openhands-agent-server 1.32.0__tar.gz → 1.34.0__tar.gz

{openhands_agent_server-1.32.0 → openhands_agent_server-1.34.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhands-agent-server
-Version: 1.32.0
+Version: 1.34.0
 Summary: OpenHands Agent Server - REST/WebSocket interface for OpenHands AI Agent
 Project-URL: Source, https://github.com/OpenHands/software-agent-sdk
 Project-URL: Homepage, https://github.com/OpenHands/software-agent-sdk

{openhands_agent_server-1.32.0 → openhands_agent_server-1.34.0}/openhands/agent_server/agent_profiles_router.py

@@ -19,21 +19,15 @@ from typing import Annotated, Any
 from fastapi import APIRouter, HTTPException, Path, Request, status
 from pydantic import BaseModel, Field, ValidationError
 
-from openhands.agent_server._secrets_exposure import (
-    build_expose_context,
-    get_cipher,
-    get_config,
-    parse_expose_secrets_header,
-    translate_missing_cipher,
-)
+from openhands.agent_server._secrets_exposure import get_cipher, get_config
 from openhands.agent_server.persistence import (
     PersistedSettings,
     get_agent_profile_store,
     get_llm_profile_store,
     get_settings_store,
 )
-from openhands.agent_server.profiles_router import MAX_PROFILES
-from openhands.agent_server.skills_service import discover_profile_skills_if_needed
+from openhands.agent_server.profiles_router import MAX_PROFILES, _has_api_key
+from openhands.agent_server.skills_service import discover_profile_skills
 from openhands.sdk.llm import LLM
 from openhands.sdk.llm.llm_profile_store import (
     ProfileLimitExceeded as LLMProfileLimitExceeded,
@@ -130,6 +124,25 @@ def _store_errors() -> Iterator[None]:
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
 
 
+def _llm_has_real_config(llm: LLM) -> bool:
+    """True when ``llm`` carries real, user-provided configuration.
+
+    Distinguishes an already-working setup — a real API key, subscription auth,
+    or a custom endpoint — from bare SDK field defaults on a never-configured
+    account (``model="gpt-5.5"``, no ``api_key``). Only the former is worth
+    mirroring into a named ``default`` LLM profile; persisting the latter leaves
+    a keyless, non-functional "ghost" profile that the user never asked for and
+    that nothing ever cleans up (#4031).
+    """
+    if _has_api_key(llm):
+        return True
+    if llm.is_subscription or llm.auth_type == "subscription":
+        return True
+    if llm.base_url and llm.base_url.strip():
+        return True
+    return False
+
+
 def _seed_default_llm_profile(llm: LLM, cipher: Cipher | None) -> str:
     """Mirror the live LLM config into a ``SEED_PROFILE_NAME`` LLM profile.
 
@@ -141,6 +154,17 @@ def _seed_default_llm_profile(llm: LLM, cipher: Cipher | None) -> str:
     ``agent_settings.llm`` under that name so the reference resolves, unless a
     profile is already stored there (never clobber it).
 
+    Only a *real, pre-existing* LLM config is persisted (``_llm_has_real_config``
+    — an API key, subscription auth, or a custom base_url), which is exactly the
+    legacy/cloud migration case the backfill exists for. On a fresh,
+    never-configured account the live LLM is untouched SDK defaults (keyless
+    ``gpt-5.5``); persisting *that* only litters the profile list with a keyless,
+    unusable ``default`` "ghost" profile (#4031), so we skip the save and leave
+    ``llm_profile_ref="default"`` as a soft/dangling ref — the canvas
+    "LLM not configured" banner and the legible launch-time error already cover
+    that state, and materialize/dry-run reports it as ``dangling_llm_profile_ref``
+    rather than raising.
+
     Existence is checked via ``load()``, not ``list()``: the store resolves a
     name straight to a filesystem path, so on a case-insensitive filesystem
     (macOS/Windows) a differently-cased ``Default`` profile already occupies
@@ -164,6 +188,15 @@ def _seed_default_llm_profile(llm: LLM, cipher: Cipher | None) -> str:
                 "failed to load; leaving it as-is"
             )
             return SEED_PROFILE_NAME
+        if not _llm_has_real_config(llm):
+            # Never-configured account: don't persist a keyless ghost profile.
+            # Leave the ref soft/dangling; the banner + launch-time error handle
+            # it, and it resolves for real once the user saves a profile.
+            logger.info(
+                f"Skipping default LLM profile '{SEED_PROFILE_NAME}' seed: "
+                "no real LLM config yet (leaving llm_profile_ref as a soft ref)"
+            )
+            return SEED_PROFILE_NAME
         try:
             llm_store.save(
                 SEED_PROFILE_NAME,
@@ -213,7 +246,7 @@ def _seed_default_profile(
                 settings.agent_settings.llm, cipher
             )
         profile = build_seed_profile(settings.agent_settings, active_llm_profile)
-        store.save(profile, cipher=cipher, max_profiles=MAX_AGENT_PROFILES)
+        store.save(profile, max_profiles=MAX_AGENT_PROFILES)
 
         profile_id = str(profile.id)
         settings_store = get_settings_store(get_config(request))
@@ -266,31 +299,24 @@ async def list_agent_profiles(request: Request) -> AgentProfileListResponse:
 
 
 @agent_profiles_router.get("/{name}", response_model=AgentProfileDetailResponse)
-async def get_agent_profile(
-    request: Request, name: ProfileName
-) -> AgentProfileDetailResponse:
+async def get_agent_profile(name: ProfileName) -> AgentProfileDetailResponse:
     """Get a stored profile.
 
-    Use the ``X-Expose-Secrets`` header to control ``skills[].mcp_tools`` secret
-    exposure (``encrypted`` / ``plaintext``); absent, those values are masked.
+    A profile is secret-free at rest (#4017), so there is nothing to mask or
+    expose — unlike the LLM ``/api/profiles`` router, this endpoint has no
+    ``X-Expose-Secrets`` behavior.
     """
-    expose_mode = parse_expose_secrets_header(request)
-    cipher = get_cipher(request)
-
     store = get_agent_profile_store()
     try:
         with _store_errors():
-            profile = store.load(name, cipher=cipher)
+            profile = store.load(name)
     except FileNotFoundError:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
             detail=f"Agent profile '{name}' not found",
         )
 
-    context = build_expose_context(expose_mode, cipher)
-    with translate_missing_cipher():
-        payload = profile.model_dump(mode="json", context=context)
-
+    payload = profile.model_dump(mode="json")
     return AgentProfileDetailResponse(name=name, profile=payload)
 
 
@@ -300,31 +326,29 @@ async def get_agent_profile(
     status_code=status.HTTP_201_CREATED,
 )
 async def save_agent_profile(
-    request: Request, name: ProfileName, body: dict[str, Any]
+    name: ProfileName, body: dict[str, Any]
 ) -> AgentProfileMutationResponse:
     """Save an ``AgentProfile`` under ``name`` (overwriting a namesake).
 
     The path ``name`` is authoritative — it overrides any ``name`` in the body.
-    With ``OH_SECRET_KEY`` configured, ``skills[].mcp_tools`` secrets are
-    encrypted at rest; otherwise they are redacted. Returns 409 if creating a
-    new profile would exceed ``MAX_AGENT_PROFILES``.
+    The profile is secret-free at rest (#4017), so no cipher/encryption is
+    involved. Returns 409 if creating a new profile would exceed
+    ``MAX_AGENT_PROFILES``.
     """
-    cipher = get_cipher(request)
     try:
         profile = validate_agent_profile({**body, "name": name})
     except ValidationError as e:
-        # Match FastAPI's request-validation shape (``detail`` is a list of error
-        # objects), but surface only ``loc``/``type`` — a nested mcp_tools
-        # FastMCP config error embeds the input (which may carry secrets) in
-        # ``msg``.
+        # Match FastAPI's request-validation shape (``detail`` is a list of
+        # error objects): ``loc``/``type``/``msg`` (``input`` dropped — see
+        # safe_validation_error_detail's docstring for why msg is now safe).
         raise HTTPException(
             status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
             detail=safe_validation_error_detail(e),
         )
     except Exception:
-        # Any other validation failure (e.g. SkillValidationError from a
-        # malformed mcp_tools, or a schema/migration error) is a client error,
-        # never a 500. Stay generic — these messages can embed the input.
+        # Any other validation failure (e.g. a schema/migration error) is a
+        # client error, never a 500. Stay generic — these messages can embed
+        # the input.
         raise HTTPException(
             status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
             detail="Invalid agent profile",
@@ -339,7 +363,7 @@ async def save_agent_profile(
     try:
         with _store_errors():
             save_profile_preserving_identity(
-                store, profile, cipher=cipher, max_profiles=MAX_AGENT_PROFILES
+                store, profile, max_profiles=MAX_AGENT_PROFILES
             )
     except ProfileLimitExceeded:
         raise HTTPException(
@@ -489,36 +513,37 @@ async def materialize_agent_profile(
     than raising — the only error status is 404 (unknown profile name).
     resolved_settings is redacted (api_key_set booleans; no raw secrets).
     """
-    cipher = get_cipher(request)
-
     store = get_agent_profile_store()
     try:
         with _store_errors():
-            profile = store.load(name, cipher=cipher)
+            profile = store.load(name)
     except FileNotFoundError:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
             detail=f"Agent profile '{name}' not found",
         )
 
+    # Still needed here (unlike the profile load above): resolve_agent_profile_
+    # dry_run uses it to decrypt the *referenced LLM profile's* own secret.
+    cipher = get_cipher(request)
     config = get_config(request)
     settings = get_settings_store(config).load() or PersistedSettings()
     mcp_config = settings.agent_settings.mcp_config
 
-    # Discover skills off the event loop so the dry-run can report which
-    # ``skill_refs`` resolve vs. dangle. A discovery failure must not 500 the
-    # preview: pass ``available_skills=None`` (catalog unknown — the dry-run then
-    # reports nothing dangling, rather than flagging every selected skill) and
-    # surface the failure as its own diagnostic below.
+    # Discover skills off the event loop so the dry-run can report which skills
+    # (catalog minus ``disabled_skills``) resolve. Only OpenHands profiles carry
+    # user/public skills; ACP profiles do not. A discovery failure must not 500
+    # the preview: pass ``available_skills=None`` and surface the failure as its
+    # own diagnostic below.
     discovery_error: str | None = None
-    try:
-        available_skills = await asyncio.to_thread(
-            discover_profile_skills_if_needed, profile
-        )
-    except Exception as exc:
-        available_skills = None
-        discovery_error = str(exc)
-        logger.warning("Skill discovery failed during materialize: %s", exc)
+    available_skills = None
+    if profile.agent_kind == "openhands":
+        try:
+            available_skills = await asyncio.to_thread(discover_profile_skills)
+        except Exception as exc:
+            available_skills = None
+            discovery_error = str(exc)
+            logger.warning("Skill discovery failed during materialize: %s", exc)
 
     llm_store = get_llm_profile_store()
     diagnostics = resolve_agent_profile_dry_run(

{openhands_agent_server-1.32.0 → openhands_agent_server-1.34.0}/openhands/agent_server/conversation_router.py

@@ -51,7 +51,6 @@ from openhands.sdk.marketplace.registry import (
 from openhands.sdk.plugin import PluginFetchError
 from openhands.sdk.profiles.resolver import (
     DanglingMcpServerRef,
-    DanglingSkillRef,
     ProfileNotFound,
 )
 from openhands.sdk.tool.client_tool import ClientToolRegistrationError
@@ -217,11 +216,6 @@ async def start_conversation(
             status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
             detail={"message": str(e), "dangling_mcp_server_refs": e.missing},
         ) from e
-    except DanglingSkillRef as e:
-        raise HTTPException(
-            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
-            detail={"message": str(e), "dangling_skill_refs": e.missing},
-        ) from e
     except ClientToolRegistrationError as e:
         raise HTTPException(
             status_code=status.HTTP_422_UNPROCESSABLE_ENTITY, detail=str(e)

{openhands_agent_server-1.32.0 → openhands_agent_server-1.34.0}/openhands/agent_server/conversation_service.py

@@ -32,7 +32,7 @@ from openhands.agent_server.models import (
 )
 from openhands.agent_server.pub_sub import Subscriber
 from openhands.agent_server.server_details_router import update_last_execution_time
-from openhands.agent_server.skills_service import discover_profile_skills_if_needed
+from openhands.agent_server.skills_service import discover_profile_skills
 from openhands.agent_server.utils import safe_rmtree, utc_now
 from openhands.sdk import LLM, AgentContext, Event, Message
 from openhands.sdk.agent.base import AgentBase
@@ -267,7 +267,6 @@ def _resolve_agent_from_profile(
     Raises:
         ProfileNotFound: No stored profile has ``profile_id``.
         DanglingMcpServerRef: A referenced MCP server is absent from the global config.
-        DanglingSkillRef: A referenced skill is absent from the discovered catalog.
         ValueError: Profile load or settings validation failure.
     """
     from openhands.agent_server.persistence.store import (
@@ -275,6 +274,7 @@ def _resolve_agent_from_profile(
         get_llm_profile_store,
     )
     from openhands.sdk.profiles.resolver import ProfileNotFound, resolve_agent_profile
+    from openhands.sdk.settings.model import OpenHandsAgentSettings
 
     store = get_agent_profile_store()
     profile_name = store.name_for_id(profile_id)
@@ -282,7 +282,7 @@ def _resolve_agent_from_profile(
         raise ProfileNotFound(f"Agent profile with id '{profile_id}' not found")
 
     try:
-        profile = store.load(profile_name, cipher=cipher)
+        profile = store.load(profile_name)
     except FileNotFoundError:
         raise ProfileNotFound(
             f"Agent profile '{profile_name}' (id={profile_id}) not found"
@@ -292,15 +292,18 @@ def _resolve_agent_from_profile(
             f"Failed to load agent profile '{profile_name}': {exc}"
         ) from exc
 
-    # Both variants honor ``skill_refs``; the helper skips discovery when it
-    # selects none. A genuine discovery failure fails the launch loudly rather
-    # than silently producing a zero-skill agent.
-    try:
-        available_skills = discover_profile_skills_if_needed(profile)
-    except Exception as exc:
-        raise ValueError(
-            f"Skill discovery failed for profile '{profile_name}': {exc}"
-        ) from exc
+    # OpenHands profiles get the discovered catalog minus their ``disabled_skills``
+    # deny-list; ACP profiles carry no user/public skills so discovery is skipped.
+    # A genuine discovery failure fails the launch loudly rather than silently
+    # producing a zero-skill agent.
+    available_skills = None
+    if profile.agent_kind == "openhands":
+        try:
+            available_skills = discover_profile_skills()
+        except Exception as exc:
+            raise ValueError(
+                f"Skill discovery failed for profile '{profile_name}': {exc}"
+            ) from exc
 
     llm_store = get_llm_profile_store()
     try:
@@ -314,6 +317,16 @@ def _resolve_agent_from_profile(
     except (TypeError, ValueError) as exc:
         raise ValueError(f"Profile '{profile_name}' failed to resolve: {exc}") from exc
 
+    if isinstance(settings_config, OpenHandsAgentSettings):
+        # Force streaming so this launch path wires on_token: a client can't set
+        # llm.stream on a profile's referenced LLM ahead of time. Safe at this
+        # layer (not the SDK resolver) because this server wires the token
+        # callback whenever any llm.stream is set; a headless resolver caller
+        # that never wires on_token is covered by LLM's graceful degradation.
+        settings_config = settings_config.model_copy(
+            update={"llm": settings_config.llm.model_copy(update={"stream": True})}
+        )
+
     agent = settings_config.create_agent()
     # Browser is deliberately absent from the deterministic SDK default
     # (environment-dependent); this server knows its runtime, so it injects

{openhands_agent_server-1.32.0 → openhands_agent_server-1.34.0}/openhands/agent_server/skills_service.py

@@ -21,7 +21,6 @@ import tempfile
 from dataclasses import dataclass
 from pathlib import Path
 from time import monotonic
-from typing import TYPE_CHECKING
 
 from pydantic import BaseModel, ValidationError
 
@@ -57,10 +56,6 @@ from openhands.sdk.utils import sanitized_env
 from openhands.sdk.utils.path import to_posix_path
 
 
-if TYPE_CHECKING:
-    from openhands.sdk.profiles import ACPAgentProfile, OpenHandsAgentProfile
-
-
 logger = get_logger(__name__)
 
 
@@ -458,20 +453,21 @@ def load_all_skills(
 
 
 def discover_profile_skills() -> list[Skill]:
-    """Skill catalog for ``AgentProfile.skill_refs`` resolution (#3868).
+    """Skill catalog an OpenHands profile launches with (#4017).
 
     Returns the merged user + public skills — the deterministic sources of
-    :func:`load_all_skills` that ``resolve_agent_profile`` filters by name.
-    ``load_all_skills`` already absorbs and logs benign per-source failures, so
-    this does not swallow errors: an unexpected failure propagates rather than
-    silently resolving the profile to a zero-skill agent.
+    :func:`load_all_skills`. ``resolve_agent_profile`` keeps all of them except
+    the profile's ``disabled_skills`` deny-list. ``load_all_skills`` already
+    absorbs and logs benign per-source failures, so this does not swallow errors:
+    an unexpected failure propagates rather than silently resolving the profile
+    to a zero-skill agent.
 
     Org / project skills need auth / workspace context not available at resolve
-    time, so they are not in this catalog (a follow-up). Because the resolver
-    now hard-fails dangling ``skill_refs`` (mirroring MCP), a profile that
-    selects an org/project skill via the picker would fail launch here until the
-    catalog is broadened — the SaaS app-server, which has that context, is
-    expected to supply the fuller catalog the same way it does for the picker.
+    time, so they are not in this catalog. That is safe under the deny-list
+    model: a skill missing from the catalog is simply never disabled (it stays
+    on when it does load, e.g. project skills loaded lazily by
+    ``LocalConversation``) — the old allow-list would instead have dangled and
+    failed the launch.
     """
     return list(
         load_all_skills(
@@ -483,21 +479,6 @@ def discover_profile_skills() -> list[Skill]:
     )
 
 
-def discover_profile_skills_if_needed(
-    profile: "OpenHandsAgentProfile | ACPAgentProfile",
-) -> list[Skill] | None:
-    """Discover the skill catalog a profile needs, or ``None`` to skip discovery.
-
-    ``skill_refs == []`` selects no discovered skills, so the (potentially
-    network-bound) discovery is skipped and the resolver receives ``None``. Any
-    other value — ``None`` (all discovered) or a name list — needs the catalog.
-    Centralizes the skip guard shared by conversation start and the dry-run.
-    """
-    if profile.skill_refs == []:
-        return None
-    return discover_profile_skills()
-
-
 def sync_public_skills() -> tuple[bool, str]:
     """Force refresh of public skills from GitHub repository.
 

{openhands_agent_server-1.32.0 → openhands_agent_server-1.34.0}/openhands_agent_server.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhands-agent-server
-Version: 1.32.0
+Version: 1.34.0
 Summary: OpenHands Agent Server - REST/WebSocket interface for OpenHands AI Agent
 Project-URL: Source, https://github.com/OpenHands/software-agent-sdk
 Project-URL: Homepage, https://github.com/OpenHands/software-agent-sdk

{openhands_agent_server-1.32.0 → openhands_agent_server-1.34.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "openhands-agent-server"
-version = "1.32.0"
+version = "1.34.0"
 description = "OpenHands Agent Server - REST/WebSocket interface for OpenHands AI Agent"
 
 requires-python = ">=3.12"