openhands-agent-server 1.29.0__tar.gz → 1.29.2__tar.gz

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhands-agent-server
-Version: 1.29.0
+Version: 1.29.2
 Summary: OpenHands Agent Server - REST/WebSocket interface for OpenHands AI Agent
 Project-URL: Source, https://github.com/OpenHands/software-agent-sdk
 Project-URL: Homepage, https://github.com/OpenHands/software-agent-sdk

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/openhands/agent_server/agent_profiles_router.py

@@ -30,9 +30,10 @@ from openhands.agent_server._secrets_exposure import (
 )
 from openhands.agent_server.persistence import (
     PersistedSettings,
+    get_agent_profile_store,
+    get_llm_profile_store,
     get_settings_store,
 )
-from openhands.sdk.llm.llm_profile_store import LLMProfileStore
 from openhands.sdk.logger import get_logger
 from openhands.sdk.profiles import (
     ACPAgentProfile,
@@ -318,7 +319,7 @@ async def list_agent_profiles(request: Request) -> AgentProfileListResponse:
     settings_store = get_settings_store(config)
     settings = settings_store.load() or PersistedSettings()
 
-    store = AgentProfileStore()
+    store = get_agent_profile_store()
     with _store_errors():
         existing = store.list()
 
@@ -347,7 +348,7 @@ async def get_agent_profile(
     expose_mode = parse_expose_secrets_header(request)
     cipher = get_cipher(request)
 
-    store = AgentProfileStore()
+    store = get_agent_profile_store()
     try:
         with _store_errors():
             profile = store.load(name, cipher=cipher)
@@ -408,7 +409,7 @@ async def save_agent_profile(
     # secret once rather than double-encrypting the token.
     profile = _decrypt_profile_mcp_tools(profile, cipher)
 
-    store = AgentProfileStore()
+    store = get_agent_profile_store()
     # The id is server-managed (the active pointer is keyed on it): overwrite
     # keeps the namesake's id and bumps revision; create mints a fresh id,
     # ignoring any client-supplied one. The lock spans read + mint + save so two
@@ -448,7 +449,7 @@ async def delete_agent_profile(
     If the deleted profile was the active one, ``active_agent_profile_id`` is
     cleared.
     """
-    store = AgentProfileStore()
+    store = get_agent_profile_store()
     deleted_id = _summary_id_for_name(store, name)
 
     with _store_errors():
@@ -485,7 +486,7 @@ async def rename_agent_profile(
     survives the rename untouched. Returns 404 if the source is missing, 409 if
     ``new_name`` is taken.
     """
-    store = AgentProfileStore()
+    store = get_agent_profile_store()
     try:
         with _store_errors():
             store.rename(name, body.new_name)
@@ -520,7 +521,7 @@ async def activate_agent_profile(
     ``/activate``, this does **not** write ``agent_settings`` (the
     creation-time-only contract). Returns 404 if no stored profile has that id.
     """
-    store = AgentProfileStore()
+    store = get_agent_profile_store()
     with _store_errors():
         known_ids = {
             str(s["id"]) for s in store.list_summaries() if s.get("id") is not None
@@ -574,7 +575,7 @@ async def materialize_agent_profile(
     """
     cipher = get_cipher(request)
 
-    store = AgentProfileStore()
+    store = get_agent_profile_store()
     try:
         with _store_errors():
             profile = store.load(name, cipher=cipher)
@@ -592,7 +593,7 @@ async def materialize_agent_profile(
     settings = get_settings_store(config).load() or PersistedSettings()
     mcp_config = settings.agent_settings.mcp_config
 
-    llm_store = LLMProfileStore()
+    llm_store = get_llm_profile_store()
     return resolve_agent_profile_dry_run(
         profile,
         llm_store=llm_store,

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/openhands/agent_server/api.py

@@ -29,8 +29,8 @@ from openhands.agent_server.conversation_service import (
     get_default_conversation_service,
 )
 from openhands.agent_server.dependencies import (
-    create_session_api_key_dependency,
-    create_workspace_session_dependency,
+    check_session_api_key,
+    check_workspace_session,
 )
 from openhands.agent_server.desktop_router import desktop_router
 from openhands.agent_server.desktop_service import get_desktop_service
@@ -47,7 +47,7 @@ from openhands.agent_server.llm_router import llm_router
 from openhands.agent_server.mcp_router import mcp_router
 from openhands.agent_server.middleware import CORSDispatcher
 from openhands.agent_server.openai.router import (
-    create_openai_api_key_dependency,
+    check_openai_api_key,
     openai_router,
 )
 from openhands.agent_server.profiles_router import profiles_router
@@ -234,6 +234,9 @@ async def api_lifespan(api: FastAPI) -> AsyncIterator[None]:
         mark_initialization_complete()
         logger.info("Server initialization complete - ready to serve requests")
 
+        bash_svc = get_default_bash_event_service()
+        api.state.bash_event_service = bash_svc
+
         async with service:
             api.state.conversation_service = service
 
@@ -241,7 +244,7 @@ async def api_lifespan(api: FastAPI) -> AsyncIterator[None]:
             retention_task: asyncio.Task | None = None
             if config.bash_events_retention_seconds is not None:
                 retention_task = asyncio.create_task(
-                    get_default_bash_event_service().run_retention_cleanup_loop(
+                    bash_svc.run_retention_cleanup_loop(
                         config.bash_events_retention_seconds
                     )
                 )
@@ -310,12 +313,8 @@ def _find_http_exception(exc: BaseExceptionGroup) -> HTTPException | None:
     return None
 
 
-def _add_api_routes(app: FastAPI, config: Config) -> None:
-    """Add all API routes to the FastAPI application.
-
-    Args:
-        app: FastAPI application instance to add routes to.
-    """
+def _add_api_routes(app: FastAPI) -> None:
+    """Add all API routes to the FastAPI application."""
     app.include_router(server_details_router)
 
     # The /api/init endpoint bypasses both the session-key auth and the
@@ -330,12 +329,14 @@ def _add_api_routes(app: FastAPI, config: Config) -> None:
     # Header-only auth: applied to every /api/* route EXCEPT the workspace
     # static-file routes (handled separately below). Cookies are NOT honored
     # here so that we don't expand the CSRF surface across the whole API.
-    dependencies = []
-    if config.session_api_keys:
-        dependencies.append(Depends(create_session_api_key_dependency(config)))
-    # Dormant gate: when ``deferred_init`` is True this 503s every /api/*
-    # route until POST /api/init completes. No-op for non-deferred deployments.
-    dependencies.append(Depends(require_initialized))
+    # check_session_api_key reads config from request.app.state at request time,
+    # so keys delivered via POST /api/init are honoured without re-registering routes.
+    dependencies = [
+        Depends(check_session_api_key),
+        # Dormant gate: 503s every /api/* route until POST /api/init completes.
+        # No-op for non-deferred deployments.
+        Depends(require_initialized),
+    ]
 
     api_router = APIRouter(prefix="/api", dependencies=dependencies)
     api_router.include_router(event_router)
@@ -359,22 +360,16 @@ def _add_api_routes(app: FastAPI, config: Config) -> None:
     api_router.include_router(auth_router)
     app.include_router(api_router)
 
-    openai_dependencies = []
-    if config.session_api_keys:
-        openai_dependencies.append(Depends(create_openai_api_key_dependency(config)))
-    app.include_router(openai_router, dependencies=openai_dependencies)
+    app.include_router(openai_router, dependencies=[Depends(check_openai_api_key)])
 
     # Workspace static-file routes get their own auth group that accepts
     # EITHER the X-Session-API-Key header OR the workspace session cookie.
     # The cookie is required so that <iframe src> / <img src> embeds of
     # workspace artifacts work — browsers cannot attach custom headers to
     # those requests.
-    workspace_dependencies = []
-    if config.session_api_keys:
-        workspace_dependencies.append(
-            Depends(create_workspace_session_dependency(config))
-        )
-    workspace_api_router = APIRouter(prefix="/api", dependencies=workspace_dependencies)
+    workspace_api_router = APIRouter(
+        prefix="/api", dependencies=[Depends(check_workspace_session)]
+    )
     workspace_api_router.include_router(workspace_router)
     app.include_router(workspace_api_router)
 
@@ -592,7 +587,7 @@ def create_app(config: Config | None = None) -> FastAPI:
     app = _create_fastapi_instance(config)
     app.state.config = config
 
-    _add_api_routes(app, config)
+    _add_api_routes(app)
     _setup_static_files(app, config)
     app.add_middleware(
         CORSDispatcher,

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/openhands/agent_server/bash_router.py

@@ -7,12 +7,14 @@ from uuid import UUID
 
 from fastapi import (
     APIRouter,
+    Depends,
     HTTPException,
     Query,
     status,
 )
 
-from openhands.agent_server.bash_service import get_default_bash_event_service
+from openhands.agent_server.bash_service import BashEventService
+from openhands.agent_server.dependencies import get_bash_event_service
 from openhands.agent_server.models import (
     BashCommand,
     BashEventBase,
@@ -25,7 +27,6 @@ from openhands.agent_server.server_details_router import update_last_execution_t
 
 
 bash_router = APIRouter(prefix="/bash", tags=["Bash"])
-bash_event_service = get_default_bash_event_service()
 logger = logging.getLogger(__name__)
 
 
@@ -53,6 +54,7 @@ async def search_bash_events(
         int,
         Query(title="The max number of results in the page", gt=0, lte=100),
     ] = 100,
+    bash_event_service: BashEventService = Depends(get_bash_event_service),
 ) -> BashEventPage:
     """Search / List bash event events"""
     assert limit > 0
@@ -73,7 +75,10 @@ async def search_bash_events(
 @bash_router.get(
     "/bash_events/{event_id}", responses={404: {"description": "Item not found"}}
 )
-async def get_bash_event(event_id: str) -> BashEventBase:
+async def get_bash_event(
+    event_id: str,
+    bash_event_service: BashEventService = Depends(get_bash_event_service),
+) -> BashEventBase:
     """Get a bash event event given an id"""
     event = await bash_event_service.get_bash_event(event_id)
     if event is None:
@@ -84,6 +89,7 @@ async def get_bash_event(event_id: str) -> BashEventBase:
 @bash_router.get("/bash_events/")
 async def batch_get_bash_events(
     event_ids: list[str],
+    bash_event_service: BashEventService = Depends(get_bash_event_service),
 ) -> list[BashEventBase | None]:
     """Get a batch of bash event events given their ids, returning null for any
     missing item."""
@@ -92,7 +98,10 @@ async def batch_get_bash_events(
 
 
 @bash_router.post("/start_bash_command")
-async def start_bash_command(request: ExecuteBashRequest) -> BashCommand:
+async def start_bash_command(
+    request: ExecuteBashRequest,
+    bash_event_service: BashEventService = Depends(get_bash_event_service),
+) -> BashCommand:
     """Execute a bash command in the background"""
     update_last_execution_time()
     command, _ = await bash_event_service.start_bash_command(request)
@@ -100,7 +109,10 @@ async def start_bash_command(request: ExecuteBashRequest) -> BashCommand:
 
 
 @bash_router.post("/execute_bash_command")
-async def execute_bash_command(request: ExecuteBashRequest) -> BashOutput:
+async def execute_bash_command(
+    request: ExecuteBashRequest,
+    bash_event_service: BashEventService = Depends(get_bash_event_service),
+) -> BashOutput:
     """Execute a bash command and wait for a result"""
     update_last_execution_time()
     command, task = await bash_event_service.start_bash_command(request)
@@ -111,7 +123,9 @@ async def execute_bash_command(request: ExecuteBashRequest) -> BashOutput:
 
 
 @bash_router.delete("/bash_events")
-async def clear_all_bash_events() -> dict[str, int]:
+async def clear_all_bash_events(
+    bash_event_service: BashEventService = Depends(get_bash_event_service),
+) -> dict[str, int]:
     """Clear all bash events from storage"""
     count = await bash_event_service.clear_all_events()
     return {"cleared_count": count}

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/openhands/agent_server/conversation_service.py

@@ -261,11 +261,13 @@ def _resolve_agent_from_profile(
         DanglingMcpServerRef: A referenced MCP server is absent from the global config.
         ValueError: Profile load or settings validation failure.
     """
-    from openhands.sdk.llm.llm_profile_store import LLMProfileStore
-    from openhands.sdk.profiles.agent_profile_store import AgentProfileStore
+    from openhands.agent_server.persistence.store import (
+        get_agent_profile_store,
+        get_llm_profile_store,
+    )
     from openhands.sdk.profiles.resolver import ProfileNotFound, resolve_agent_profile
 
-    store = AgentProfileStore()
+    store = get_agent_profile_store()
     profile_name = store.name_for_id(profile_id)
     if profile_name is None:
         raise ProfileNotFound(f"Agent profile with id '{profile_id}' not found")
@@ -281,7 +283,7 @@ def _resolve_agent_from_profile(
             f"Failed to load agent profile '{profile_name}': {exc}"
         ) from exc
 
-    llm_store = LLMProfileStore()
+    llm_store = get_llm_profile_store()
     try:
         settings_config = resolve_agent_profile(
             profile, llm_store=llm_store, mcp_config=mcp_config, cipher=cipher
@@ -1343,9 +1345,11 @@ class AutoTitleSubscriber(Subscriber):
             return None
 
         try:
-            from openhands.sdk.llm.llm_profile_store import LLMProfileStore
+            from openhands.agent_server.persistence.store import (
+                get_llm_profile_store,
+            )
 
-            profile_store = LLMProfileStore()
+            profile_store = get_llm_profile_store()
             return profile_store.load(profile_name, cipher=self.service.cipher)
         except (FileNotFoundError, ValueError) as e:
             logger.warning(

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/openhands/agent_server/dependencies.py

@@ -3,6 +3,7 @@ from uuid import UUID
 from fastapi import Depends, HTTPException, Request, status
 from fastapi.security import APIKeyCookie, APIKeyHeader
 
+from openhands.agent_server.bash_service import BashEventService
 from openhands.agent_server.config import Config
 from openhands.agent_server.conversation_service import ConversationService
 from openhands.agent_server.event_service import EventService
@@ -20,22 +21,26 @@ _WORKSPACE_SESSION_COOKIE = APIKeyCookie(
 )
 
 
-def create_session_api_key_dependency(config: Config):
-    """Create a session API key dependency with the given config."""
+def check_session_api_key(
+    request: Request,
+    session_api_key: str | None = Depends(_SESSION_API_KEY_HEADER),
+) -> None:
+    """Reject the request if the supplied key is not in the current session keys.
 
-    def check_session_api_key(
-        session_api_key: str | None = Depends(_SESSION_API_KEY_HEADER),
-    ):
-        """Check the session API key and throw an exception if incorrect. Having this as
-        a dependency means it appears in OpenAPI Docs
-        """
-        if config.session_api_keys and session_api_key not in config.session_api_keys:
-            raise HTTPException(status.HTTP_401_UNAUTHORIZED)
-
-    return check_session_api_key
+    Reads ``session_api_keys`` from ``request.app.state.config`` at request time
+    so that keys delivered via ``POST /api/init`` take effect immediately without
+    restarting the server or re-registering routes.
+    """
+    config: Config = request.app.state.config
+    if config.session_api_keys and session_api_key not in config.session_api_keys:
+        raise HTTPException(status.HTTP_401_UNAUTHORIZED)
 
 
-def create_workspace_session_dependency(config: Config):
+def check_workspace_session(
+    request: Request,
+    header_key: str | None = Depends(_SESSION_API_KEY_HEADER),
+    cookie_key: str | None = Depends(_WORKSPACE_SESSION_COOKIE),
+) -> None:
     """Auth dependency for the workspace static-file routes.
 
     Accepts EITHER the standard ``X-Session-API-Key`` header OR the
@@ -46,28 +51,16 @@ def create_workspace_session_dependency(config: Config):
     frontend embeds workspace artifacts. The cookie is deliberately scoped
     to this router only; no other endpoint honors it.
     """
-
-    def check_workspace_session(
-        header_key: str | None = Depends(_SESSION_API_KEY_HEADER),
-        cookie_key: str | None = Depends(_WORKSPACE_SESSION_COOKIE),
-    ):
-        if not config.session_api_keys:
+    config: Config = request.app.state.config
+    if not config.session_api_keys:
+        return
+    for candidate in (header_key, cookie_key):
+        if candidate and candidate in config.session_api_keys:
             return
-        for candidate in (header_key, cookie_key):
-            if candidate and candidate in config.session_api_keys:
-                return
-        raise HTTPException(status.HTTP_401_UNAUTHORIZED)
-
-    return check_workspace_session
-
-
-def get_conversation_service(request: Request):
-    """Get the conversation service from app state.
+    raise HTTPException(status.HTTP_401_UNAUTHORIZED)
 
-    This dependency ensures that the conversation service is properly initialized
-    through the application lifespan context manager.
-    """
 
+def get_conversation_service(request: Request) -> ConversationService:
     service = getattr(request.app.state, "conversation_service", None)
     if service is None:
         raise HTTPException(
@@ -77,6 +70,16 @@ def get_conversation_service(request: Request):
     return service
 
 
+def get_bash_event_service(request: Request) -> BashEventService:
+    service = getattr(request.app.state, "bash_event_service", None)
+    if service is None:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Bash event service is not available",
+        )
+    return service
+
+
 async def get_event_service(
     conversation_id: UUID,
     conversation_service: ConversationService = Depends(get_conversation_service),

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/openhands/agent_server/docker/Dockerfile

@@ -8,6 +8,11 @@ ARG USERNAME=openhands
 ARG UID=10001
 ARG GID=10001
 ARG PORT=8000
+# Opt-in build flag for the Vertex AI extra (`openhands-sdk[vertex]`). Off by
+# default to keep the published image lean. Pass `--build-arg ENABLE_VERTEX=1`
+# to bundle google-cloud-aiplatform so the resulting binary supports
+# `vertex_ai/*` partner models (MiniMax, Qwen, Kimi MaaS endpoints).
+ARG ENABLE_VERTEX=0
 
 ####################################################################################
 # Builder (source mode)
@@ -26,7 +31,7 @@ ARG PORT=8000
 # See OpenHands/software-agent-sdk#2761.
 ####################################################################################
 FROM python:3.13-bookworm AS builder
-ARG USERNAME UID GID
+ARG USERNAME UID GID ENABLE_VERTEX
 ENV UV_PROJECT_ENVIRONMENT=/agent-server/.venv
 ENV UV_PYTHON_INSTALL_DIR=/agent-server/uv-managed-python
 
@@ -48,9 +53,11 @@ COPY --chown=${USERNAME}:${USERNAME} openhands-tools ./openhands-tools
 COPY --chown=${USERNAME}:${USERNAME} openhands-workspace ./openhands-workspace
 COPY --chown=${USERNAME}:${USERNAME} openhands-agent-server ./openhands-agent-server
 RUN --mount=type=cache,target=/home/${USERNAME}/.cache,uid=${UID},gid=${GID} \
+    EXTRA_FLAGS=""; \
+    if [ "$ENABLE_VERTEX" = "1" ]; then EXTRA_FLAGS="--extra vertex"; fi; \
     uv python install 3.13 && \
     uv venv --python-preference only-managed --python 3.13 .venv && \
-    uv sync --frozen --no-editable --managed-python --extra boto3 && \
+    uv sync --frozen --no-editable --managed-python --extra boto3 $EXTRA_FLAGS && \
     readlink -f .venv/bin/python | grep -q '^/agent-server/uv-managed-python/'
 
 ####################################################################################
@@ -58,11 +65,13 @@ RUN --mount=type=cache,target=/home/${USERNAME}/.cache,uid=${UID},gid=${GID} \
 # We run pyinstaller here to produce openhands-agent-server
 ####################################################################################
 FROM builder AS binary-builder
-ARG USERNAME UID GID
+ARG USERNAME UID GID ENABLE_VERTEX
 
 # We need --dev for pyinstaller
 RUN --mount=type=cache,target=/home/${USERNAME}/.cache,uid=${UID},gid=${GID} \
-    uv sync --frozen --dev --no-editable --extra boto3
+    EXTRA_FLAGS=""; \
+    if [ "$ENABLE_VERTEX" = "1" ]; then EXTRA_FLAGS="--extra vertex"; fi; \
+    uv sync --frozen --dev --no-editable --extra boto3 $EXTRA_FLAGS
 
 RUN --mount=type=cache,target=/home/${USERNAME}/.cache,uid=${UID},gid=${GID} \
     uv run pyinstaller openhands-agent-server/openhands/agent_server/agent-server.spec

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/openhands/agent_server/event_service.py

@@ -6,6 +6,8 @@ from datetime import datetime
 from pathlib import Path
 from uuid import UUID, uuid4
 
+from pydantic import ValidationError
+
 from openhands.agent_server.conversation_lease import (
     ConversationLease,
     ConversationOwnershipLostError,
@@ -20,6 +22,7 @@ from openhands.agent_server.pub_sub import PubSub, Subscriber
 from openhands.sdk import LLM, AgentBase, Event, Message, TextContent, get_logger
 from openhands.sdk.agent import ACPAgent
 from openhands.sdk.conversation.base import BaseConversation
+from openhands.sdk.conversation.events_list_base import EventsListBase
 from openhands.sdk.conversation.goal import (
     GoalController,
     GoalDone,
@@ -217,6 +220,18 @@ class EventService:
             return False
         return True
 
+    def _get_searchable_event(self, events: EventsListBase, index: int) -> Event | None:
+        try:
+            return events[index]
+        except (FileNotFoundError, UnicodeDecodeError, ValidationError) as exc:
+            logger.warning(
+                "Skipping unreadable event at index %d for conversation %s (%s)",
+                index,
+                self.stored.id,
+                type(exc).__name__,
+            )
+            return None
+
     def _search_events_sync(
         self,
         page_id: str | None = None,
@@ -272,7 +287,8 @@ class EventService:
                     start_index = None
             else:
                 for i in range(total):
-                    if events[i].id == page_id:
+                    event = self._get_searchable_event(events, i)
+                    if event is not None and event.id == page_id:
                         start_index = i
                         break
         if start_index is None:
@@ -286,7 +302,9 @@ class EventService:
         items: list[Event] = []
         next_page_id: str | None = None
         for i in indices:
-            event = events[i]
+            event = self._get_searchable_event(events, i)
+            if event is None:
+                continue
             if not self._event_matches_filters(
                 event, kind, source, body, timestamp_gte_str, timestamp_lt_str
             ):
@@ -360,7 +378,10 @@ class EventService:
         timestamp_lt_str = timestamp__lt.isoformat() if timestamp__lt else None
 
         count = 0
-        for event in events:
+        for i in range(len(events)):
+            event = self._get_searchable_event(events, i)
+            if event is None:
+                continue
             if self._event_matches_filters(
                 event, kind, source, body, timestamp_gte_str, timestamp_lt_str
             ):

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/openhands/agent_server/file_router.py

@@ -151,17 +151,20 @@ async def download_file_query(
     return await _download_file(path)
 
 
-def _list_home_favorites(home: Path, limit: int = 50) -> list[FileBrowserEntry]:
-    """Top-level visible directories inside the user's home, alphabetised.
-
-    Hidden entries (names starting with '.') and symlinks are skipped so the
-    list matches what ``search_subdirs`` returns for the same path.
+def _list_home_favorites(
+    home: Path, limit: int = 50, include_hidden: bool = False
+) -> list[FileBrowserEntry]:
+    """Top-level directories inside the user's home, alphabetised.
+
+    Symlinks are skipped. Hidden entries (names starting with '.') are skipped
+    unless ``include_hidden`` is True, so the list matches what
+    ``search_subdirs`` returns for the same path and the same flag.
     """
     entries: list[FileBrowserEntry] = []
     try:
         with os.scandir(home) as scanner:
             for entry in scanner:
-                if entry.name.startswith("."):
+                if not include_hidden and entry.name.startswith("."):
                     continue
                 try:
                     if not entry.is_dir(follow_symlinks=False):
@@ -197,18 +200,24 @@ def _list_root_locations() -> list[FileBrowserEntry]:
 
 
 @file_router.get("/home")
-async def get_home_directory() -> HomeResponse:
+async def get_home_directory(
+    include_hidden: Annotated[
+        bool,
+        Query(description="Include hidden top-level directories in `favorites`"),
+    ] = False,
+) -> HomeResponse:
     """Return the agent-server user's home directory and dynamic sidebar lists.
 
-    ``favorites`` is the set of visible top-level directories actually present
-    in the user's home (so it reflects the real environment instead of a
-    hardcoded list of names that may not exist). ``locations`` is the set of
-    filesystem roots — '/' on POSIX or available drive letters on Windows.
+    ``favorites`` is the set of top-level directories actually present in the
+    user's home (so it reflects the real environment instead of a hardcoded
+    list of names that may not exist). Hidden directories are included only
+    when ``include_hidden`` is True. ``locations`` is the set of filesystem
+    roots — '/' on POSIX or available drive letters on Windows.
     """
     home = Path.home()
     return HomeResponse(
         home=str(home),
-        favorites=_list_home_favorites(home),
+        favorites=_list_home_favorites(home, include_hidden=include_hidden),
         locations=_list_root_locations(),
     )
 
@@ -227,12 +236,17 @@ async def search_subdirs(
         int,
         Query(title="The max number of results in the page", gt=0, lte=100),
     ] = 100,
+    include_hidden: Annotated[
+        bool,
+        Query(title="Include hidden subdirectories (names starting with '.')"),
+    ] = False,
 ) -> SubdirectoryPage:
     """Search / List immediate subdirectories of `path`.
 
-    Used by the GUI's workspace picker. Hidden entries (names starting with '.')
-    and symlinks are skipped. Files are skipped. Returns absolute paths so the
-    GUI can use a result directly as ``workspace.working_dir``.
+    Used by the GUI's workspace picker. Symlinks and files are skipped. Hidden
+    entries (names starting with '.') are skipped unless ``include_hidden`` is
+    True. Returns absolute paths so the GUI can use a result directly as
+    ``workspace.working_dir``.
 
     Results are sorted case-insensitively by name and paginated. ``page_id`` is
     the ``next_page_id`` returned by the previous page (the lowercase name of
@@ -262,7 +276,7 @@ async def search_subdirs(
     try:
         with os.scandir(target) as scanner:
             for entry in scanner:
-                if entry.name.startswith("."):
+                if not include_hidden and entry.name.startswith("."):
                     continue
                 try:
                     if not entry.is_dir(follow_symlinks=False):

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/openhands/agent_server/init_router.py

@@ -21,6 +21,7 @@ from fastapi import APIRouter, Depends, FastAPI, HTTPException, Request, status
 from fastapi.security import APIKeyHeader
 from pydantic import BaseModel, ConfigDict, Field, SecretStr
 
+from openhands.agent_server.bash_service import BashEventService
 from openhands.agent_server.config import Config, WebhookSpec
 from openhands.agent_server.conversation_service import ConversationService
 from openhands.agent_server.server_details_router import mark_initialization_complete
@@ -175,6 +176,7 @@ class InitService:
         self._error: str | None = None
         self._lock = asyncio.Lock()
         self._entered_service: ConversationService | None = None
+        self._entered_bash_service: BashEventService | None = None
 
     @property
     def state(self) -> InitState:
@@ -209,10 +211,22 @@ class InitService:
             service = ConversationService.get_instance(new_config)
             cs_mod._conversation_service = service
 
+            bash_svc = BashEventService(bash_events_dir=new_config.bash_events_dir)
+            await bash_svc.__aenter__()
+            self._entered_bash_service = bash_svc
+
             await service.__aenter__()
             self._entered_service = service
             self._app.state.config = new_config
             self._app.state.conversation_service = service
+            self._app.state.bash_event_service = bash_svc
+
+            # Re-derive root_path from the merged config so Doc URLS are valid
+            from openhands.agent_server.api import _get_root_path
+
+            new_root_path = _get_root_path(new_config)
+            self._app.root_path = new_root_path
+
             mark_initialization_complete()
             self._state = "ready"
             logger.info("deferred_init: server transitioned to ready")
@@ -235,6 +249,9 @@ class InitService:
         if self._entered_service is not None:
             await self._entered_service.__aexit__(None, None, None)
             self._entered_service = None
+        if self._entered_bash_service is not None:
+            await self._entered_bash_service.__aexit__(None, None, None)
+            self._entered_bash_service = None
 
 
 def get_init_service(request: Request) -> InitService:

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/openhands/agent_server/openai/router.py

@@ -28,7 +28,11 @@ _SESSION_API_KEY_HEADER = APIKeyHeader(name="X-Session-API-Key", auto_error=Fals
 _AUTHORIZATION_HEADER = HTTPBearer(auto_error=False)
 
 
-def create_openai_api_key_dependency(config: Config):
+def check_openai_api_key(
+    request: Request,
+    session_api_key: str | None = Depends(_SESSION_API_KEY_HEADER),
+    authorization: HTTPAuthorizationCredentials | None = Depends(_AUTHORIZATION_HEADER),
+) -> None:
     """Accept the same session key through OpenHands and OpenAI auth shapes.
 
     ``X-Session-API-Key`` preserves compatibility with existing agent-server
@@ -37,24 +41,19 @@ def create_openai_api_key_dependency(config: Config):
     ``config.session_api_keys``; this does not introduce a second credential
     system. When no session keys are configured, the local server remains
     unauthenticated like the existing agent-server API.
-    """
 
-    def check_openai_api_key(
-        session_api_key: str | None = Depends(_SESSION_API_KEY_HEADER),
-        authorization: HTTPAuthorizationCredentials | None = Depends(
-            _AUTHORIZATION_HEADER
-        ),
-    ) -> None:
-        if not config.session_api_keys:
-            return
-        bearer_token = authorization.credentials if authorization else None
-        if session_api_key in config.session_api_keys:
-            return
-        if bearer_token in config.session_api_keys:
-            return
-        raise HTTPException(status.HTTP_401_UNAUTHORIZED)
-
-    return check_openai_api_key
+    Reads config from ``request.app.state`` at request time so that keys
+    delivered via ``POST /api/init`` take effect immediately.
+    """
+    config: Config = request.app.state.config
+    if not config.session_api_keys:
+        return
+    bearer_token = authorization.credentials if authorization else None
+    if session_api_key in config.session_api_keys:
+        return
+    if bearer_token in config.session_api_keys:
+        return
+    raise HTTPException(status.HTTP_401_UNAUTHORIZED)
 
 
 def _get_config(request: Request) -> Config:

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/openhands/agent_server/openai/service.py

@@ -25,7 +25,11 @@ from openhands.agent_server.openai.models import (
     OpenAIResponseMessage,
     OpenAIUsage,
 )
-from openhands.agent_server.persistence import PersistedSettings, get_settings_store
+from openhands.agent_server.persistence import (
+    PersistedSettings,
+    get_llm_profile_store,
+    get_settings_store,
+)
 from openhands.sdk import LLM, Message
 from openhands.sdk.context.agent_context import AgentContext
 from openhands.sdk.conversation.request import (
@@ -36,7 +40,6 @@ from openhands.sdk.conversation.state import (
     ConversationExecutionStatus,
     ConversationState,
 )
-from openhands.sdk.llm.llm_profile_store import LLMProfileStore
 from openhands.sdk.llm.message import ImageContent, TextContent
 from openhands.sdk.settings import ACPAgentSettings, OpenHandsAgentSettings
 from openhands.sdk.workspace import LocalWorkspace
@@ -66,7 +69,7 @@ def _profile_name_from_model(model: str) -> str:
 
 def _load_profile_llm(profile_name: str, config: Config) -> LLM:
     try:
-        return LLMProfileStore().load(profile_name, cipher=config.cipher)
+        return get_llm_profile_store().load(profile_name, cipher=config.cipher)
     except FileNotFoundError:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -369,7 +372,7 @@ def iter_openai_chat_completion_sse(
 
 async def list_openai_models() -> OpenAIModelListResponse:
     try:
-        profiles = LLMProfileStore().list_summaries()
+        profiles = get_llm_profile_store().list_summaries()
     except TimeoutError:
         raise HTTPException(
             status_code=status.HTTP_503_SERVICE_UNAVAILABLE,

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/openhands/agent_server/persistence/__init__.py

@@ -25,6 +25,8 @@ from openhands.agent_server.persistence.store import (
     SecretsStore,
     SettingsStore,
     WorkspacesStore,
+    get_agent_profile_store,
+    get_llm_profile_store,
     get_secrets_store,
     get_settings_store,
     get_workspaces_store,
@@ -52,6 +54,8 @@ __all__ = [
     "SecretsStore",
     "SettingsStore",
     "WorkspacesStore",
+    "get_agent_profile_store",
+    "get_llm_profile_store",
     "get_secrets_store",
     "get_settings_store",
     "get_workspaces_store",

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/openhands/agent_server/persistence/store.py

@@ -27,7 +27,9 @@ from openhands.agent_server.persistence.models import (
     PersistedWorkspaces,
     Secrets,
 )
+from openhands.sdk.llm.llm_profile_store import LLMProfileStore
 from openhands.sdk.logger import get_logger
+from openhands.sdk.profiles.agent_profile_store import AgentProfileStore
 from openhands.sdk.utils.cipher import Cipher
 
 
@@ -687,6 +689,8 @@ class FileWorkspacesStore(WorkspacesStore):
 _settings_store: FileSettingsStore | None = None
 _secrets_store: FileSecretsStore | None = None
 _workspaces_store: FileWorkspacesStore | None = None
+_llm_profile_store: LLMProfileStore | None = None
+_agent_profile_store: AgentProfileStore | None = None
 _store_lock = threading.Lock()
 
 
@@ -704,6 +708,20 @@ def _get_persistence_dir(config: Config | None = None) -> Path:
     return DEFAULT_PERSISTENCE_DIR
 
 
+def _get_profile_persistence_dir() -> Path:
+    """Get the base dir for LLM/agent profile stores.
+
+    Profiles can hold credentials (LLM API keys), so absent
+    ``OH_PERSISTENCE_DIR`` they fall back to the user's ``~/.openhands``
+    rather than the workspace-relative agent-server default, keeping bare
+    local profile secrets in the expected user config directory.
+    """
+    env_dir = os.environ.get("OH_PERSISTENCE_DIR")
+    if env_dir:
+        return Path(env_dir)
+    return Path.home() / ".openhands"
+
+
 def _get_cipher(config: Config | None = None) -> Cipher | None:
     """Get cipher from config for encrypting secrets."""
     if config is not None:
@@ -794,10 +812,53 @@ def get_workspaces_store(config: Config | None = None) -> FileWorkspacesStore:
         return _workspaces_store
 
 
+def get_llm_profile_store() -> LLMProfileStore:
+    """Get the global ``LLMProfileStore`` instance (thread-safe).
+
+    Stored at ``<dir>/profiles`` where ``<dir>`` is ``OH_PERSISTENCE_DIR``
+    when set, else ``~/.openhands``. This honors isolated agent-server
+    instances while keeping bare local profile secrets in the user's
+    config directory (never workspace-relative). See
+    :func:`_get_profile_persistence_dir`.
+    """
+    global _llm_profile_store
+    if _llm_profile_store is not None:
+        return _llm_profile_store
+
+    with _store_lock:
+        if _llm_profile_store is None:
+            _llm_profile_store = LLMProfileStore(
+                base_dir=_get_profile_persistence_dir() / "profiles",
+            )
+        return _llm_profile_store
+
+
+def get_agent_profile_store() -> AgentProfileStore:
+    """Get the global ``AgentProfileStore`` instance (thread-safe).
+
+    Stored at ``<dir>/agent-profiles`` where ``<dir>`` is resolved by
+    :func:`_get_profile_persistence_dir`, for the same reason as
+    :func:`get_llm_profile_store`.
+    """
+    global _agent_profile_store
+    if _agent_profile_store is not None:
+        return _agent_profile_store
+
+    with _store_lock:
+        if _agent_profile_store is None:
+            _agent_profile_store = AgentProfileStore(
+                base_dir=_get_profile_persistence_dir() / "agent-profiles",
+            )
+        return _agent_profile_store
+
+
 def reset_stores() -> None:
     """Reset global store instances (for testing)."""
     global _settings_store, _secrets_store, _workspaces_store
+    global _llm_profile_store, _agent_profile_store
     with _store_lock:
         _settings_store = None
         _secrets_store = None
         _workspaces_store = None
+        _llm_profile_store = None
+        _agent_profile_store = None

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/openhands/agent_server/profiles_router.py

@@ -17,17 +17,17 @@ from openhands.agent_server._secrets_exposure import (
 )
 from openhands.agent_server.persistence import (
     PersistedSettings,
+    get_agent_profile_store,
+    get_llm_profile_store,
     get_settings_store,
 )
 from openhands.sdk.llm import LLM
 from openhands.sdk.llm.llm_profile_store import (
     PROFILE_NAME_PATTERN,
-    LLMProfileStore,
     ProfileLimitExceeded,
 )
 from openhands.sdk.logger import get_logger
 from openhands.sdk.profiles import (
-    AgentProfileStore,
     ProfileReferenced,
     delete_llm_profile,
     rename_llm_profile,
@@ -140,7 +140,7 @@ async def list_profiles(request: Request) -> ProfileListResponse:
     settings_store = get_settings_store(config)
     settings = settings_store.load() or PersistedSettings()
 
-    store = LLMProfileStore()
+    store = get_llm_profile_store()
     with _store_errors():
         summaries = store.list_summaries()
 
@@ -162,7 +162,7 @@ async def get_profile(request: Request, name: ProfileName) -> ProfileDetailRespo
     expose_mode = parse_expose_secrets_header(request)
     cipher = get_cipher(request)
 
-    store = LLMProfileStore()
+    store = get_llm_profile_store()
     try:
         with _store_errors():
             llm = store.load(name, cipher=cipher)
@@ -206,7 +206,7 @@ async def save_profile(
     """
     cipher = get_cipher(request)
     llm = decrypt_incoming_llm_secrets(body.llm, cipher) if cipher else body.llm
-    store = LLMProfileStore()
+    store = get_llm_profile_store()
     try:
         with _store_errors():
             store.save(
@@ -238,8 +238,8 @@ async def delete_profile(
     Guarded by the agent-profile FK: returns 409 naming the referrers if any
     ``AgentProfile`` still cites this LLM profile via ``llm_profile_ref``.
     """
-    store = LLMProfileStore()
-    agent_store = AgentProfileStore()
+    store = get_llm_profile_store()
+    agent_store = get_agent_profile_store()
     try:
         with _store_errors():
             delete_llm_profile(agent_store, store, name)
@@ -266,8 +266,8 @@ async def rename_profile(
     setting is updated to the new name. Any ``AgentProfile.llm_profile_ref``
     citing the old name is cascaded to the new name in lock-step.
     """
-    store = LLMProfileStore()
-    agent_store = AgentProfileStore()
+    store = get_llm_profile_store()
+    agent_store = get_agent_profile_store()
     try:
         with _store_errors():
             rename_llm_profile(agent_store, store, name, body.new_name)
@@ -323,7 +323,7 @@ async def activate_profile(
     config = get_config(request)
 
     # Load the profile
-    profile_store = LLMProfileStore()
+    profile_store = get_llm_profile_store()
     try:
         with _store_errors():
             llm = profile_store.load(name, cipher=cipher)

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/openhands/agent_server/sockets.py

@@ -28,9 +28,13 @@ from fastapi import (
 )
 from starlette.websockets import WebSocketState
 
-from openhands.agent_server.bash_service import get_default_bash_event_service
+from openhands.agent_server.bash_service import (
+    BashEventService,
+    get_default_bash_event_service,
+)
 from openhands.agent_server.config import Config, get_default_config
 from openhands.agent_server.conversation_service import (
+    ConversationService,
     get_default_conversation_service,
 )
 from openhands.agent_server.event_router import normalize_datetime_to_server_timezone
@@ -64,6 +68,38 @@ def _get_config(websocket: WebSocket) -> Config:
     return get_default_config()
 
 
+def _get_conversation_service(websocket: WebSocket) -> ConversationService:
+    """Return the ConversationService for this FastAPI app instance.
+
+    Looks up ``app.state.conversation_service`` at request time so that the
+    service delivered via ``POST /api/init`` (deferred-init / dormant mode)
+    is used instead of the module-level default captured at import. When
+    ``app.state`` is not configured (e.g. when sockets.py is imported as a
+    library without a lifespan), falls back to the module-level singleton,
+    which keeps the behaviour of existing tests that patch the module-level
+    variable.
+    """
+    service = getattr(websocket.app.state, "conversation_service", None)
+    if isinstance(service, ConversationService):
+        return service
+    return conversation_service
+
+
+def _get_bash_event_service(websocket: WebSocket) -> BashEventService:
+    """Return the BashEventService for this FastAPI app instance.
+
+    Looks up ``app.state.bash_event_service`` at request time so that the
+    service delivered via ``POST /api/init`` (deferred-init / dormant mode)
+    is used instead of the module-level default captured at import. When
+    ``app.state`` is not configured (e.g. when sockets.py is imported as a
+    library without a lifespan), falls back to the module-level singleton.
+    """
+    service = getattr(websocket.app.state, "bash_event_service", None)
+    if isinstance(service, BashEventService):
+        return service
+    return bash_event_service
+
+
 def _resolve_websocket_session_api_key(
     websocket: WebSocket,
     session_api_key: str | None,
@@ -242,7 +278,8 @@ async def events_socket(
         return
 
     logger.info(f"Event Websocket Connected: {conversation_id}")
-    event_service = await conversation_service.get_event_service(conversation_id)
+    conv_service = _get_conversation_service(websocket)
+    event_service = await conv_service.get_event_service(conversation_id)
     if event_service is None:
         logger.warning(f"Converation not found: {conversation_id}")
         await websocket.close(code=4004, reason="Conversation not found")
@@ -372,9 +409,10 @@ async def bash_events_socket(
     if not await _accept_authenticated_websocket(websocket, session_api_key):
         return
 
+    bash_service = _get_bash_event_service(websocket)
     logger.info("Bash Websocket Connected")
     try:
-        subscriber_id = await bash_event_service.subscribe_to_events(
+        subscriber_id = await bash_service.subscribe_to_events(
             _BashWebSocketSubscriber(websocket)
         )
     except MaxSubscribersError:
@@ -392,7 +430,7 @@ async def bash_events_socket(
         # Resend all existing events if requested
         if effective_mode == "all":
             logger.info("Resending bash events")
-            async for event in page_iterator(bash_event_service.search_bash_events):
+            async for event in page_iterator(bash_service.search_bash_events):
                 await _send_bash_event(event, websocket)
 
         while True:
@@ -401,7 +439,7 @@ async def bash_events_socket(
                 data = await websocket.receive_json()
                 logger.info("Received bash request")
                 request = ExecuteBashRequest.model_validate(data)
-                await bash_event_service.start_bash_command(request)
+                await bash_service.start_bash_command(request)
             except WebSocketDisconnect:
                 logger.info("Bash websocket disconnected")
                 return
@@ -428,7 +466,7 @@ async def bash_events_socket(
                     await _safe_close_websocket(websocket)
                     return
     finally:
-        await bash_event_service.unsubscribe_from_events(subscriber_id)
+        await bash_service.unsubscribe_from_events(subscriber_id)
 
 
 async def _send_event(event: Event, websocket: WebSocket):

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/openhands_agent_server.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhands-agent-server
-Version: 1.29.0
+Version: 1.29.2
 Summary: OpenHands Agent Server - REST/WebSocket interface for OpenHands AI Agent
 Project-URL: Source, https://github.com/OpenHands/software-agent-sdk
 Project-URL: Homepage, https://github.com/OpenHands/software-agent-sdk

{openhands_agent_server-1.29.0 → openhands_agent_server-1.29.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "openhands-agent-server"
-version = "1.29.0"
+version = "1.29.2"
 description = "OpenHands Agent Server - REST/WebSocket interface for OpenHands AI Agent"
 
 requires-python = ">=3.12"