openhands-agent-server 1.40.0__tar.gz → 1.40.1__tar.gz

{openhands_agent_server-1.40.0 → openhands_agent_server-1.40.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhands-agent-server
-Version: 1.40.0
+Version: 1.40.1
 Summary: OpenHands Agent Server - REST/WebSocket interface for OpenHands AI Agent
 Project-URL: Source, https://github.com/OpenHands/software-agent-sdk
 Project-URL: Homepage, https://github.com/OpenHands/software-agent-sdk

{openhands_agent_server-1.40.0 → openhands_agent_server-1.40.1}/openhands/agent_server/_secrets_exposure.py

@@ -120,3 +120,22 @@ def translate_missing_cipher() -> Iterator[None]:
                 ),
             )
         raise
+
+
+@contextmanager
+def store_errors() -> Iterator[None]:
+    """Map profile-store errors (``LLMProfileStore``/``AgentProfileStore``) to
+    HTTP responses. Shared by the settings, profiles, and agent-profiles
+    routers."""
+    try:
+        yield
+    except TimeoutError:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Profile store is busy. Please retry.",
+        )
+    except ValueError as e:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=str(e),
+        )

{openhands_agent_server-1.40.0 → openhands_agent_server-1.40.1}/openhands/agent_server/agent_profiles_router.py

@@ -12,14 +12,16 @@ MCP references and returns :class:`~openhands.sdk.profiles.AgentProfileDiagnosti
 """
 
 import asyncio
-from collections.abc import Iterator
-from contextlib import contextmanager
 from typing import Annotated, Any
 
 from fastapi import APIRouter, HTTPException, Path, Request, status
 from pydantic import BaseModel, Field, ValidationError
 
-from openhands.agent_server._secrets_exposure import get_cipher, get_config
+from openhands.agent_server._secrets_exposure import (
+    get_cipher,
+    get_config,
+    store_errors,
+)
 from openhands.agent_server.persistence import (
     PersistedSettings,
     get_agent_profile_store,
@@ -105,25 +107,6 @@ class RenameAgentProfileRequest(BaseModel):
     )
 
 
-@contextmanager
-def _store_errors() -> Iterator[None]:
-    """Map ``AgentProfileStore`` errors to HTTP responses.
-
-    Mirrors ``profiles_router._store_errors``: ``TimeoutError`` and
-    ``ValueError`` only. ``FileNotFoundError`` / ``FileExistsError`` are handled
-    inline per-endpoint so each gets a clean, resource-specific message.
-    """
-    try:
-        yield
-    except TimeoutError:
-        raise HTTPException(
-            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
-            detail="Agent profile store is busy. Please retry.",
-        )
-    except ValueError as e:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
-
-
 def _llm_has_real_config(llm: LLM) -> bool:
     """True when ``llm`` carries real, user-provided configuration.
 
@@ -173,7 +156,7 @@ def _seed_default_llm_profile(llm: LLM, cipher: Cipher | None) -> str:
     silently clobber it.
     """
     llm_store = get_llm_profile_store()
-    with _store_errors():
+    with store_errors():
         try:
             llm_store.load(SEED_PROFILE_NAME, cipher=cipher)
             return SEED_PROFILE_NAME
@@ -227,7 +210,7 @@ def _seed_default_profile(
     The lock spans empty-check + save + pointer write so concurrent first
     requests seed exactly once and the pointer matches the persisted id.
     """
-    with _store_errors(), store.lock():
+    with store_errors(), store.lock():
         # Double-checked under the lock: a concurrent first request may have
         # already seeded (the outer emptiness check in the list endpoint is
         # unlocked).
@@ -261,7 +244,7 @@ def _seed_default_profile(
 
 def _summary_id_for_name(store: AgentProfileStore, name: str) -> str | None:
     """Return the stable id of the profile stored under ``name``, if present."""
-    with _store_errors():
+    with store_errors():
         for summary in store.list_summaries():
             if summary.get("name") == name:
                 sid = summary.get("id")
@@ -282,14 +265,14 @@ async def list_agent_profiles(request: Request) -> AgentProfileListResponse:
     settings = settings_store.load() or PersistedSettings()
 
     store = get_agent_profile_store()
-    with _store_errors():
+    with store_errors():
         existing = store.list()
 
     if not existing and settings.active_agent_profile_id is None:
         _seed_default_profile(store, request, settings, get_cipher(request))
         settings = settings_store.load() or settings
 
-    with _store_errors():
+    with store_errors():
         summaries = store.list_summaries()
 
     return AgentProfileListResponse(
@@ -308,7 +291,7 @@ async def get_agent_profile(name: ProfileName) -> AgentProfileDetailResponse:
     """
     store = get_agent_profile_store()
     try:
-        with _store_errors():
+        with store_errors():
             profile = store.load(name)
     except FileNotFoundError:
         raise HTTPException(
@@ -361,7 +344,7 @@ async def save_agent_profile(
     # holds the store lock across read + mint + save so two concurrent creates
     # of the same new name can't both mint an id and clobber each other.
     try:
-        with _store_errors():
+        with store_errors():
             save_profile_preserving_identity(
                 store, profile, max_profiles=MAX_AGENT_PROFILES
             )
@@ -392,7 +375,7 @@ async def delete_agent_profile(
     store = get_agent_profile_store()
     deleted_id = _summary_id_for_name(store, name)
 
-    with _store_errors():
+    with store_errors():
         store.delete(name)
 
     if deleted_id is not None:
@@ -428,7 +411,7 @@ async def rename_agent_profile(
     """
     store = get_agent_profile_store()
     try:
-        with _store_errors():
+        with store_errors():
             store.rename(name, body.new_name)
     except FileNotFoundError:
         raise HTTPException(
@@ -462,7 +445,7 @@ async def activate_agent_profile(
     creation-time-only contract). Returns 404 if no stored profile has that id.
     """
     store = get_agent_profile_store()
-    with _store_errors():
+    with store_errors():
         known_ids = {
             str(s["id"]) for s in store.list_summaries() if s.get("id") is not None
         }
@@ -515,7 +498,7 @@ async def materialize_agent_profile(
     """
     store = get_agent_profile_store()
     try:
-        with _store_errors():
+        with store_errors():
             profile = store.load(name)
     except FileNotFoundError:
         raise HTTPException(

{openhands_agent_server-1.40.0 → openhands_agent_server-1.40.1}/openhands/agent_server/config.py

@@ -106,11 +106,26 @@ class WebhookSpec(BaseModel):
         default=1000,
         ge=1,
         description=(
-            "Upper bound on the number of events buffered for delivery. When the "
-            "downstream is failing and events are re-queued for retry, the oldest "
+            "Upper bound on the number of events buffered for delivery. The oldest "
             "events are dropped past this bound to prevent unbounded memory growth."
         ),
     )
+    max_batch_bytes: int = Field(
+        default=5 * 1024 * 1024,
+        ge=1,
+        description=(
+            "Upper bound on the serialized size of each webhook request. A single "
+            "event larger than this limit is sent by itself."
+        ),
+    )
+    max_queue_bytes: int = Field(
+        default=50 * 1024 * 1024,
+        ge=1,
+        description=(
+            "Upper bound on the serialized size of events buffered for delivery. "
+            "The oldest events are dropped when the queue exceeds this bound."
+        ),
+    )
 
 
 TelemetryExporterKind = Literal["none", "posthog", "http"]

{openhands_agent_server-1.40.0 → openhands_agent_server-1.40.1}/openhands/agent_server/conversation_service.py

@@ -50,6 +50,7 @@ from openhands.sdk import LLM, AgentContext, Event, Message
 from openhands.sdk.agent import ACPAgent
 from openhands.sdk.agent.acp_file_credentials import CODEX_AUTH_SECRET_NAME
 from openhands.sdk.agent.base import AgentBase
+from openhands.sdk.conversation.impl.local_conversation import LocalConversation
 from openhands.sdk.conversation.persistence_const import BASE_STATE
 from openhands.sdk.conversation.state import (
     ConversationExecutionStatus,
@@ -65,6 +66,7 @@ from openhands.sdk.event.conversation_state import ConversationStateUpdateEvent
 from openhands.sdk.git.exceptions import GitCommandError, GitRepositoryError
 from openhands.sdk.git.utils import run_git_command, validate_git_repository
 from openhands.sdk.mcp.utils import MCPToolProvider
+from openhands.sdk.observability import OPERATION_METADATA_KEY, observe
 from openhands.sdk.tool import BROWSER_TOOL_NAME, Tool, is_tool_usable
 from openhands.sdk.tool.client_tool import register_client_tools
 from openhands.sdk.utils.cipher import Cipher
@@ -2193,6 +2195,22 @@ class _EventSubscriber(Subscriber):
         update_last_execution_time()
 
 
+@observe(
+    name="conversation.generate_title",
+    ignore_inputs=["conversation", "llm"],
+    metadata={OPERATION_METADATA_KEY: "title_generation"},
+)
+def _generate_title_traced(
+    # Unused, but must stay first and positional: ``observe`` re-attaches the
+    # root span it carries, and this runs on a context-less executor thread.
+    conversation: LocalConversation | None,  # noqa: ARG001
+    message: str,
+    llm: LLM | None,
+    max_length: int,
+) -> str:
+    return generate_title_from_message(message, llm, max_length)
+
+
 @dataclass
 class AutoTitleSubscriber(Subscriber):
     service: EventService
@@ -2215,9 +2233,9 @@ class AutoTitleSubscriber(Subscriber):
         # Precedence: title_llm_profile (if configured and loads) → agent.llm →
         # truncation. This keeps auto-titling non-breaking for consumers who
         # don't configure title_llm_profile.
+        conversation = self.service._conversation
         title_llm = self._load_title_llm()
         if title_llm is None:
-            conversation = self.service._conversation
             title_llm = conversation.agent.llm if conversation else None
 
         async def _generate_and_save() -> None:
@@ -2225,7 +2243,8 @@ class AutoTitleSubscriber(Subscriber):
                 loop = asyncio.get_running_loop()
                 title = await loop.run_in_executor(
                     None,
-                    generate_title_from_message,
+                    _generate_title_traced,
+                    conversation,
                     message_text,
                     title_llm,
                     50,
@@ -2278,6 +2297,11 @@ class WebhookSubscriber(Subscriber):
     session_api_key: str | None = None
     queue: list[Event] = field(default_factory=list)
     _flush_timer: asyncio.Task | None = field(default=None, init=False)
+    _post_lock: asyncio.Lock = field(default_factory=asyncio.Lock, init=False)
+    _queue_sizes: list[int] = field(default_factory=list, init=False)
+    _queue_bytes: int = field(default=0, init=False)
+    _dropped_events: int = field(default=0, init=False)
+    _closed: bool = field(default=False, init=False)
     # Per-instance sleep seam so tests override delays without patching the
     # global asyncio.sleep. default_factory (not default) keeps it an instance
     # attribute, else the function would be descriptor-bound as a method.
@@ -2287,17 +2311,24 @@ class WebhookSubscriber(Subscriber):
 
     async def __call__(self, event: Event):
         """Add event to queue and post to webhook when buffer size is reached."""
-        self.queue.append(event)
+        self._enqueue(event)
 
-        if len(self.queue) >= self.spec.event_buffer_size:
+        if (
+            len(self.queue) >= self.spec.event_buffer_size
+            or self._queue_bytes >= self.spec.max_batch_bytes
+        ):
+            if self._post_lock.locked():
+                self._start_flush_timer()
+                return
             # Cancel timer since we're flushing due to buffer size
             self._cancel_flush_timer()
             await self._post_events()
-        elif not self._flush_timer:
-            self._flush_timer = asyncio.create_task(self._flush_after_delay())
+        elif self.queue:
+            self._start_flush_timer()
 
     async def close(self):
         """Post any remaining items in the queue to the webhook."""
+        self._closed = True
         # Cancel any pending flush timer
         self._cancel_flush_timer()
 
@@ -2305,30 +2336,26 @@ class WebhookSubscriber(Subscriber):
             await self._post_events()
 
     async def _post_events(self):
-        """Post queued events to the webhook with retry logic."""
-        if not self.queue:
-            return
+        """Post bounded batches serially until the queue is empty or a post fails."""
+        async with self._post_lock:
+            self._sync_queue_sizes()
+            self._trim_queue()
+            events_remaining = len(self.queue)
+            while events_remaining:
+                events_to_post, event_data = self._take_batch(events_remaining)
+                if not await self._post_batch(event_data):
+                    self._requeue(events_to_post)
+                    return
+                events_remaining -= len(events_to_post)
 
-        events_to_post = self.queue.copy()
-        self.queue.clear()
+    async def _post_batch(self, event_data: list[dict[str, Any]]) -> bool:
+        """Post one serialized batch with retry logic."""
 
         # Prepare headers
         headers = self.spec.headers.copy()
         if self.session_api_key:
             headers["X-Session-API-Key"] = self.session_api_key
 
-        # Convert events to a JSON-serializable format. mode="json" is required
-        # so types like set and SecretStr become JSON-safe primitives; without
-        # it httpx's encoder raises "Object of type set/SecretStr is not JSON
-        # serializable", every retry fails identically, and the events are
-        # dropped. (Mirrors ConversationWebhookSubscriber.post_conversation_info.)
-        event_data = [
-            event.model_dump(mode="json")
-            if hasattr(event, "model_dump")
-            else event.__dict__
-            for event in events_to_post
-        ]
-
         # Construct events URL
         events_url = (
             f"{self.spec.base_url.rstrip('/')}/events/{self.conversation_id.hex}"
@@ -2350,7 +2377,7 @@ class WebhookSubscriber(Subscriber):
                         f"Successfully posted {len(event_data)} events "
                         f"to webhook {events_url}"
                     )
-                    return
+                    return True
             except Exception as e:
                 logger.warning(f"Webhook post attempt {attempt + 1} failed: {e}")
                 if attempt < self.spec.num_retries:
@@ -2360,15 +2387,95 @@ class WebhookSubscriber(Subscriber):
                         f"Failed to post events to webhook {events_url} "
                         f"after {self.spec.num_retries + 1} attempts"
                     )
-                    self.queue.extend(events_to_post)
-                    overflow = len(self.queue) - self.spec.max_queue_size
-                    if overflow > 0:
-                        del self.queue[:overflow]
-                        logger.warning(
-                            f"Webhook queue exceeded max_queue_size="
-                            f"{self.spec.max_queue_size}; dropped {overflow} "
-                            f"oldest event(s) for {events_url}."
-                        )
+        return False
+
+    @staticmethod
+    def _event_data(event: Event) -> dict[str, Any]:
+        # mode="json" makes types such as set and SecretStr JSON-safe.
+        if hasattr(event, "model_dump"):
+            return event.model_dump(mode="json")
+        return event.__dict__
+
+    @classmethod
+    def _event_size(cls, event: Event) -> int:
+        return len(
+            json.dumps(
+                cls._event_data(event),
+                ensure_ascii=False,
+                separators=(",", ":"),
+                allow_nan=False,
+            ).encode()
+        )
+
+    def _sync_queue_sizes(self):
+        """Refresh size accounting after callers directly replace the public queue."""
+        if len(self._queue_sizes) != len(self.queue):
+            self._queue_sizes = [self._event_size(event) for event in self.queue]
+            self._queue_bytes = sum(self._queue_sizes)
+
+    def _enqueue(self, event: Event):
+        self._sync_queue_sizes()
+        event_size = self._event_size(event)
+        self.queue.append(event)
+        self._queue_sizes.append(event_size)
+        self._queue_bytes += event_size
+        self._trim_queue()
+
+    def _requeue(self, events: list[Event]):
+        sizes = [self._event_size(event) for event in events]
+        self.queue[:0] = events
+        self._queue_sizes[:0] = sizes
+        self._queue_bytes += sum(sizes)
+        self._trim_queue()
+
+    def _trim_queue(self):
+        dropped = 0
+        while self.queue and (
+            len(self.queue) > self.spec.max_queue_size
+            or self._queue_bytes > self.spec.max_queue_bytes
+        ):
+            del self.queue[0]
+            self._queue_bytes -= self._queue_sizes.pop(0)
+            dropped += 1
+        if dropped:
+            previous_dropped = self._dropped_events
+            self._dropped_events += dropped
+            if (
+                previous_dropped == 0
+                or self._dropped_events // 100 > previous_dropped // 100
+            ):
+                logger.warning(
+                    "Webhook queue exceeded its configured count or byte limit; "
+                    f"dropped {self._dropped_events} event(s) so far for conversation "
+                    f"{self.conversation_id.hex}."
+                )
+
+    def _take_batch(self, max_events: int) -> tuple[list[Event], list[dict[str, Any]]]:
+        self._sync_queue_sizes()
+        batch_size = 2  # JSON array brackets
+        batch_count = 0
+        event_data: list[dict[str, Any]] = []
+
+        for event, event_size in zip(self.queue, self._queue_sizes, strict=True):
+            next_size = batch_size + event_size + (1 if batch_count else 0)
+            if batch_count and next_size > self.spec.max_batch_bytes:
+                break
+            event_data.append(self._event_data(event))
+            batch_size = next_size
+            batch_count += 1
+            if batch_count >= min(self.spec.event_buffer_size, max_events):
+                break
+
+        events = self.queue[:batch_count]
+        del self.queue[:batch_count]
+        removed_sizes = self._queue_sizes[:batch_count]
+        del self._queue_sizes[:batch_count]
+        self._queue_bytes -= sum(removed_sizes)
+        return events, event_data
+
+    def _start_flush_timer(self):
+        if not self._closed and not self._flush_timer:
+            self._flush_timer = asyncio.create_task(self._flush_after_delay())
 
     def _cancel_flush_timer(self):
         """Cancel the current flush timer if it exists."""
@@ -2378,16 +2485,22 @@ class WebhookSubscriber(Subscriber):
 
     async def _flush_after_delay(self):
         """Wait for flush_delay seconds then flush events if any exist."""
+        current_task = asyncio.current_task()
+        should_reschedule = False
         try:
             await self._sleep(self.spec.flush_delay)
             # Only flush if there are events in the queue
             if self.queue:
                 await self._post_events()
+                should_reschedule = bool(self.queue)
         except asyncio.CancelledError:
             # Timer was cancelled, which is expected behavior
             pass
         finally:
-            self._flush_timer = None
+            if self._flush_timer is current_task:
+                self._flush_timer = None
+            if should_reschedule:
+                self._start_flush_timer()
 
 
 @dataclass

{openhands_agent_server-1.40.0 → openhands_agent_server-1.40.1}/openhands/agent_server/mcp_oauth_store.py

@@ -24,7 +24,10 @@ from openhands.sdk.mcp.config import (
     MCPOAuthTokenStorageField,
     MCPServer,
 )
-from openhands.sdk.mcp.utils import ToolsChangedCallback, create_mcp_tools
+from openhands.sdk.mcp.utils import (
+    ToolsChangedCallback,
+    create_mcp_tools,
+)
 
 
 logger = get_logger(__name__)

{openhands_agent_server-1.40.0 → openhands_agent_server-1.40.1}/openhands/agent_server/profiles_router.py

@@ -1,7 +1,5 @@
 """HTTP endpoints for managing named LLM configurations (profiles)."""
 
-from collections.abc import Iterator
-from contextlib import contextmanager
 from typing import Annotated, Any
 
 from fastapi import APIRouter, HTTPException, Path, Request, status
@@ -13,6 +11,7 @@ from openhands.agent_server._secrets_exposure import (
     get_cipher,
     get_config,
     parse_expose_secrets_header,
+    store_errors,
     translate_missing_cipher,
 )
 from openhands.agent_server.persistence import (
@@ -88,23 +87,6 @@ class RenameProfileRequest(BaseModel):
     )
 
 
-@contextmanager
-def _store_errors() -> Iterator[None]:
-    """Map ``LLMProfileStore`` errors to HTTP responses."""
-    try:
-        yield
-    except TimeoutError:
-        raise HTTPException(
-            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
-            detail="Profile store is busy. Please retry.",
-        )
-    except ValueError as e:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=str(e),
-        )
-
-
 def _has_api_key(llm: LLM) -> bool:
     if not isinstance(llm.api_key, SecretStr):
         return False
@@ -141,7 +123,7 @@ async def list_profiles(request: Request) -> ProfileListResponse:
     settings = settings_store.load() or PersistedSettings()
 
     store = get_llm_profile_store()
-    with _store_errors():
+    with store_errors():
         summaries = store.list_summaries()
 
     return ProfileListResponse(
@@ -164,7 +146,7 @@ async def get_profile(request: Request, name: ProfileName) -> ProfileDetailRespo
 
     store = get_llm_profile_store()
     try:
-        with _store_errors():
+        with store_errors():
             llm = store.load(name, cipher=cipher)
     except FileNotFoundError:
         raise HTTPException(
@@ -208,7 +190,7 @@ async def save_profile(
     llm = decrypt_incoming_llm_secrets(body.llm, cipher) if cipher else body.llm
     store = get_llm_profile_store()
     try:
-        with _store_errors():
+        with store_errors():
             store.save(
                 name,
                 llm,
@@ -241,7 +223,7 @@ async def delete_profile(
     store = get_llm_profile_store()
     agent_store = get_agent_profile_store()
     try:
-        with _store_errors():
+        with store_errors():
             delete_llm_profile(agent_store, store, name)
     except ProfileReferenced as e:
         raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail=str(e))
@@ -269,7 +251,7 @@ async def rename_profile(
     store = get_llm_profile_store()
     agent_store = get_agent_profile_store()
     try:
-        with _store_errors():
+        with store_errors():
             rename_llm_profile(agent_store, store, name, body.new_name)
     except FileNotFoundError:
         raise HTTPException(
@@ -325,7 +307,7 @@ async def activate_profile(
     # Load the profile
     profile_store = get_llm_profile_store()
     try:
-        with _store_errors():
+        with store_errors():
             llm = profile_store.load(name, cipher=cipher)
     except FileNotFoundError:
         raise HTTPException(

{openhands_agent_server-1.40.0 → openhands_agent_server-1.40.1}/openhands/agent_server/settings_router.py

@@ -7,13 +7,16 @@ from pydantic import ValidationError
 
 from openhands.agent_server._secrets_exposure import (
     build_expose_context,
+    get_cipher,
     get_config,
     parse_expose_secrets_header,
+    store_errors,
     translate_missing_cipher,
 )
 from openhands.agent_server.persistence import (
     SECRET_NAME_PATTERN,
     PersistedSettings,
+    get_llm_profile_store,
     get_secrets_store,
     get_settings_store,
 )
@@ -179,6 +182,10 @@ async def update_settings(
 
     Accepts ``agent_settings_diff``, ``conversation_settings_diff``,
     ``misc_settings_diff``, and/or ``active_profile`` for incremental updates.
+    Setting ``active_profile`` loads and applies that profile's LLM, same as
+    ``POST /api/profiles/{name}/activate``, unless ``agent_settings_diff.llm``
+    is also given.
+
     The three ``*_settings_diff`` fields are deep-merged; nested objects merge
     recursively, and a ``null`` value **inside a nested map deletes that entry**
     — the "unset" primitive that lets a client remove a single map key without
@@ -226,11 +233,47 @@ async def update_settings(
     )
 
 
+def _resolve_active_profile_llm(
+    request: Request, update_data: SettingsUpdatePayload
+) -> SettingsUpdatePayload:
+    """Fold the named profile's LLM into ``agent_settings_diff`` unless the
+    caller already gave one explicitly. Mirrors ``/activate``."""
+    profile_name = update_data.get("active_profile")
+    agent_diff = update_data.get("agent_settings_diff")
+    explicit_llm_diff = isinstance(agent_diff, dict) and "llm" in agent_diff
+    if not profile_name or explicit_llm_diff:
+        return update_data
+
+    cipher = get_cipher(request)
+    profile_store = get_llm_profile_store()
+    try:
+        with store_errors():
+            llm = profile_store.load(profile_name, cipher=cipher)
+    except FileNotFoundError:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=f"Profile '{profile_name}' not found",
+        )
+
+    return cast(
+        SettingsUpdatePayload,
+        {
+            **update_data,
+            "agent_settings_diff": {
+                **(agent_diff if isinstance(agent_diff, dict) else {}),
+                "llm": llm.model_dump(mode="json", context={"expose_secrets": True}),
+            },
+        },
+    )
+
+
 def _apply_settings_update(
     request: Request,
     update_data: SettingsUpdatePayload,
     before_update: Callable[[PersistedSettings], None] | None = None,
 ) -> SettingsResponse:
+    update_data = _resolve_active_profile_llm(request, update_data)
+
     # Apply updates atomically with file locking
     def apply_update(settings: PersistedSettings) -> PersistedSettings:
         if before_update is not None:

{openhands_agent_server-1.40.0 → openhands_agent_server-1.40.1}/openhands_agent_server.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhands-agent-server
-Version: 1.40.0
+Version: 1.40.1
 Summary: OpenHands Agent Server - REST/WebSocket interface for OpenHands AI Agent
 Project-URL: Source, https://github.com/OpenHands/software-agent-sdk
 Project-URL: Homepage, https://github.com/OpenHands/software-agent-sdk

{openhands_agent_server-1.40.0 → openhands_agent_server-1.40.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "openhands-agent-server"
-version = "1.40.0"
+version = "1.40.1"
 description = "OpenHands Agent Server - REST/WebSocket interface for OpenHands AI Agent"
 
 requires-python = ">=3.12"