversations/{id}/git/{changes,diff}` proxy\n * endpoints instead — the server resolves the conversation's runtime\n * and makes the hop itself with the sandbox's session API key, and the\n * cloud API's CORS is permissive for bearer-token requests.\n */\n\n/**\n * The cloud runtime's `/api/git/{changes,diff}` endpoints prepend\n * `/workspace/` to relative paths (so a relative arg like\n * `workspace/project` becomes `/workspace/workspace/project` and 404s).\n * `getGitPath` returns the local agent-server's relative convention by\n * default; normalize to an absolute path before sending to the cloud\n * runtime.\n */\nfunction toAbsoluteRuntimePath(path: string): string {\n  return path.startsWith(\"/\") ? path : `/${path}`;\n}\n\nclass AgentServerGitService {\n  static async getGitChanges(\n    conversationId: string,\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    path: string,\n  ): Promise<GitChange[]> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\" && conversationId) {\n      const params = new URLSearchParams();\n      params.set(\"path\", toAbsoluteRuntimePath(path));\n      const data = await callCloudProxy<AgentServerGitChange[]>({\n        backend: active,\n        method: \"GET\",\n        path: `/api/v1/app-conversations/${conversationId}/git/changes?${params.toString()}`,\n      });\n      if (!Array.isArray(data)) {\n        throw new Error(\n          \"Invalid response from runtime - runtime may be unavailable\",\n        );\n      }\n      return data.map((change) => ({\n        status: mapAnyGitStatusToClientStatus(\n          String(change.status) as Parameters<\n            typeof mapAnyGitStatusToClientStatus\n          >[0],\n        ),\n        path: change.path,\n      }));\n    }\n\n    // No `ref`: let the server auto-detect the base (origin branch /\n    // merge-base), so changes the agent has already committed still show\n    // up. `ref: \"HEAD\"` would go blank after every `git commit` — and the\n    // cloud-proxy branch above already omits `ref`.\n    const changes = await new RemoteWorkspace(\n      getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n    ).gitChanges(path);\n\n    if (!Array.isArray(changes)) {\n      throw new Error(\n        \"Invalid response from runtime - runtime may be unavailable\",\n      );\n    }\n\n    return changes.map((change) => ({\n      status: mapAnyGitStatusToClientStatus(\n        String(change.status) as Parameters<\n          typeof mapAnyGitStatusToClientStatus\n        >[0],\n      ),\n      path: change.path,\n    }));\n  }\n\n  static async getGitChangeDiff(\n    conversationId: string,\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    path: string,\n  ): Promise<GitChangeDiff> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\" && conversationId) {\n      const params = new URLSearchParams();\n      params.set(\"path\", toAbsoluteRuntimePath(path));\n      const diff = await callCloudProxy<GitChangeDiff & { diff?: string }>({\n        backend: active,\n        method: \"GET\",\n        path: `/api/v1/app-conversations/${conversationId}/git/diff?${params.toString()}`,\n      });\n      return {\n        modified: diff?.modified ?? \"\",\n        original: diff?.original ?? \"\",\n        ...(diff?.diff ? { diff: diff.diff } : {}),\n      } as GitChangeDiff;\n    }\n\n    // No `ref` for the same reason as getGitChanges: the base must match\n    // the one the change list was computed against.\n    const diff = (await new RemoteWorkspace(\n      getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n    ).gitDiff(path)) as GitChangeDiff & { diff?: string };\n\n    return {\n      modified: diff.modified ?? \"\",\n      original: diff.original ?? \"\",\n      ...(diff.diff ? { diff: diff.diff } : {}),\n    } as GitChangeDiff;\n  }\n}\n\nexport default AgentServerGitService;\n"],"mappings":"wUAkCA,SAAS,EAAsB,EAAsB,CACnD,OAAO,EAAK,WAAW,IAAI,CAAG,EAAO,IAAI,IAG3C,IAAM,EAAN,KAA4B,CAC1B,aAAa,cACX,EACA,EACA,EACA,EACsB,CACtB,IAAM,EAAS,EAAA,kBAAkB,CAAC,QAElC,GAAI,EAAO,OAAS,SAAW,EAAgB,CAC7C,IAAM,EAAS,IAAI,gBACnB,EAAO,IAAI,OAAQ,EAAsB,EAAK,CAAC,CAC/C,IAAM,EAAO,MAAM,EAAA,eAAuC,CACxD,QAAS,EACT,OAAQ,MACR,KAAM,6BAA6B,EAAe,eAAe,EAAO,UAAU,GACnF,CAAC,CACF,GAAI,CAAC,MAAM,QAAQ,EAAK,CACtB,MAAU,MACR,6DACD,CAEH,OAAO,EAAK,IAAK,IAAY,CAC3B,OAAQ,EAAA,8BACN,OAAO,EAAO,OAAO,CAGtB,CACD,KAAM,EAAO,KACd,EAAE,CAOL,IAAM,EAAU,MAAM,IAAI,EAAA,gBACxB,EAAA,4BAA4B,CAAE,kBAAiB,gBAAe,CAAC,CAChE,CAAC,WAAW,EAAK,CAElB,GAAI,CAAC,MAAM,QAAQ,EAAQ,CACzB,MAAU,MACR,6DACD,CAGH,OAAO,EAAQ,IAAK,IAAY,CAC9B,OAAQ,EAAA,8BACN,OAAO,EAAO,OAAO,CAGtB,CACD,KAAM,EAAO,KACd,EAAE,CAGL,aAAa,iBACX,EACA,EACA,EACA,EACwB,CACxB,IAAM,EAAS,EAAA,kBAAkB,CAAC,QAElC,GAAI,EAAO,OAAS,SAAW,EAAgB,CAC7C,IAAM,EAAS,IAAI,gBACnB,EAAO,IAAI,OAAQ,EAAsB,EAAK,CAAC,CAC/C,IAAM,EAAO,MAAM,EAAA,eAAkD,CACnE,QAAS,EACT,OAAQ,MACR,KAAM,6BAA6B,EAAe,YAAY,EAAO,UAAU,GAChF,CAAC,CACF,MAAO,CACL,SAAU,GAAM,UAAY,GAC5B,SAAU,GAAM,UAAY,GAC5B,GAAI,GAAM,KAAO,CAAE,KAAM,EAAK,KAAM,CAAG,EAAE,CAC1C,CAKH,IAAM,EAAQ,MAAM,IAAI,EAAA,gBACtB,EAAA,4BAA4B,CAAE,kBAAiB,gBAAe,CAAC,CAChE,CAAC,QAAQ,EAAK,CAEf,MAAO,CACL,SAAU,EAAK,UAAY,GAC3B,SAAU,EAAK,UAAY,GAC3B,GAAI,EAAK,KAAO,CAAE,KAAM,EAAK,KAAM,CAAG,EAAE,CACzC"}
+{"version":3,"file":"agent-server-git-service.api.cjs","names":[],"sources":["../../../src/api/git-service/agent-server-git-service.api.ts"],"sourcesContent":["import { isAxiosError } from \"axios\";\nimport { RemoteWorkspace } from \"@openhands/typescript-client/workspace/remote-workspace\";\nimport { mapAnyGitStatusToClientStatus } from \"#/utils/git-status-mapper\";\nimport { buildHttpBaseUrl } from \"#/utils/websocket-url\";\nimport type {\n  GitChange,\n  GitChangeDiff,\n  GitCommitsPage,\n} from \"../open-hands.types\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport { callCloudProxy } from \"../cloud/proxy\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\nimport { isSdkHttpStatusError } from \"../agent-server-compatibility\";\n\ninterface AgentServerGitChange {\n  status: string;\n  path: string;\n}\n\ninterface AgentServerGitCommit {\n  sha: string;\n  short_sha: string;\n  subject: string;\n  author: string;\n  timestamp: string;\n}\n\ninterface AgentServerGitCommitsPage {\n  commits: AgentServerGitCommit[];\n  has_more: boolean;\n}\n\n/**\n * Git operations for agent-server conversations.\n *\n * In **local** mode the runtime is reachable directly from the browser\n * (it's `127.0.0.1:18000`); the SDK's `RemoteWorkspace` calls land\n * fine. In **cloud** mode the runtime is at\n * `*.prod-runtime.all-hands.dev`, which doesn't allow CORS from\n * `localhost`. So cloud-mode calls hit the cloud API's\n * `GET /api/v1/app-conversations/{id}/git/{changes,diff}` proxy\n * endpoints instead — the server resolves the conversation's runtime\n * and makes the hop itself with the sandbox's session API key, and the\n * cloud API's CORS is permissive for bearer-token requests.\n */\n\n/**\n * The cloud runtime's `/api/git/{changes,diff}` endpoints prepend\n * `/workspace/` to relative paths (so a relative arg like\n * `workspace/project` becomes `/workspace/workspace/project` and 404s).\n * `getGitPath` returns the local agent-server's relative convention by\n * default; normalize to an absolute path before sending to the cloud\n * runtime.\n */\nfunction toAbsoluteRuntimePath(path: string): string {\n  return path.startsWith(\"/\") ? path : `/${path}`;\n}\n\n/**\n * GET an arbitrary runtime git endpoint in both backend modes. Local mode\n * uses the SDK's public `HttpClient` (the typed `gitChanges`/`gitDiff`\n * wrappers don't know the newer endpoints/params, and they re-wrap errors,\n * dropping the `.status` needed for 404 feature-detection). Cloud mode goes\n * through the generic cloud-proxy envelope with the sandbox's session API\n * key — the same hop `executeCommand`/`downloadFile` use — so no dedicated\n * cloud API endpoints are required.\n */\nasync function getFromRuntime<T>(\n  conversationUrl: string | null | undefined,\n  sessionApiKey: string | null | undefined,\n  apiPath: string,\n  params: { path: string } & Record<string, string>,\n): Promise<T> {\n  const active = getActiveBackend().backend;\n\n  if (active.kind === \"cloud\" && conversationUrl) {\n    const search = new URLSearchParams({\n      ...params,\n      path: toAbsoluteRuntimePath(params.path),\n    });\n    return callCloudProxy<T>({\n      backend: active,\n      method: \"GET\",\n      hostOverride: buildHttpBaseUrl(conversationUrl),\n      path: `${apiPath}?${search.toString()}`,\n      authMode: \"session-api-key\",\n      sessionApiKey: sessionApiKey ?? undefined,\n    });\n  }\n\n  const response = await new RemoteWorkspace(\n    getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n  ).client.get<T>(apiPath, { params });\n  return response.data;\n}\n\n/**\n * The commit endpoints are newer than some deployed agent servers. A 404\n * (route absent) means \"server too old\" — callers hide the commits section\n * instead of surfacing an error. Local calls and cloud-proxy calls (via the\n * shared TypeScript client) both throw the SDK's `HttpError`; the axios\n * check is kept as a safety net for axios-shaped errors.\n */\nfunction isEndpointMissingError(error: unknown): boolean {\n  return (\n    isSdkHttpStatusError(error, 404) ||\n    (isAxiosError(error) && error.response?.status === 404)\n  );\n}\n\nclass AgentServerGitService {\n  static async getGitChanges(\n    conversationId: string,\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    path: string,\n  ): Promise<GitChange[]> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\" && conversationId) {\n      const params = new URLSearchParams();\n      params.set(\"path\", toAbsoluteRuntimePath(path));\n      const data = await callCloudProxy<AgentServerGitChange[]>({\n        backend: active,\n        method: \"GET\",\n        path: `/api/v1/app-conversations/${conversationId}/git/changes?${params.toString()}`,\n      });\n      if (!Array.isArray(data)) {\n        throw new Error(\n          \"Invalid response from runtime - runtime may be unavailable\",\n        );\n      }\n      return data.map((change) => ({\n        status: mapAnyGitStatusToClientStatus(\n          String(change.status) as Parameters<\n            typeof mapAnyGitStatusToClientStatus\n          >[0],\n        ),\n        path: change.path,\n      }));\n    }\n\n    // No `ref`: let the server auto-detect the base (origin branch /\n    // merge-base), so changes the agent has already committed still show\n    // up. `ref: \"HEAD\"` would go blank after every `git commit` — and the\n    // cloud-proxy branch above already omits `ref`.\n    const changes = await new RemoteWorkspace(\n      getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n    ).gitChanges(path);\n\n    if (!Array.isArray(changes)) {\n      throw new Error(\n        \"Invalid response from runtime - runtime may be unavailable\",\n      );\n    }\n\n    return changes.map((change) => ({\n      status: mapAnyGitStatusToClientStatus(\n        String(change.status) as Parameters<\n          typeof mapAnyGitStatusToClientStatus\n        >[0],\n      ),\n      path: change.path,\n    }));\n  }\n\n  /**\n   * List the conversation's commits (display-base..HEAD, newest first).\n   * Resolves to `null` when the agent server predates the endpoint (404),\n   * so callers can hide the commits section instead of erroring.\n   */\n  static async getGitCommits(\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    path: string,\n    limit = 50,\n  ): Promise<GitCommitsPage | null> {\n    try {\n      const page = await getFromRuntime<AgentServerGitCommitsPage>(\n        conversationUrl,\n        sessionApiKey,\n        \"/api/git/commits\",\n        { path, limit: String(limit) },\n      );\n      return {\n        commits: (page?.commits ?? []).map((commit) => ({\n          sha: commit.sha,\n          shortSha: commit.short_sha,\n          subject: commit.subject,\n          author: commit.author,\n          timestamp: commit.timestamp,\n        })),\n        hasMore: Boolean(page?.has_more),\n      };\n    } catch (error) {\n      if (isEndpointMissingError(error)) return null;\n      throw error;\n    }\n  }\n\n  /** Files changed by a single commit (vs its first parent). */\n  static async getCommitChanges(\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    path: string,\n    sha: string,\n  ): Promise<GitChange[]> {\n    const changes = await getFromRuntime<AgentServerGitChange[]>(\n      conversationUrl,\n      sessionApiKey,\n      `/api/git/commits/${encodeURIComponent(sha)}/changes`,\n      { path },\n    );\n\n    if (!Array.isArray(changes)) {\n      throw new Error(\n        \"Invalid response from runtime - runtime may be unavailable\",\n      );\n    }\n\n    return changes.map((change) => ({\n      status: mapAnyGitStatusToClientStatus(\n        String(change.status) as Parameters<\n          typeof mapAnyGitStatusToClientStatus\n        >[0],\n      ),\n      path: change.path,\n    }));\n  }\n\n  static async getGitChangeDiff(\n    conversationId: string,\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    path: string,\n    commit?: string,\n  ): Promise<GitChangeDiff> {\n    if (commit) {\n      // Per-commit diff: both sides come from git objects on the server,\n      // so files the commit deleted still render.\n      const commitDiff = await getFromRuntime<\n        GitChangeDiff & { diff?: string }\n      >(conversationUrl, sessionApiKey, \"/api/git/diff\", { path, commit });\n      return {\n        modified: commitDiff?.modified ?? \"\",\n        original: commitDiff?.original ?? \"\",\n        ...(commitDiff?.diff ? { diff: commitDiff.diff } : {}),\n      } as GitChangeDiff;\n    }\n\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\" && conversationId) {\n      const params = new URLSearchParams();\n      params.set(\"path\", toAbsoluteRuntimePath(path));\n      const diff = await callCloudProxy<GitChangeDiff & { diff?: string }>({\n        backend: active,\n        method: \"GET\",\n        path: `/api/v1/app-conversations/${conversationId}/git/diff?${params.toString()}`,\n      });\n      return {\n        modified: diff?.modified ?? \"\",\n        original: diff?.original ?? \"\",\n        ...(diff?.diff ? { diff: diff.diff } : {}),\n      } as GitChangeDiff;\n    }\n\n    // No `ref` for the same reason as getGitChanges: the base must match\n    // the one the change list was computed against.\n    const diff = (await new RemoteWorkspace(\n      getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n    ).gitDiff(path)) as GitChangeDiff & { diff?: string };\n\n    return {\n      modified: diff.modified ?? \"\",\n      original: diff.original ?? \"\",\n      ...(diff.diff ? { diff: diff.diff } : {}),\n    } as GitChangeDiff;\n  }\n}\n\nexport default AgentServerGitService;\n"],"mappings":"kdAsDA,SAAS,EAAsB,EAAsB,CACnD,OAAO,EAAK,WAAW,IAAI,CAAG,EAAO,IAAI,IAY3C,eAAe,EACb,EACA,EACA,EACA,EACY,CACZ,IAAM,EAAS,EAAA,kBAAkB,CAAC,QAElC,GAAI,EAAO,OAAS,SAAW,EAAiB,CAC9C,IAAM,EAAS,IAAI,gBAAgB,CACjC,GAAG,EACH,KAAM,EAAsB,EAAO,KAAK,CACzC,CAAC,CACF,OAAO,EAAA,eAAkB,CACvB,QAAS,EACT,OAAQ,MACR,aAAc,EAAA,iBAAiB,EAAgB,CAC/C,KAAM,GAAG,EAAQ,GAAG,EAAO,UAAU,GACrC,SAAU,kBACV,cAAe,GAAiB,IAAA,GACjC,CAAC,CAMJ,OAAO,MAHgB,IAAI,EAAA,gBACzB,EAAA,4BAA4B,CAAE,kBAAiB,gBAAe,CAAC,CAChE,CAAC,OAAO,IAAO,EAAS,CAAE,SAAQ,CAAC,EACpB,KAUlB,SAAS,EAAuB,EAAyB,CACvD,OACE,EAAA,qBAAqB,EAAO,IAAI,EAC/B,EAAA,aAAa,EAAM,EAAI,EAAM,UAAU,SAAW,IAIvD,IAAM,EAAN,KAA4B,CAC1B,aAAa,cACX,EACA,EACA,EACA,EACsB,CACtB,IAAM,EAAS,EAAA,kBAAkB,CAAC,QAElC,GAAI,EAAO,OAAS,SAAW,EAAgB,CAC7C,IAAM,EAAS,IAAI,gBACnB,EAAO,IAAI,OAAQ,EAAsB,EAAK,CAAC,CAC/C,IAAM,EAAO,MAAM,EAAA,eAAuC,CACxD,QAAS,EACT,OAAQ,MACR,KAAM,6BAA6B,EAAe,eAAe,EAAO,UAAU,GACnF,CAAC,CACF,GAAI,CAAC,MAAM,QAAQ,EAAK,CACtB,MAAU,MACR,6DACD,CAEH,OAAO,EAAK,IAAK,IAAY,CAC3B,OAAQ,EAAA,8BACN,OAAO,EAAO,OAAO,CAGtB,CACD,KAAM,EAAO,KACd,EAAE,CAOL,IAAM,EAAU,MAAM,IAAI,EAAA,gBACxB,EAAA,4BAA4B,CAAE,kBAAiB,gBAAe,CAAC,CAChE,CAAC,WAAW,EAAK,CAElB,GAAI,CAAC,MAAM,QAAQ,EAAQ,CACzB,MAAU,MACR,6DACD,CAGH,OAAO,EAAQ,IAAK,IAAY,CAC9B,OAAQ,EAAA,8BACN,OAAO,EAAO,OAAO,CAGtB,CACD,KAAM,EAAO,KACd,EAAE,CAQL,aAAa,cACX,EACA,EACA,EACA,EAAQ,GACwB,CAChC,GAAI,CACF,IAAM,EAAO,MAAM,EACjB,EACA,EACA,mBACA,CAAE,OAAM,MAAO,OAAO,EAAM,CAAE,CAC/B,CACD,MAAO,CACL,SAAU,GAAM,SAAW,EAAE,EAAE,IAAK,IAAY,CAC9C,IAAK,EAAO,IACZ,SAAU,EAAO,UACjB,QAAS,EAAO,QAChB,OAAQ,EAAO,OACf,UAAW,EAAO,UACnB,EAAE,CACH,QAAS,EAAQ,GAAM,SACxB,OACM,EAAO,CACd,GAAI,EAAuB,EAAM,CAAE,OAAO,KAC1C,MAAM,GAKV,aAAa,iBACX,EACA,EACA,EACA,EACsB,CACtB,IAAM,EAAU,MAAM,EACpB,EACA,EACA,oBAAoB,mBAAmB,EAAI,CAAC,UAC5C,CAAE,OAAM,CACT,CAED,GAAI,CAAC,MAAM,QAAQ,EAAQ,CACzB,MAAU,MACR,6DACD,CAGH,OAAO,EAAQ,IAAK,IAAY,CAC9B,OAAQ,EAAA,8BACN,OAAO,EAAO,OAAO,CAGtB,CACD,KAAM,EAAO,KACd,EAAE,CAGL,aAAa,iBACX,EACA,EACA,EACA,EACA,EACwB,CACxB,GAAI,EAAQ,CAGV,IAAM,EAAa,MAAM,EAEvB,EAAiB,EAAe,gBAAiB,CAAE,OAAM,SAAQ,CAAC,CACpE,MAAO,CACL,SAAU,GAAY,UAAY,GAClC,SAAU,GAAY,UAAY,GAClC,GAAI,GAAY,KAAO,CAAE,KAAM,EAAW,KAAM,CAAG,EAAE,CACtD,CAGH,IAAM,EAAS,EAAA,kBAAkB,CAAC,QAElC,GAAI,EAAO,OAAS,SAAW,EAAgB,CAC7C,IAAM,EAAS,IAAI,gBACnB,EAAO,IAAI,OAAQ,EAAsB,EAAK,CAAC,CAC/C,IAAM,EAAO,MAAM,EAAA,eAAkD,CACnE,QAAS,EACT,OAAQ,MACR,KAAM,6BAA6B,EAAe,YAAY,EAAO,UAAU,GAChF,CAAC,CACF,MAAO,CACL,SAAU,GAAM,UAAY,GAC5B,SAAU,GAAM,UAAY,GAC5B,GAAI,GAAM,KAAO,CAAE,KAAM,EAAK,KAAM,CAAG,EAAE,CAC1C,CAKH,IAAM,EAAQ,MAAM,IAAI,EAAA,gBACtB,EAAA,4BAA4B,CAAE,kBAAiB,gBAAe,CAAC,CAChE,CAAC,QAAQ,EAAK,CAEf,MAAO,CACL,SAAU,EAAK,UAAY,GAC3B,SAAU,EAAK,UAAY,GAC3B,GAAI,EAAK,KAAO,CAAE,KAAM,EAAK,KAAM,CAAG,EAAE,CACzC"}

package/dist/api/git-service/agent-server-git-service.api.d.ts

@@ -1,6 +1,14 @@
-import type { GitChange, GitChangeDiff } from "../open-hands.types";
+import type { GitChange, GitChangeDiff, GitCommitsPage } from "../open-hands.types";
 declare class AgentServerGitService {
     static getGitChanges(conversationId: string, conversationUrl: string | null | undefined, sessionApiKey: string | null | undefined, path: string): Promise<GitChange[]>;
-    static getGitChangeDiff(conversationId: string, conversationUrl: string | null | undefined, sessionApiKey: string | null | undefined, path: string): Promise<GitChangeDiff>;
+    /**
+     * List the conversation's commits (display-base..HEAD, newest first).
+     * Resolves to `null` when the agent server predates the endpoint (404),
+     * so callers can hide the commits section instead of erroring.
+     */
+    static getGitCommits(conversationUrl: string | null | undefined, sessionApiKey: string | null | undefined, path: string, limit?: number): Promise<GitCommitsPage | null>;
+    /** Files changed by a single commit (vs its first parent). */
+    static getCommitChanges(conversationUrl: string | null | undefined, sessionApiKey: string | null | undefined, path: string, sha: string): Promise<GitChange[]>;
+    static getGitChangeDiff(conversationId: string, conversationUrl: string | null | undefined, sessionApiKey: string | null | undefined, path: string, commit?: string): Promise<GitChangeDiff>;
 }
 export default AgentServerGitService;

package/dist/api/git-service/agent-server-git-service.api.js

@@ -1,67 +1,134 @@
-import { getActiveBackend as e } from "../backend-registry/active-store.js";
-import { getAgentServerClientOptions as t } from "../agent-server-client-options.js";
-import { callCloudProxy as n } from "../cloud/proxy.js";
-import { RemoteWorkspace as r } from "../../node_modules/@openhands/typescript-client/dist/workspace/remote-workspace.js";
-import { mapAnyGitStatusToClientStatus as i } from "../../utils/git-status-mapper.js";
+import { buildHttpBaseUrl as e } from "../../utils/websocket-url.js";
+import { getActiveBackend as t } from "../backend-registry/active-store.js";
+import { getAgentServerClientOptions as n } from "../agent-server-client-options.js";
+import { isSdkHttpStatusError as r } from "../agent-server-compatibility.js";
+import { isAxiosError as i } from "../../node_modules/axios/index.js";
+import { callCloudProxy as a } from "../cloud/proxy.js";
+import { RemoteWorkspace as o } from "../../node_modules/@openhands/typescript-client/dist/workspace/remote-workspace.js";
+import { mapAnyGitStatusToClientStatus as s } from "../../utils/git-status-mapper.js";
 //#region src/api/git-service/agent-server-git-service.api.ts
-function a(e) {
+function c(e) {
 	return e.startsWith("/") ? e : `/${e}`;
 }
-var o = class {
-	static async getGitChanges(o, s, c, l) {
-		let u = e().backend;
-		if (u.kind === "cloud" && o) {
-			let e = new URLSearchParams();
-			e.set("path", a(l));
-			let t = await n({
+async function l(r, i, s, l) {
+	let u = t().backend;
+	if (u.kind === "cloud" && r) {
+		let t = new URLSearchParams({
+			...l,
+			path: c(l.path)
+		});
+		return a({
+			backend: u,
+			method: "GET",
+			hostOverride: e(r),
+			path: `${s}?${t.toString()}`,
+			authMode: "session-api-key",
+			sessionApiKey: i ?? void 0
+		});
+	}
+	return (await new o(n({
+		conversationUrl: r,
+		sessionApiKey: i
+	})).client.get(s, { params: l })).data;
+}
+function u(e) {
+	return r(e, 404) || i(e) && e.response?.status === 404;
+}
+var d = class {
+	static async getGitChanges(e, r, i, l) {
+		let u = t().backend;
+		if (u.kind === "cloud" && e) {
+			let t = new URLSearchParams();
+			t.set("path", c(l));
+			let n = await a({
 				backend: u,
 				method: "GET",
-				path: `/api/v1/app-conversations/${o}/git/changes?${e.toString()}`
+				path: `/api/v1/app-conversations/${e}/git/changes?${t.toString()}`
 			});
-			if (!Array.isArray(t)) throw Error("Invalid response from runtime - runtime may be unavailable");
-			return t.map((e) => ({
-				status: i(String(e.status)),
+			if (!Array.isArray(n)) throw Error("Invalid response from runtime - runtime may be unavailable");
+			return n.map((e) => ({
+				status: s(String(e.status)),
 				path: e.path
 			}));
 		}
-		let d = await new r(t({
-			conversationUrl: s,
-			sessionApiKey: c
+		let d = await new o(n({
+			conversationUrl: r,
+			sessionApiKey: i
 		})).gitChanges(l);
 		if (!Array.isArray(d)) throw Error("Invalid response from runtime - runtime may be unavailable");
 		return d.map((e) => ({
-			status: i(String(e.status)),
+			status: s(String(e.status)),
 			path: e.path
 		}));
 	}
-	static async getGitChangeDiff(i, o, s, c) {
-		let l = e().backend;
-		if (l.kind === "cloud" && i) {
-			let e = new URLSearchParams();
-			e.set("path", a(c));
-			let t = await n({
-				backend: l,
+	static async getGitCommits(e, t, n, r = 50) {
+		try {
+			let i = await l(e, t, "/api/git/commits", {
+				path: n,
+				limit: String(r)
+			});
+			return {
+				commits: (i?.commits ?? []).map((e) => ({
+					sha: e.sha,
+					shortSha: e.short_sha,
+					subject: e.subject,
+					author: e.author,
+					timestamp: e.timestamp
+				})),
+				hasMore: !!i?.has_more
+			};
+		} catch (e) {
+			if (u(e)) return null;
+			throw e;
+		}
+	}
+	static async getCommitChanges(e, t, n, r) {
+		let i = await l(e, t, `/api/git/commits/${encodeURIComponent(r)}/changes`, { path: n });
+		if (!Array.isArray(i)) throw Error("Invalid response from runtime - runtime may be unavailable");
+		return i.map((e) => ({
+			status: s(String(e.status)),
+			path: e.path
+		}));
+	}
+	static async getGitChangeDiff(e, r, i, s, u) {
+		if (u) {
+			let e = await l(r, i, "/api/git/diff", {
+				path: s,
+				commit: u
+			});
+			return {
+				modified: e?.modified ?? "",
+				original: e?.original ?? "",
+				...e?.diff ? { diff: e.diff } : {}
+			};
+		}
+		let d = t().backend;
+		if (d.kind === "cloud" && e) {
+			let t = new URLSearchParams();
+			t.set("path", c(s));
+			let n = await a({
+				backend: d,
 				method: "GET",
-				path: `/api/v1/app-conversations/${i}/git/diff?${e.toString()}`
+				path: `/api/v1/app-conversations/${e}/git/diff?${t.toString()}`
 			});
 			return {
-				modified: t?.modified ?? "",
-				original: t?.original ?? "",
-				...t?.diff ? { diff: t.diff } : {}
+				modified: n?.modified ?? "",
+				original: n?.original ?? "",
+				...n?.diff ? { diff: n.diff } : {}
 			};
 		}
-		let u = await new r(t({
-			conversationUrl: o,
-			sessionApiKey: s
-		})).gitDiff(c);
+		let f = await new o(n({
+			conversationUrl: r,
+			sessionApiKey: i
+		})).gitDiff(s);
 		return {
-			modified: u.modified ?? "",
-			original: u.original ?? "",
-			...u.diff ? { diff: u.diff } : {}
+			modified: f.modified ?? "",
+			original: f.original ?? "",
+			...f.diff ? { diff: f.diff } : {}
 		};
 	}
 };
 //#endregion
-export { o as default };
+export { d as default };
 
 //# sourceMappingURL=agent-server-git-service.api.js.map

package/dist/api/git-service/agent-server-git-service.api.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-server-git-service.api.js","names":[],"sources":["../../../src/api/git-service/agent-server-git-service.api.ts"],"sourcesContent":["import { RemoteWorkspace } from \"@openhands/typescript-client/workspace/remote-workspace\";\nimport { mapAnyGitStatusToClientStatus } from \"#/utils/git-status-mapper\";\nimport type { GitChange, GitChangeDiff } from \"../open-hands.types\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport { callCloudProxy } from \"../cloud/proxy\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\n\ninterface AgentServerGitChange {\n  status: string;\n  path: string;\n}\n\n/**\n * Git operations for agent-server conversations.\n *\n * In **local** mode the runtime is reachable directly from the browser\n * (it's `127.0.0.1:18000`); the SDK's `RemoteWorkspace` calls land\n * fine. In **cloud** mode the runtime is at\n * `*.prod-runtime.all-hands.dev`, which doesn't allow CORS from\n * `localhost`. So cloud-mode calls hit the cloud API's\n * `GET /api/v1/app-conversations/{id}/git/{changes,diff}` proxy\n * endpoints instead — the server resolves the conversation's runtime\n * and makes the hop itself with the sandbox's session API key, and the\n * cloud API's CORS is permissive for bearer-token requests.\n */\n\n/**\n * The cloud runtime's `/api/git/{changes,diff}` endpoints prepend\n * `/workspace/` to relative paths (so a relative arg like\n * `workspace/project` becomes `/workspace/workspace/project` and 404s).\n * `getGitPath` returns the local agent-server's relative convention by\n * default; normalize to an absolute path before sending to the cloud\n * runtime.\n */\nfunction toAbsoluteRuntimePath(path: string): string {\n  return path.startsWith(\"/\") ? path : `/${path}`;\n}\n\nclass AgentServerGitService {\n  static async getGitChanges(\n    conversationId: string,\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    path: string,\n  ): Promise<GitChange[]> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\" && conversationId) {\n      const params = new URLSearchParams();\n      params.set(\"path\", toAbsoluteRuntimePath(path));\n      const data = await callCloudProxy<AgentServerGitChange[]>({\n        backend: active,\n        method: \"GET\",\n        path: `/api/v1/app-conversations/${conversationId}/git/changes?${params.toString()}`,\n      });\n      if (!Array.isArray(data)) {\n        throw new Error(\n          \"Invalid response from runtime - runtime may be unavailable\",\n        );\n      }\n      return data.map((change) => ({\n        status: mapAnyGitStatusToClientStatus(\n          String(change.status) as Parameters<\n            typeof mapAnyGitStatusToClientStatus\n          >[0],\n        ),\n        path: change.path,\n      }));\n    }\n\n    // No `ref`: let the server auto-detect the base (origin branch /\n    // merge-base), so changes the agent has already committed still show\n    // up. `ref: \"HEAD\"` would go blank after every `git commit` — and the\n    // cloud-proxy branch above already omits `ref`.\n    const changes = await new RemoteWorkspace(\n      getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n    ).gitChanges(path);\n\n    if (!Array.isArray(changes)) {\n      throw new Error(\n        \"Invalid response from runtime - runtime may be unavailable\",\n      );\n    }\n\n    return changes.map((change) => ({\n      status: mapAnyGitStatusToClientStatus(\n        String(change.status) as Parameters<\n          typeof mapAnyGitStatusToClientStatus\n        >[0],\n      ),\n      path: change.path,\n    }));\n  }\n\n  static async getGitChangeDiff(\n    conversationId: string,\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    path: string,\n  ): Promise<GitChangeDiff> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\" && conversationId) {\n      const params = new URLSearchParams();\n      params.set(\"path\", toAbsoluteRuntimePath(path));\n      const diff = await callCloudProxy<GitChangeDiff & { diff?: string }>({\n        backend: active,\n        method: \"GET\",\n        path: `/api/v1/app-conversations/${conversationId}/git/diff?${params.toString()}`,\n      });\n      return {\n        modified: diff?.modified ?? \"\",\n        original: diff?.original ?? \"\",\n        ...(diff?.diff ? { diff: diff.diff } : {}),\n      } as GitChangeDiff;\n    }\n\n    // No `ref` for the same reason as getGitChanges: the base must match\n    // the one the change list was computed against.\n    const diff = (await new RemoteWorkspace(\n      getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n    ).gitDiff(path)) as GitChangeDiff & { diff?: string };\n\n    return {\n      modified: diff.modified ?? \"\",\n      original: diff.original ?? \"\",\n      ...(diff.diff ? { diff: diff.diff } : {}),\n    } as GitChangeDiff;\n  }\n}\n\nexport default AgentServerGitService;\n"],"mappings":";;;;;;AAkCA,SAAS,EAAsB,GAAsB;AACnD,QAAO,EAAK,WAAW,IAAI,GAAG,IAAO,IAAI;;AAG3C,IAAM,IAAN,MAA4B;CAC1B,aAAa,cACX,GACA,GACA,GACA,GACsB;EACtB,IAAM,IAAS,GAAkB,CAAC;AAElC,MAAI,EAAO,SAAS,WAAW,GAAgB;GAC7C,IAAM,IAAS,IAAI,iBAAiB;AACpC,KAAO,IAAI,QAAQ,EAAsB,EAAK,CAAC;GAC/C,IAAM,IAAO,MAAM,EAAuC;IACxD,SAAS;IACT,QAAQ;IACR,MAAM,6BAA6B,EAAe,eAAe,EAAO,UAAU;IACnF,CAAC;AACF,OAAI,CAAC,MAAM,QAAQ,EAAK,CACtB,OAAU,MACR,6DACD;AAEH,UAAO,EAAK,KAAK,OAAY;IAC3B,QAAQ,EACN,OAAO,EAAO,OAAO,CAGtB;IACD,MAAM,EAAO;IACd,EAAE;;EAOL,IAAM,IAAU,MAAM,IAAI,EACxB,EAA4B;GAAE;GAAiB;GAAe,CAAC,CAChE,CAAC,WAAW,EAAK;AAElB,MAAI,CAAC,MAAM,QAAQ,EAAQ,CACzB,OAAU,MACR,6DACD;AAGH,SAAO,EAAQ,KAAK,OAAY;GAC9B,QAAQ,EACN,OAAO,EAAO,OAAO,CAGtB;GACD,MAAM,EAAO;GACd,EAAE;;CAGL,aAAa,iBACX,GACA,GACA,GACA,GACwB;EACxB,IAAM,IAAS,GAAkB,CAAC;AAElC,MAAI,EAAO,SAAS,WAAW,GAAgB;GAC7C,IAAM,IAAS,IAAI,iBAAiB;AACpC,KAAO,IAAI,QAAQ,EAAsB,EAAK,CAAC;GAC/C,IAAM,IAAO,MAAM,EAAkD;IACnE,SAAS;IACT,QAAQ;IACR,MAAM,6BAA6B,EAAe,YAAY,EAAO,UAAU;IAChF,CAAC;AACF,UAAO;IACL,UAAU,GAAM,YAAY;IAC5B,UAAU,GAAM,YAAY;IAC5B,GAAI,GAAM,OAAO,EAAE,MAAM,EAAK,MAAM,GAAG,EAAE;IAC1C;;EAKH,IAAM,IAAQ,MAAM,IAAI,EACtB,EAA4B;GAAE;GAAiB;GAAe,CAAC,CAChE,CAAC,QAAQ,EAAK;AAEf,SAAO;GACL,UAAU,EAAK,YAAY;GAC3B,UAAU,EAAK,YAAY;GAC3B,GAAI,EAAK,OAAO,EAAE,MAAM,EAAK,MAAM,GAAG,EAAE;GACzC"}
+{"version":3,"file":"agent-server-git-service.api.js","names":[],"sources":["../../../src/api/git-service/agent-server-git-service.api.ts"],"sourcesContent":["import { isAxiosError } from \"axios\";\nimport { RemoteWorkspace } from \"@openhands/typescript-client/workspace/remote-workspace\";\nimport { mapAnyGitStatusToClientStatus } from \"#/utils/git-status-mapper\";\nimport { buildHttpBaseUrl } from \"#/utils/websocket-url\";\nimport type {\n  GitChange,\n  GitChangeDiff,\n  GitCommitsPage,\n} from \"../open-hands.types\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport { callCloudProxy } from \"../cloud/proxy\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\nimport { isSdkHttpStatusError } from \"../agent-server-compatibility\";\n\ninterface AgentServerGitChange {\n  status: string;\n  path: string;\n}\n\ninterface AgentServerGitCommit {\n  sha: string;\n  short_sha: string;\n  subject: string;\n  author: string;\n  timestamp: string;\n}\n\ninterface AgentServerGitCommitsPage {\n  commits: AgentServerGitCommit[];\n  has_more: boolean;\n}\n\n/**\n * Git operations for agent-server conversations.\n *\n * In **local** mode the runtime is reachable directly from the browser\n * (it's `127.0.0.1:18000`); the SDK's `RemoteWorkspace` calls land\n * fine. In **cloud** mode the runtime is at\n * `*.prod-runtime.all-hands.dev`, which doesn't allow CORS from\n * `localhost`. So cloud-mode calls hit the cloud API's\n * `GET /api/v1/app-conversations/{id}/git/{changes,diff}` proxy\n * endpoints instead — the server resolves the conversation's runtime\n * and makes the hop itself with the sandbox's session API key, and the\n * cloud API's CORS is permissive for bearer-token requests.\n */\n\n/**\n * The cloud runtime's `/api/git/{changes,diff}` endpoints prepend\n * `/workspace/` to relative paths (so a relative arg like\n * `workspace/project` becomes `/workspace/workspace/project` and 404s).\n * `getGitPath` returns the local agent-server's relative convention by\n * default; normalize to an absolute path before sending to the cloud\n * runtime.\n */\nfunction toAbsoluteRuntimePath(path: string): string {\n  return path.startsWith(\"/\") ? path : `/${path}`;\n}\n\n/**\n * GET an arbitrary runtime git endpoint in both backend modes. Local mode\n * uses the SDK's public `HttpClient` (the typed `gitChanges`/`gitDiff`\n * wrappers don't know the newer endpoints/params, and they re-wrap errors,\n * dropping the `.status` needed for 404 feature-detection). Cloud mode goes\n * through the generic cloud-proxy envelope with the sandbox's session API\n * key — the same hop `executeCommand`/`downloadFile` use — so no dedicated\n * cloud API endpoints are required.\n */\nasync function getFromRuntime<T>(\n  conversationUrl: string | null | undefined,\n  sessionApiKey: string | null | undefined,\n  apiPath: string,\n  params: { path: string } & Record<string, string>,\n): Promise<T> {\n  const active = getActiveBackend().backend;\n\n  if (active.kind === \"cloud\" && conversationUrl) {\n    const search = new URLSearchParams({\n      ...params,\n      path: toAbsoluteRuntimePath(params.path),\n    });\n    return callCloudProxy<T>({\n      backend: active,\n      method: \"GET\",\n      hostOverride: buildHttpBaseUrl(conversationUrl),\n      path: `${apiPath}?${search.toString()}`,\n      authMode: \"session-api-key\",\n      sessionApiKey: sessionApiKey ?? undefined,\n    });\n  }\n\n  const response = await new RemoteWorkspace(\n    getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n  ).client.get<T>(apiPath, { params });\n  return response.data;\n}\n\n/**\n * The commit endpoints are newer than some deployed agent servers. A 404\n * (route absent) means \"server too old\" — callers hide the commits section\n * instead of surfacing an error. Local calls and cloud-proxy calls (via the\n * shared TypeScript client) both throw the SDK's `HttpError`; the axios\n * check is kept as a safety net for axios-shaped errors.\n */\nfunction isEndpointMissingError(error: unknown): boolean {\n  return (\n    isSdkHttpStatusError(error, 404) ||\n    (isAxiosError(error) && error.response?.status === 404)\n  );\n}\n\nclass AgentServerGitService {\n  static async getGitChanges(\n    conversationId: string,\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    path: string,\n  ): Promise<GitChange[]> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\" && conversationId) {\n      const params = new URLSearchParams();\n      params.set(\"path\", toAbsoluteRuntimePath(path));\n      const data = await callCloudProxy<AgentServerGitChange[]>({\n        backend: active,\n        method: \"GET\",\n        path: `/api/v1/app-conversations/${conversationId}/git/changes?${params.toString()}`,\n      });\n      if (!Array.isArray(data)) {\n        throw new Error(\n          \"Invalid response from runtime - runtime may be unavailable\",\n        );\n      }\n      return data.map((change) => ({\n        status: mapAnyGitStatusToClientStatus(\n          String(change.status) as Parameters<\n            typeof mapAnyGitStatusToClientStatus\n          >[0],\n        ),\n        path: change.path,\n      }));\n    }\n\n    // No `ref`: let the server auto-detect the base (origin branch /\n    // merge-base), so changes the agent has already committed still show\n    // up. `ref: \"HEAD\"` would go blank after every `git commit` — and the\n    // cloud-proxy branch above already omits `ref`.\n    const changes = await new RemoteWorkspace(\n      getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n    ).gitChanges(path);\n\n    if (!Array.isArray(changes)) {\n      throw new Error(\n        \"Invalid response from runtime - runtime may be unavailable\",\n      );\n    }\n\n    return changes.map((change) => ({\n      status: mapAnyGitStatusToClientStatus(\n        String(change.status) as Parameters<\n          typeof mapAnyGitStatusToClientStatus\n        >[0],\n      ),\n      path: change.path,\n    }));\n  }\n\n  /**\n   * List the conversation's commits (display-base..HEAD, newest first).\n   * Resolves to `null` when the agent server predates the endpoint (404),\n   * so callers can hide the commits section instead of erroring.\n   */\n  static async getGitCommits(\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    path: string,\n    limit = 50,\n  ): Promise<GitCommitsPage | null> {\n    try {\n      const page = await getFromRuntime<AgentServerGitCommitsPage>(\n        conversationUrl,\n        sessionApiKey,\n        \"/api/git/commits\",\n        { path, limit: String(limit) },\n      );\n      return {\n        commits: (page?.commits ?? []).map((commit) => ({\n          sha: commit.sha,\n          shortSha: commit.short_sha,\n          subject: commit.subject,\n          author: commit.author,\n          timestamp: commit.timestamp,\n        })),\n        hasMore: Boolean(page?.has_more),\n      };\n    } catch (error) {\n      if (isEndpointMissingError(error)) return null;\n      throw error;\n    }\n  }\n\n  /** Files changed by a single commit (vs its first parent). */\n  static async getCommitChanges(\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    path: string,\n    sha: string,\n  ): Promise<GitChange[]> {\n    const changes = await getFromRuntime<AgentServerGitChange[]>(\n      conversationUrl,\n      sessionApiKey,\n      `/api/git/commits/${encodeURIComponent(sha)}/changes`,\n      { path },\n    );\n\n    if (!Array.isArray(changes)) {\n      throw new Error(\n        \"Invalid response from runtime - runtime may be unavailable\",\n      );\n    }\n\n    return changes.map((change) => ({\n      status: mapAnyGitStatusToClientStatus(\n        String(change.status) as Parameters<\n          typeof mapAnyGitStatusToClientStatus\n        >[0],\n      ),\n      path: change.path,\n    }));\n  }\n\n  static async getGitChangeDiff(\n    conversationId: string,\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    path: string,\n    commit?: string,\n  ): Promise<GitChangeDiff> {\n    if (commit) {\n      // Per-commit diff: both sides come from git objects on the server,\n      // so files the commit deleted still render.\n      const commitDiff = await getFromRuntime<\n        GitChangeDiff & { diff?: string }\n      >(conversationUrl, sessionApiKey, \"/api/git/diff\", { path, commit });\n      return {\n        modified: commitDiff?.modified ?? \"\",\n        original: commitDiff?.original ?? \"\",\n        ...(commitDiff?.diff ? { diff: commitDiff.diff } : {}),\n      } as GitChangeDiff;\n    }\n\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\" && conversationId) {\n      const params = new URLSearchParams();\n      params.set(\"path\", toAbsoluteRuntimePath(path));\n      const diff = await callCloudProxy<GitChangeDiff & { diff?: string }>({\n        backend: active,\n        method: \"GET\",\n        path: `/api/v1/app-conversations/${conversationId}/git/diff?${params.toString()}`,\n      });\n      return {\n        modified: diff?.modified ?? \"\",\n        original: diff?.original ?? \"\",\n        ...(diff?.diff ? { diff: diff.diff } : {}),\n      } as GitChangeDiff;\n    }\n\n    // No `ref` for the same reason as getGitChanges: the base must match\n    // the one the change list was computed against.\n    const diff = (await new RemoteWorkspace(\n      getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n    ).gitDiff(path)) as GitChangeDiff & { diff?: string };\n\n    return {\n      modified: diff.modified ?? \"\",\n      original: diff.original ?? \"\",\n      ...(diff.diff ? { diff: diff.diff } : {}),\n    } as GitChangeDiff;\n  }\n}\n\nexport default AgentServerGitService;\n"],"mappings":";;;;;;;;;AAsDA,SAAS,EAAsB,GAAsB;AACnD,QAAO,EAAK,WAAW,IAAI,GAAG,IAAO,IAAI;;AAY3C,eAAe,EACb,GACA,GACA,GACA,GACY;CACZ,IAAM,IAAS,GAAkB,CAAC;AAElC,KAAI,EAAO,SAAS,WAAW,GAAiB;EAC9C,IAAM,IAAS,IAAI,gBAAgB;GACjC,GAAG;GACH,MAAM,EAAsB,EAAO,KAAK;GACzC,CAAC;AACF,SAAO,EAAkB;GACvB,SAAS;GACT,QAAQ;GACR,cAAc,EAAiB,EAAgB;GAC/C,MAAM,GAAG,EAAQ,GAAG,EAAO,UAAU;GACrC,UAAU;GACV,eAAe,KAAiB,KAAA;GACjC,CAAC;;AAMJ,SAAO,MAHgB,IAAI,EACzB,EAA4B;EAAE;EAAiB;EAAe,CAAC,CAChE,CAAC,OAAO,IAAO,GAAS,EAAE,WAAQ,CAAC,EACpB;;AAUlB,SAAS,EAAuB,GAAyB;AACvD,QACE,EAAqB,GAAO,IAAI,IAC/B,EAAa,EAAM,IAAI,EAAM,UAAU,WAAW;;AAIvD,IAAM,IAAN,MAA4B;CAC1B,aAAa,cACX,GACA,GACA,GACA,GACsB;EACtB,IAAM,IAAS,GAAkB,CAAC;AAElC,MAAI,EAAO,SAAS,WAAW,GAAgB;GAC7C,IAAM,IAAS,IAAI,iBAAiB;AACpC,KAAO,IAAI,QAAQ,EAAsB,EAAK,CAAC;GAC/C,IAAM,IAAO,MAAM,EAAuC;IACxD,SAAS;IACT,QAAQ;IACR,MAAM,6BAA6B,EAAe,eAAe,EAAO,UAAU;IACnF,CAAC;AACF,OAAI,CAAC,MAAM,QAAQ,EAAK,CACtB,OAAU,MACR,6DACD;AAEH,UAAO,EAAK,KAAK,OAAY;IAC3B,QAAQ,EACN,OAAO,EAAO,OAAO,CAGtB;IACD,MAAM,EAAO;IACd,EAAE;;EAOL,IAAM,IAAU,MAAM,IAAI,EACxB,EAA4B;GAAE;GAAiB;GAAe,CAAC,CAChE,CAAC,WAAW,EAAK;AAElB,MAAI,CAAC,MAAM,QAAQ,EAAQ,CACzB,OAAU,MACR,6DACD;AAGH,SAAO,EAAQ,KAAK,OAAY;GAC9B,QAAQ,EACN,OAAO,EAAO,OAAO,CAGtB;GACD,MAAM,EAAO;GACd,EAAE;;CAQL,aAAa,cACX,GACA,GACA,GACA,IAAQ,IACwB;AAChC,MAAI;GACF,IAAM,IAAO,MAAM,EACjB,GACA,GACA,oBACA;IAAE;IAAM,OAAO,OAAO,EAAM;IAAE,CAC/B;AACD,UAAO;IACL,UAAU,GAAM,WAAW,EAAE,EAAE,KAAK,OAAY;KAC9C,KAAK,EAAO;KACZ,UAAU,EAAO;KACjB,SAAS,EAAO;KAChB,QAAQ,EAAO;KACf,WAAW,EAAO;KACnB,EAAE;IACH,SAAS,EAAQ,GAAM;IACxB;WACM,GAAO;AACd,OAAI,EAAuB,EAAM,CAAE,QAAO;AAC1C,SAAM;;;CAKV,aAAa,iBACX,GACA,GACA,GACA,GACsB;EACtB,IAAM,IAAU,MAAM,EACpB,GACA,GACA,oBAAoB,mBAAmB,EAAI,CAAC,WAC5C,EAAE,SAAM,CACT;AAED,MAAI,CAAC,MAAM,QAAQ,EAAQ,CACzB,OAAU,MACR,6DACD;AAGH,SAAO,EAAQ,KAAK,OAAY;GAC9B,QAAQ,EACN,OAAO,EAAO,OAAO,CAGtB;GACD,MAAM,EAAO;GACd,EAAE;;CAGL,aAAa,iBACX,GACA,GACA,GACA,GACA,GACwB;AACxB,MAAI,GAAQ;GAGV,IAAM,IAAa,MAAM,EAEvB,GAAiB,GAAe,iBAAiB;IAAE;IAAM;IAAQ,CAAC;AACpE,UAAO;IACL,UAAU,GAAY,YAAY;IAClC,UAAU,GAAY,YAAY;IAClC,GAAI,GAAY,OAAO,EAAE,MAAM,EAAW,MAAM,GAAG,EAAE;IACtD;;EAGH,IAAM,IAAS,GAAkB,CAAC;AAElC,MAAI,EAAO,SAAS,WAAW,GAAgB;GAC7C,IAAM,IAAS,IAAI,iBAAiB;AACpC,KAAO,IAAI,QAAQ,EAAsB,EAAK,CAAC;GAC/C,IAAM,IAAO,MAAM,EAAkD;IACnE,SAAS;IACT,QAAQ;IACR,MAAM,6BAA6B,EAAe,YAAY,EAAO,UAAU;IAChF,CAAC;AACF,UAAO;IACL,UAAU,GAAM,YAAY;IAC5B,UAAU,GAAM,YAAY;IAC5B,GAAI,GAAM,OAAO,EAAE,MAAM,EAAK,MAAM,GAAG,EAAE;IAC1C;;EAKH,IAAM,IAAQ,MAAM,IAAI,EACtB,EAA4B;GAAE;GAAiB;GAAe,CAAC,CAChE,CAAC,QAAQ,EAAK;AAEf,SAAO;GACL,UAAU,EAAK,YAAY;GAC3B,UAAU,EAAK,YAAY;GAC3B,GAAI,EAAK,OAAO,EAAE,MAAM,EAAK,MAAM,GAAG,EAAE;GACzC"}

package/dist/api/open-hands.types.d.ts

@@ -85,6 +85,17 @@ export interface GitChangeDiff {
     modified: string;
     original: string;
 }
+export interface GitCommit {
+    sha: string;
+    shortSha: string;
+    subject: string;
+    author: string;
+    timestamp: string;
+}
+export interface GitCommitsPage {
+    commits: GitCommit[];
+    hasMore: boolean;
+}
 export interface InputMetadata {
     name: string;
     description: string;

package/dist/api/secrets-service.cjs

@@ -1,2 +1,2 @@
-require(`../_virtual/_rolldown/runtime.cjs`);const e=require(`../node_modules/@openhands/typescript-client/dist/client/settings-client.cjs`);require(`../node_modules/@openhands/typescript-client/dist/clients.cjs`);const t=require(`./backend-registry/active-store.cjs`),n=require(`./agent-server-client-options.cjs`),r=require(`./cloud/secrets-service.api.cjs`);async function i(e,t=3,n=500){for(let r=0;r<t;r+=1)try{return await e()}catch(e){if(r>=t-1)throw e;let i=n*2**r;await new Promise(e=>{setTimeout(e,i)})}throw Error(`Retry attempts exhausted`)}var a=class{static async getSecrets(){try{return t.getActiveBackend().backend.kind===`cloud`?await i(()=>r.fetchCloudSecrets()):(await i(()=>new e.SettingsClient(n.getAgentServerClientOptions()).listSecrets())).secrets.map(e=>({name:e.name,description:e.description}))}catch(e){return console.error(`Failed to fetch secrets after retries:`,e),[]}}static async createSecret(a,o,s){if(t.getActiveBackend().backend.kind===`cloud`){await i(()=>r.createCloudSecret(a,o,s));return}await i(()=>new e.SettingsClient(n.getAgentServerClientOptions()).upsertSecret({name:a,value:o,description:s}))}static async updateSecret(e,n,a){if(t.getActiveBackend().backend.kind===`cloud`){await i(()=>r.updateCloudSecret(e,n,a));return}await this.createSecret(e,n,a)}static async deleteSecret(a){try{if(t.getActiveBackend().backend.kind===`cloud`){await i(()=>r.deleteCloudSecret(a));return}await i(()=>new e.SettingsClient(n.getAgentServerClientOptions()).deleteSecret(a))}catch(e){if(e&&typeof e==`object`&&`response`in e&&e.response?.status===404)return;throw e}}};exports.SecretsService=a;
+require(`../_virtual/_rolldown/runtime.cjs`);const e=require(`../node_modules/@openhands/typescript-client/dist/client/settings-client.cjs`);require(`../node_modules/@openhands/typescript-client/dist/clients.cjs`);const t=require(`./backend-registry/active-store.cjs`),n=require(`./agent-server-client-options.cjs`),r=require(`./agent-server-compatibility.cjs`),i=require(`./cloud/secrets-service.api.cjs`);async function a(e,t=3,n=500){for(let r=0;r<t;r+=1)try{return await e()}catch(e){if(r>=t-1)throw e;let i=n*2**r;await new Promise(e=>{setTimeout(e,i)})}throw Error(`Retry attempts exhausted`)}var o=class{static async getSecrets(){try{return t.getActiveBackend().backend.kind===`cloud`?await a(()=>i.fetchCloudSecrets()):(await a(()=>new e.SettingsClient(n.getAgentServerClientOptions()).listSecrets())).secrets.map(e=>({name:e.name,description:e.description}))}catch(e){return console.error(`Failed to fetch secrets after retries:`,e),[]}}static async createSecret(r,o,s){if(t.getActiveBackend().backend.kind===`cloud`){await a(()=>i.createCloudSecret(r,o,s));return}await a(()=>new e.SettingsClient(n.getAgentServerClientOptions()).upsertSecret({name:r,value:o,description:s}))}static async updateSecret(e,n,r){if(t.getActiveBackend().backend.kind===`cloud`){await a(()=>i.updateCloudSecret(e,n,r));return}await this.createSecret(e,n,r)}static async deleteSecret(o){try{if(t.getActiveBackend().backend.kind===`cloud`){await a(()=>i.deleteCloudSecret(o));return}await a(()=>new e.SettingsClient(n.getAgentServerClientOptions()).deleteSecret(o))}catch(e){if(r.isSdkHttpStatusError(e,404)||e&&typeof e==`object`&&`response`in e&&e.response?.status===404)return;throw e}}};exports.SecretsService=o;
 //# sourceMappingURL=secrets-service.cjs.map

package/dist/api/secrets-service.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-service.cjs","names":[],"sources":["../../src/api/secrets-service.ts"],"sourcesContent":["import { SettingsClient } from \"@openhands/typescript-client/clients\";\nimport { getActiveBackend } from \"./backend-registry/active-store\";\nimport {\n  createCloudSecret,\n  deleteCloudSecret,\n  fetchCloudSecrets,\n  updateCloudSecret,\n} from \"./cloud/secrets-service.api\";\nimport { getAgentServerClientOptions } from \"./agent-server-client-options\";\nimport { CustomSecretWithoutValue } from \"./secrets-service.types\";\n\n/**\n * Retry helper for API calls with exponential backoff.\n */\nasync function withRetry<T>(\n  fn: () => Promise<T>,\n  maxRetries: number = 3,\n  baseDelayMs: number = 500,\n): Promise<T> {\n  for (let attempt = 0; attempt < maxRetries; attempt += 1) {\n    try {\n      return await fn();\n    } catch (error) {\n      if (attempt >= maxRetries - 1) {\n        throw error;\n      }\n\n      const delay = baseDelayMs * 2 ** attempt;\n\n      await new Promise<void>((resolve) => {\n        setTimeout(resolve, delay);\n      });\n    }\n  }\n\n  throw new Error(\"Retry attempts exhausted\");\n}\n\nexport class SecretsService {\n  /**\n   * List all custom secrets (names and descriptions only, no values).\n   * Uses the agent-server API endpoint: GET /api/settings/secrets\n   *\n   * Note: The agent-server API doesn't support pagination or search filtering.\n   * All secrets are returned in a single response.\n   */\n  static async getSecrets(): Promise<CustomSecretWithoutValue[]> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        return await withRetry(() => fetchCloudSecrets());\n      }\n      const response = await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).listSecrets(),\n      );\n      return response.secrets.map((s) => ({\n        name: s.name,\n        description: s.description,\n      }));\n    } catch (error) {\n      console.error(\"Failed to fetch secrets after retries:\", error);\n      return [];\n    }\n  }\n\n  /**\n   * Create or update a custom secret (upsert by name).\n   * Uses the agent-server API endpoint: PUT /api/settings/secrets\n   *\n   * @param name - Secret name (must start with letter, contain only letters/numbers/underscores, 1-64 chars)\n   * @param value - Secret value\n   * @param description - Optional description\n   * @throws Error if the API call fails after retries\n   */\n  static async createSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      await withRetry(() => createCloudSecret(name, value, description));\n      return;\n    }\n    await withRetry(() =>\n      new SettingsClient(getAgentServerClientOptions()).upsertSecret({\n        name,\n        value,\n        description,\n      }),\n    );\n  }\n\n  /**\n   * Update a secret's value and/or description.\n   * Uses the same upsert endpoint as createSecret since agent-server\n   * doesn't have a separate update endpoint.\n   *\n   * @param name - Secret name (used as identifier)\n   * @param value - New secret value\n   * @param description - Optional new description\n   * @throws Error if the API call fails after retries\n   */\n  static async updateSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      // The cloud PUT endpoint renames + redescribes only (no value field),\n      // matching what `useUpdateSecret` actually sends:\n      // (secretToEdit=name, newName=value, description).\n      await withRetry(() => updateCloudSecret(name, value, description));\n      return;\n    }\n    // Agent-server uses upsert, so update is the same as create\n    await this.createSecret(name, value, description);\n  }\n\n  /**\n   * Delete a custom secret by name.\n   * Uses the agent-server API endpoint: DELETE /api/settings/secrets/{name}\n   *\n   * @param name - Secret name to delete\n   * @throws Error if the API call fails (except 404, which is treated as success)\n   */\n  static async deleteSecret(name: string): Promise<void> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        await withRetry(() => deleteCloudSecret(name));\n        return;\n      }\n      await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).deleteSecret(name),\n      );\n    } catch (error) {\n      // 404 means secret doesn't exist - treat as successful deletion\n      if (\n        error &&\n        typeof error === \"object\" &&\n        \"response\" in error &&\n        (error as { response?: { status?: number } }).response?.status === 404\n      ) {\n        return;\n      }\n      throw error;\n    }\n  }\n}\n"],"mappings":"yWAcA,eAAe,EACb,EACA,EAAqB,EACrB,EAAsB,IACV,CACZ,IAAK,IAAI,EAAU,EAAG,EAAU,EAAY,GAAW,EACrD,GAAI,CACF,OAAO,MAAM,GAAI,OACV,EAAO,CACd,GAAI,GAAW,EAAa,EAC1B,MAAM,EAGR,IAAM,EAAQ,EAAc,GAAK,EAEjC,MAAM,IAAI,QAAe,GAAY,CACnC,WAAW,EAAS,EAAM,EAC1B,CAIN,MAAU,MAAM,2BAA2B,CAG7C,IAAa,EAAb,KAA4B,CAQ1B,aAAa,YAAkD,CAC7D,GAAI,CAOF,OANI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAC/B,MAAM,MAAgB,EAAA,mBAAmB,CAAC,EAK5C,MAHgB,MACrB,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,CAChE,EACe,QAAQ,IAAK,IAAO,CAClC,KAAM,EAAE,KACR,YAAa,EAAE,YAChB,EAAE,OACI,EAAO,CAEd,OADA,QAAQ,MAAM,yCAA0C,EAAM,CACvD,EAAE,EAab,aAAa,aACX,EACA,EACA,EACe,CACf,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAC/C,MAAM,MAAgB,EAAA,kBAAkB,EAAM,EAAO,EAAY,CAAC,CAClE,OAEF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,CAC7D,OACA,QACA,cACD,CAAC,CACH,CAaH,aAAa,aACX,EACA,EACA,EACe,CACf,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAI/C,MAAM,MAAgB,EAAA,kBAAkB,EAAM,EAAO,EAAY,CAAC,CAClE,OAGF,MAAM,KAAK,aAAa,EAAM,EAAO,EAAY,CAUnD,aAAa,aAAa,EAA6B,CACrD,GAAI,CACF,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAC/C,MAAM,MAAgB,EAAA,kBAAkB,EAAK,CAAC,CAC9C,OAEF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,EAAK,CACrE,OACM,EAAO,CAEd,GACE,GACA,OAAO,GAAU,UACjB,aAAc,GACb,EAA6C,UAAU,SAAW,IAEnE,OAEF,MAAM"}
+{"version":3,"file":"secrets-service.cjs","names":[],"sources":["../../src/api/secrets-service.ts"],"sourcesContent":["import { SettingsClient } from \"@openhands/typescript-client/clients\";\nimport { isSdkHttpStatusError } from \"./agent-server-compatibility\";\nimport { getActiveBackend } from \"./backend-registry/active-store\";\nimport {\n  createCloudSecret,\n  deleteCloudSecret,\n  fetchCloudSecrets,\n  updateCloudSecret,\n} from \"./cloud/secrets-service.api\";\nimport { getAgentServerClientOptions } from \"./agent-server-client-options\";\nimport { CustomSecretWithoutValue } from \"./secrets-service.types\";\n\n/**\n * Retry helper for API calls with exponential backoff.\n */\nasync function withRetry<T>(\n  fn: () => Promise<T>,\n  maxRetries: number = 3,\n  baseDelayMs: number = 500,\n): Promise<T> {\n  for (let attempt = 0; attempt < maxRetries; attempt += 1) {\n    try {\n      return await fn();\n    } catch (error) {\n      if (attempt >= maxRetries - 1) {\n        throw error;\n      }\n\n      const delay = baseDelayMs * 2 ** attempt;\n\n      await new Promise<void>((resolve) => {\n        setTimeout(resolve, delay);\n      });\n    }\n  }\n\n  throw new Error(\"Retry attempts exhausted\");\n}\n\nexport class SecretsService {\n  /**\n   * List all custom secrets (names and descriptions only, no values).\n   * Uses the agent-server API endpoint: GET /api/settings/secrets\n   *\n   * Note: The agent-server API doesn't support pagination or search filtering.\n   * All secrets are returned in a single response.\n   */\n  static async getSecrets(): Promise<CustomSecretWithoutValue[]> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        return await withRetry(() => fetchCloudSecrets());\n      }\n      const response = await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).listSecrets(),\n      );\n      return response.secrets.map((s) => ({\n        name: s.name,\n        description: s.description,\n      }));\n    } catch (error) {\n      console.error(\"Failed to fetch secrets after retries:\", error);\n      return [];\n    }\n  }\n\n  /**\n   * Create or update a custom secret (upsert by name).\n   * Uses the agent-server API endpoint: PUT /api/settings/secrets\n   *\n   * @param name - Secret name (must start with letter, contain only letters/numbers/underscores, 1-64 chars)\n   * @param value - Secret value\n   * @param description - Optional description\n   * @throws Error if the API call fails after retries\n   */\n  static async createSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      await withRetry(() => createCloudSecret(name, value, description));\n      return;\n    }\n    await withRetry(() =>\n      new SettingsClient(getAgentServerClientOptions()).upsertSecret({\n        name,\n        value,\n        description,\n      }),\n    );\n  }\n\n  /**\n   * Update a secret's value and/or description.\n   * Uses the same upsert endpoint as createSecret since agent-server\n   * doesn't have a separate update endpoint.\n   *\n   * @param name - Secret name (used as identifier)\n   * @param value - New secret value\n   * @param description - Optional new description\n   * @throws Error if the API call fails after retries\n   */\n  static async updateSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      // The cloud PUT endpoint renames + redescribes only (no value field),\n      // matching what `useUpdateSecret` actually sends:\n      // (secretToEdit=name, newName=value, description).\n      await withRetry(() => updateCloudSecret(name, value, description));\n      return;\n    }\n    // Agent-server uses upsert, so update is the same as create\n    await this.createSecret(name, value, description);\n  }\n\n  /**\n   * Delete a custom secret by name.\n   * Uses the agent-server API endpoint: DELETE /api/settings/secrets/{name}\n   *\n   * @param name - Secret name to delete\n   * @throws Error if the API call fails (except 404, which is treated as success)\n   */\n  static async deleteSecret(name: string): Promise<void> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        await withRetry(() => deleteCloudSecret(name));\n        return;\n      }\n      await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).deleteSecret(name),\n      );\n    } catch (error) {\n      // 404 means secret doesn't exist - treat as successful deletion.\n      // Both the SDK's HttpError (status on the error itself) and\n      // axios-style errors (status under `response`) count.\n      if (\n        isSdkHttpStatusError(error, 404) ||\n        (error &&\n          typeof error === \"object\" &&\n          \"response\" in error &&\n          (error as { response?: { status?: number } }).response?.status ===\n            404)\n      ) {\n        return;\n      }\n      throw error;\n    }\n  }\n}\n"],"mappings":"uZAeA,eAAe,EACb,EACA,EAAqB,EACrB,EAAsB,IACV,CACZ,IAAK,IAAI,EAAU,EAAG,EAAU,EAAY,GAAW,EACrD,GAAI,CACF,OAAO,MAAM,GAAI,OACV,EAAO,CACd,GAAI,GAAW,EAAa,EAC1B,MAAM,EAGR,IAAM,EAAQ,EAAc,GAAK,EAEjC,MAAM,IAAI,QAAe,GAAY,CACnC,WAAW,EAAS,EAAM,EAC1B,CAIN,MAAU,MAAM,2BAA2B,CAG7C,IAAa,EAAb,KAA4B,CAQ1B,aAAa,YAAkD,CAC7D,GAAI,CAOF,OANI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAC/B,MAAM,MAAgB,EAAA,mBAAmB,CAAC,EAK5C,MAHgB,MACrB,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,CAChE,EACe,QAAQ,IAAK,IAAO,CAClC,KAAM,EAAE,KACR,YAAa,EAAE,YAChB,EAAE,OACI,EAAO,CAEd,OADA,QAAQ,MAAM,yCAA0C,EAAM,CACvD,EAAE,EAab,aAAa,aACX,EACA,EACA,EACe,CACf,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAC/C,MAAM,MAAgB,EAAA,kBAAkB,EAAM,EAAO,EAAY,CAAC,CAClE,OAEF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,CAC7D,OACA,QACA,cACD,CAAC,CACH,CAaH,aAAa,aACX,EACA,EACA,EACe,CACf,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAI/C,MAAM,MAAgB,EAAA,kBAAkB,EAAM,EAAO,EAAY,CAAC,CAClE,OAGF,MAAM,KAAK,aAAa,EAAM,EAAO,EAAY,CAUnD,aAAa,aAAa,EAA6B,CACrD,GAAI,CACF,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAC/C,MAAM,MAAgB,EAAA,kBAAkB,EAAK,CAAC,CAC9C,OAEF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,EAAK,CACrE,OACM,EAAO,CAId,GACE,EAAA,qBAAqB,EAAO,IAAI,EAC/B,GACC,OAAO,GAAU,UACjB,aAAc,GACb,EAA6C,UAAU,SACtD,IAEJ,OAEF,MAAM"}