openhands-agent-server 1.40.1__tar.gz → 1.41.0__tar.gz

{openhands_agent_server-1.40.1 → openhands_agent_server-1.41.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhands-agent-server
-Version: 1.40.1
+Version: 1.41.0
 Summary: OpenHands Agent Server - REST/WebSocket interface for OpenHands AI Agent
 Project-URL: Source, https://github.com/OpenHands/software-agent-sdk
 Project-URL: Homepage, https://github.com/OpenHands/software-agent-sdk

openhands_agent_server-1.41.0/openhands/agent_server/canvas_extensions/__init__.py

@@ -0,0 +1,44 @@
+"""Canvas Extensions: installable UI bundles that contribute pages to Canvas."""
+
+from openhands.agent_server.canvas_extensions.installed import (
+    CanvasExtensionUpdateCheck,
+    InstalledCanvasExtensionInfo,
+    apply_canvas_extension_update,
+    check_canvas_extension_update,
+    disable_canvas_extension,
+    enable_canvas_extension,
+    get_installed_canvas_extension,
+    get_installed_canvas_extensions_dir,
+    install_canvas_extension,
+    list_installed_canvas_extensions,
+    load_installed_canvas_extensions,
+    uninstall_canvas_extension,
+)
+from openhands.agent_server.canvas_extensions.manifest import (
+    MANIFEST_FILENAME,
+    CanvasExtensionContributes,
+    CanvasExtensionManifest,
+    CanvasExtensionPage,
+    resolve_entrypoint,
+)
+
+
+__all__ = [
+    "CanvasExtensionManifest",
+    "CanvasExtensionContributes",
+    "CanvasExtensionPage",
+    "MANIFEST_FILENAME",
+    "resolve_entrypoint",
+    "InstalledCanvasExtensionInfo",
+    "install_canvas_extension",
+    "uninstall_canvas_extension",
+    "enable_canvas_extension",
+    "disable_canvas_extension",
+    "list_installed_canvas_extensions",
+    "load_installed_canvas_extensions",
+    "get_installed_canvas_extension",
+    "get_installed_canvas_extensions_dir",
+    "CanvasExtensionUpdateCheck",
+    "check_canvas_extension_update",
+    "apply_canvas_extension_update",
+]

openhands_agent_server-1.41.0/openhands/agent_server/canvas_extensions/installed.py

@@ -0,0 +1,403 @@
+"""Installed Canvas Extensions.
+
+Built on ``openhands.sdk.extensions.installation``, shared with Plugins/
+Skills, with two behaviors specific to this module:
+
+Disabled by default -- ``InstallationInfo.enabled`` defaults to ``True``
+and neither ``InstallationManager.install()`` nor its directory discovery
+override that for a new entry, so every write path that can create one
+forces ``enabled=False`` as an explicit post-write step.
+
+Staged refresh -- ``check``/``apply`` replace ``update()``/
+``install(force=True)``, which rmtree+copytree straight onto the live
+install path with no staging directory. ``check`` fetches and validates
+into ``.staging/`` without touching the active install; ``apply`` swaps it
+in via two atomic renames (POSIX can't atomically replace a non-empty
+directory in one rename), rolling back if the second fails.
+"""
+
+import os
+import shutil
+from pathlib import Path
+
+from pydantic import BaseModel, Field, ValidationError
+
+from openhands.agent_server.canvas_extensions.manifest import (
+    MANIFEST_FILENAME,
+    CanvasExtensionManifest,
+    resolve_entrypoint,
+)
+from openhands.sdk.extensions.fetch import fetch_with_resolution
+from openhands.sdk.extensions.installation import (
+    InstallationInfo,
+    InstallationInterface,
+    InstallationManager,
+    InstallationMetadata,
+)
+from openhands.sdk.extensions.installation.manager import DEFAULT_CACHE_DIR
+
+
+# Matches the InstalledPluginInfo naming convention.
+InstalledCanvasExtensionInfo = InstallationInfo
+
+
+def get_installed_canvas_extensions_dir() -> Path:
+    """Get the default directory for installed canvas extensions."""
+    return Path.home() / ".openhands" / "canvas-extensions" / "installed"
+
+
+class CanvasExtensionInstallationInterface(
+    InstallationInterface[CanvasExtensionManifest]
+):
+    @staticmethod
+    def load_from_dir(extension_dir: Path) -> CanvasExtensionManifest:
+        manifest_path = extension_dir / MANIFEST_FILENAME
+        manifest = CanvasExtensionManifest.model_validate_json(
+            manifest_path.read_text()
+        )
+        # Containment must hold too -- a parseable manifest alone isn't enough.
+        resolve_entrypoint(manifest, extension_dir)
+        return manifest
+
+
+def _resolve_installed_dir(installed_dir: Path | None) -> Path:
+    return (
+        installed_dir
+        if installed_dir is not None
+        else get_installed_canvas_extensions_dir()
+    )
+
+
+def _manager(installed_dir: Path) -> InstallationManager[CanvasExtensionManifest]:
+    return InstallationManager(
+        installation_dir=installed_dir,
+        installation_interface=CanvasExtensionInstallationInterface(),
+    )
+
+
+def _tracked_names(installed_dir: Path) -> set[str]:
+    """Names with a real, valid tracked entry, not just a metadata key.
+
+    A stale record with no matching directory must not count as "already
+    installed" -- otherwise a real install of that name would wrongly
+    inherit its state as if this were a force-reinstall.
+    """
+    if not installed_dir.exists():
+        return set()
+    metadata = InstallationMetadata.load_from_dir(installed_dir)
+    return {info.name for info in metadata.validate_tracked(installed_dir)}
+
+
+def _force_disable_new(
+    manager: InstallationManager[CanvasExtensionManifest],
+    info: InstallationInfo,
+    pre_existing: set[str],
+) -> InstallationInfo:
+    """Force a newly created tracked entry to ``enabled=False``.
+
+    ``pre_existing`` distinguishes a genuinely new entry from a
+    force-reinstall, whose prior enabled state is already preserved.
+    """
+    if info.name in pre_existing or not info.enabled:
+        return info
+    manager.disable(info.name)
+    info.enabled = False
+    return info
+
+
+def install_canvas_extension(
+    source: str,
+    ref: str | None = None,
+    repo_path: str | None = None,
+    installed_dir: Path | None = None,
+    force: bool = False,
+) -> InstalledCanvasExtensionInfo:
+    """Install a canvas extension from a source.
+
+    A newly created entry always lands disabled, regardless of what the
+    caller passes in.
+
+    Args:
+        source: ``"github:owner/repo"``, a git URL, or a local path.
+        ref: Optional branch, tag, or commit to install.
+        repo_path: Subdirectory within the repository (for monorepos).
+        installed_dir: Defaults to ``~/.openhands/canvas-extensions/installed/``.
+        force: If True, overwrite an existing installation.
+
+    Returns:
+        InstalledCanvasExtensionInfo for the installed extension.
+    """
+    installed_dir = _resolve_installed_dir(installed_dir)
+    manager = _manager(installed_dir)
+    pre_existing = _tracked_names(installed_dir)
+    info = manager.install(source, ref=ref, repo_path=repo_path, force=force)
+    return _force_disable_new(manager, info, pre_existing)
+
+
+def uninstall_canvas_extension(name: str, installed_dir: Path | None = None) -> bool:
+    """Uninstall a canvas extension by name.
+
+    Also drops any staged, not-yet-applied update for *name*, so refreshing
+    a since-uninstalled name never leaves an orphaned staging slot behind.
+
+    Returns:
+        True if uninstalled, False if it wasn't installed.
+    """
+    installed_dir = _resolve_installed_dir(installed_dir)
+    uninstalled = _manager(installed_dir).uninstall(name)
+    if uninstalled:
+        shutil.rmtree(_staging_root(installed_dir) / name, ignore_errors=True)
+    return uninstalled
+
+
+def enable_canvas_extension(name: str, installed_dir: Path | None = None) -> bool:
+    """Enable an installed canvas extension by name."""
+    return _manager(_resolve_installed_dir(installed_dir)).enable(name)
+
+
+def disable_canvas_extension(name: str, installed_dir: Path | None = None) -> bool:
+    """Disable an installed canvas extension by name."""
+    return _manager(_resolve_installed_dir(installed_dir)).disable(name)
+
+
+def list_installed_canvas_extensions(
+    installed_dir: Path | None = None,
+) -> list[InstalledCanvasExtensionInfo]:
+    """List all installed canvas extensions.
+
+    Self-healing like ``InstallationManager.list_installed()``; directories
+    discovered this way also land disabled.
+    """
+    installed_dir = _resolve_installed_dir(installed_dir)
+    manager = _manager(installed_dir)
+    pre_existing = _tracked_names(installed_dir)
+    infos = manager.list_installed()
+    return [_force_disable_new(manager, info, pre_existing) for info in infos]
+
+
+def load_installed_canvas_extensions(
+    installed_dir: Path | None = None,
+) -> list[CanvasExtensionManifest]:
+    """Load all enabled canvas extensions' manifests.
+
+    Runs through ``list_installed_canvas_extensions`` first so discovery
+    is force-disabled before anything is loaded -- see the module
+    docstring. Mirrors ``InstallationManager.load_installed()``'s own
+    enabled-filter/load logic on top of the corrected info list.
+    """
+    installed_dir = _resolve_installed_dir(installed_dir)
+    manager = _manager(installed_dir)
+    manifests: list[CanvasExtensionManifest] = []
+    for info in list_installed_canvas_extensions(installed_dir):
+        if not info.enabled:
+            continue
+        extension_path = installed_dir / info.name
+        if extension_path.exists():
+            manifests.append(
+                manager.installation_interface.load_from_dir(extension_path)
+            )
+    return manifests
+
+
+def get_installed_canvas_extension(
+    name: str, installed_dir: Path | None = None
+) -> InstalledCanvasExtensionInfo | None:
+    """Get information about a specific installed canvas extension."""
+    return _manager(_resolve_installed_dir(installed_dir)).get(name)
+
+
+class CanvasExtensionUpdateCheck(BaseModel):
+    """Result of ``check_canvas_extension_update``.
+
+    The active install is untouched; only ``.staging/`` is written. Pass
+    ``resolved_ref`` back to ``apply_canvas_extension_update`` to confirm
+    and swap this exact staged content into place.
+    """
+
+    requested_ref: str | None = Field(
+        description="Ref the staged fetch was resolved against"
+    )
+    resolved_ref: str | None = Field(
+        description="Commit SHA the staged content was resolved to"
+    )
+    validated: bool = Field(
+        description="Whether staged content passed validation; only True may be applied"
+    )
+
+
+def _staging_root(installed_dir: Path) -> Path:
+    return installed_dir / ".staging"
+
+
+def _staged_path(installed_dir: Path, name: str, resolved_ref: str | None) -> Path:
+    """Path to the staging slot for (*name*, *resolved_ref*).
+
+    *resolved_ref* is untrusted (``apply_canvas_extension_update`` takes it
+    as a caller-supplied argument), so it's rejected if it could escape the
+    staging directory -- same check as ``entrypoint`` in manifest.py.
+    """
+    if resolved_ref is not None and (
+        not resolved_ref
+        or resolved_ref.startswith("/")
+        or ".." in Path(resolved_ref).parts
+    ):
+        raise ValueError(f"Invalid resolved_ref: {resolved_ref!r}")
+    return _staging_root(installed_dir) / name / (resolved_ref or "local")
+
+
+def _stage_fetched_content(
+    installed_dir: Path, name: str, resolved_ref: str | None, fetched_path: Path
+) -> Path:
+    """Copy fetched content into a clean staging slot for *name*.
+
+    Clears any previously staged candidate first -- at most one is kept
+    per extension at a time.
+    """
+    slot_root = _staging_root(installed_dir) / name
+    shutil.rmtree(slot_root, ignore_errors=True)
+    staged_path = _staged_path(installed_dir, name, resolved_ref)
+    # symlinks=True: dereferencing here would copy a malicious symlink's
+    # target in as a plain file, defeating containment validation below.
+    shutil.copytree(fetched_path, staged_path, symlinks=True)
+    return staged_path
+
+
+def _load_validated_manifest(
+    staged_path: Path, expected_name: str
+) -> CanvasExtensionManifest:
+    """Load and validate a staged extension's manifest.
+
+    Raises if the manifest is malformed, its entrypoint escapes the package
+    root, or its name no longer matches *expected_name*.
+    """
+    manifest = CanvasExtensionInstallationInterface.load_from_dir(staged_path)
+    if manifest.name != expected_name:
+        raise ValueError(
+            f"Staged content for {expected_name!r} declares a different "
+            f"name {manifest.name!r}; refusing to treat it as an update"
+        )
+    return manifest
+
+
+def check_canvas_extension_update(
+    name: str, installed_dir: Path | None = None
+) -> CanvasExtensionUpdateCheck | None:
+    """Check for an update to *name*, staging and validating it.
+
+    Re-fetches the tracked source at its original ref (never "latest")
+    into ``.staging/``; the active install is untouched. See
+    ``apply_canvas_extension_update`` for the step that swaps it into
+    place.
+
+    Args:
+        name: Name of the installed extension to check.
+        installed_dir: Defaults to ``~/.openhands/canvas-extensions/installed/``.
+
+    Returns:
+        None if not installed, else a result -- only apply when ``validated``.
+
+    Raises:
+        ValueError: If *name* is not valid kebab-case.
+        ExtensionFetchError: If fetching the tracked source fails.
+    """
+    installed_dir = _resolve_installed_dir(installed_dir)
+    manager = _manager(installed_dir)
+    current_info = manager.get(name)
+    if current_info is None:
+        return None
+
+    fetched_path, resolved_ref = fetch_with_resolution(
+        source=current_info.source,
+        cache_dir=DEFAULT_CACHE_DIR,
+        ref=current_info.requested_ref,
+        repo_path=current_info.repo_path,
+        update=True,
+    )
+
+    staged_path = _stage_fetched_content(
+        installed_dir, name, resolved_ref, fetched_path
+    )
+    try:
+        _load_validated_manifest(staged_path, name)
+        validated = True
+    except (ValidationError, ValueError, OSError):
+        validated = False
+        shutil.rmtree(staged_path.parent, ignore_errors=True)
+
+    return CanvasExtensionUpdateCheck(
+        requested_ref=current_info.requested_ref,
+        resolved_ref=resolved_ref,
+        validated=validated,
+    )
+
+
+def apply_canvas_extension_update(
+    name: str,
+    resolved_ref: str | None,
+    enabled: bool,
+    installed_dir: Path | None = None,
+) -> InstalledCanvasExtensionInfo | None:
+    """Apply a previously checked and validated update.
+
+    *resolved_ref* must match a staged candidate already validated by
+    ``check_canvas_extension_update``, reconfirming what's being applied.
+    Atomically swaps staged content into the active install path;
+    *enabled* is always applied explicitly, never inherited.
+
+    Args:
+        name: Name of the installed extension to update.
+        resolved_ref: The ``resolved_ref`` from a prior, validated check.
+        enabled: Enabled state to apply to the new bundle.
+        installed_dir: Defaults to ``~/.openhands/canvas-extensions/installed/``.
+
+    Returns:
+        None if not installed, else the InstallationInfo for the new bundle.
+
+    Raises:
+        ValueError: If *name* is invalid, *resolved_ref* could escape the
+            staging directory, or no validated staged candidate matches it
+            -- call check first.
+    """
+    installed_dir = _resolve_installed_dir(installed_dir)
+    manager = _manager(installed_dir)
+    current_info = manager.get(name)
+    if current_info is None:
+        return None
+
+    staged_path = _staged_path(installed_dir, name, resolved_ref)
+    if not staged_path.is_dir():
+        raise ValueError(
+            f"No validated staged update found for {name!r} at ref "
+            f"{resolved_ref!r}. Call check_canvas_extension_update() first."
+        )
+    manifest = _load_validated_manifest(staged_path, name)
+
+    install_path = installed_dir / name
+    backup_path = _staging_root(installed_dir) / f"{name}.previous"
+    shutil.rmtree(backup_path, ignore_errors=True)
+
+    # POSIX rename() can't atomically replace a non-empty directory, so the
+    # active bundle moves aside first; roll back if the second rename fails.
+    os.replace(install_path, backup_path)
+    try:
+        os.replace(staged_path, install_path)
+    except OSError:
+        os.replace(backup_path, install_path)
+        raise
+    shutil.rmtree(backup_path, ignore_errors=True)
+    shutil.rmtree(_staging_root(installed_dir) / name, ignore_errors=True)
+
+    info = InstallationInfo.from_extension(
+        manifest,
+        source=current_info.source,
+        install_path=install_path,
+        requested_ref=current_info.requested_ref,
+        resolved_ref=resolved_ref,
+        repo_path=current_info.repo_path,
+    )
+    info.enabled = enabled
+
+    with manager.metadata_session as session:
+        session.extensions[name] = info
+
+    return info

openhands_agent_server-1.41.0/openhands/agent_server/canvas_extensions/manifest.py

@@ -0,0 +1,166 @@
+"""Canvas Extensions manifest: schema, validation, and entrypoint containment.
+
+A Canvas extension is an installable UI bundle that contributes pages to the
+OpenHands Canvas frontend. Extensions are installed and served entirely by
+the agent-server (via ``openhands.sdk.extensions.installation``, the same
+type-agnostic install-tracking framework Plugins/Skills use); nothing here
+is consumed by ``Agent``/``Conversation``.
+
+This module defines the manifest schema (``canvas-extension.json``) and the
+two security-critical checks around it:
+
+* Name / contribution-id / page-path validation (syntactic, on the model).
+* Entrypoint containment (filesystem-level, once a package root is known) —
+  rejects both textual path traversal and symlink escapes.
+"""
+
+import re
+from pathlib import Path
+from typing import Final
+
+from pydantic import BaseModel, Field, field_validator
+
+from openhands.sdk.extensions.installation.utils import validate_extension_name
+
+
+# Filename a canvas extension's manifest is loaded from, at its package root.
+MANIFEST_FILENAME: Final[str] = "canvas-extension.json"
+
+# Absolute, kebab-case, multi-segment UI route, e.g. "/dashboard/settings".
+_PAGE_PATH_PATTERN: re.Pattern[str] = re.compile(
+    r"^/[a-z0-9]+(?:-[a-z0-9]+)*(?:/[a-z0-9]+(?:-[a-z0-9]+)*)*$"
+)
+
+
+class CanvasExtensionPage(BaseModel):
+    """A single page contributed to the Canvas UI by an extension."""
+
+    id: str = Field(description="Unique contribution id within the extension")
+    title: str = Field(description="Page title shown in Canvas navigation")
+    path: str = Field(description="Route the page is mounted at, e.g. '/dashboard'")
+
+    @field_validator("id")
+    @classmethod
+    def _validate_id(cls, v: str) -> str:
+        try:
+            validate_extension_name(v)
+        except ValueError as e:
+            raise ValueError(
+                f"Invalid contribution id. Expected kebab-case, got {v!r}."
+            ) from e
+        return v
+
+    @field_validator("path")
+    @classmethod
+    def _validate_path(cls, v: str) -> str:
+        if not _PAGE_PATH_PATTERN.fullmatch(v):
+            raise ValueError(
+                "Invalid page path. Expected an absolute kebab-case route "
+                f"(e.g. '/dashboard'), got {v!r}."
+            )
+        return v
+
+
+class CanvasExtensionContributes(BaseModel):
+    """Contributions an extension makes to the Canvas UI."""
+
+    pages: list[CanvasExtensionPage] = Field(
+        default_factory=list, description="Pages contributed to Canvas navigation"
+    )
+
+    @field_validator("pages")
+    @classmethod
+    def _validate_unique_pages(
+        cls, v: list[CanvasExtensionPage]
+    ) -> list[CanvasExtensionPage]:
+        seen_ids: set[str] = set()
+        seen_paths: set[str] = set()
+        for page in v:
+            if page.id in seen_ids:
+                raise ValueError(f"Duplicate page contribution id: {page.id!r}")
+            if page.path in seen_paths:
+                raise ValueError(f"Duplicate page path: {page.path!r}")
+            seen_ids.add(page.id)
+            seen_paths.add(page.path)
+        return v
+
+
+class CanvasExtensionManifest(BaseModel):
+    """Canvas extension manifest (``canvas-extension.json``)."""
+
+    schema_version: int = Field(description="Manifest schema version")
+    name: str = Field(description="Extension name (kebab-case)")
+    display_name: str = Field(description="Human-readable extension name")
+    version: str = Field(description="Extension version")
+    description: str = Field(default="", description="Extension description")
+    entrypoint: str = Field(
+        description=(
+            "Path, relative to the extension package root, to the bundle entry file"
+        )
+    )
+    contributes: CanvasExtensionContributes = Field(
+        default_factory=CanvasExtensionContributes,
+        description="Contributions this extension makes to the Canvas UI",
+    )
+
+    @field_validator("name")
+    @classmethod
+    def _validate_name(cls, v: str) -> str:
+        validate_extension_name(v)
+        return v
+
+    @field_validator("entrypoint")
+    @classmethod
+    def _validate_entrypoint(cls, v: str) -> str:
+        """Reject textual traversal/absolute paths.
+
+        Syntactic only — see :func:`resolve_entrypoint` for the real,
+        symlink-aware containment check against the installed package root.
+        """
+        if not v:
+            raise ValueError("entrypoint must not be empty")
+        if v.startswith("/"):
+            raise ValueError("entrypoint must be relative, not absolute")
+        if ".." in Path(v).parts:
+            raise ValueError(
+                "entrypoint cannot contain '..' (parent directory traversal)"
+            )
+        return v
+
+
+def resolve_entrypoint(manifest: CanvasExtensionManifest, package_root: Path) -> Path:
+    """Resolve ``manifest.entrypoint`` against ``package_root``, safely.
+
+    Field-level validation on ``entrypoint`` only rejects textual traversal
+    (``..``) and absolute paths. It cannot catch a symlink inside the
+    package that resolves outside of it. This performs the real
+    filesystem-level containment check (resolving symlinks) and must be
+    called both when an extension is installed and again immediately
+    before its entrypoint is read or served over HTTP.
+
+    Args:
+        manifest: A validated manifest.
+        package_root: The extension's installed package root directory.
+
+    Returns:
+        The resolved, contained entrypoint path.
+
+    Raises:
+        ValueError: If the resolved entrypoint escapes ``package_root``, or
+            does not resolve to a regular file within it (covers ``.``,
+            a directory, a dangling symlink, and symlink cycles — none of
+            which ``is_relative_to`` alone rejects).
+    """
+    root = package_root.resolve()
+    candidate = (root / manifest.entrypoint).resolve()
+    if not candidate.is_relative_to(root):
+        raise ValueError(
+            f"entrypoint {manifest.entrypoint!r} resolves outside the "
+            "extension package root"
+        )
+    if not candidate.is_file():
+        raise ValueError(
+            f"entrypoint {manifest.entrypoint!r} does not resolve to a file "
+            "in the extension package"
+        )
+    return candidate

{openhands_agent_server-1.40.1 → openhands_agent_server-1.41.0}/openhands/agent_server/mcp_router.py

@@ -53,7 +53,6 @@ from openhands.sdk.mcp.config import (
 )
 from openhands.sdk.mcp.exceptions import MCPError, MCPTimeoutError
 from openhands.sdk.utils.cipher import Cipher
-from openhands.sdk.utils.deprecation import warn_deprecated
 
 
 logger = get_logger(__name__)
@@ -100,44 +99,13 @@ class _RemoteMCPServerSpec(BaseModel):
     type: Literal["http", "shttp", "streamable-http", "sse"]
     url: str = Field(..., min_length=1)
     headers: dict[str, str] = Field(default_factory=dict)
-    api_key: str | None = Field(
-        default=None,
-        deprecated=True,
-        description=(
-            "Deprecated bearer token. Prefer auth.strategy='bearer'. If provided "
-            "without auth, sent as 'Authorization: Bearer <token>'."
-        ),
-    )
     auth: MCPAuthCredential | None = None
     timeout: float | None = None
     sse_read_timeout: float | None = None
     keep_alive: bool | None = None
 
-    @model_validator(mode="before")
-    @classmethod
-    def _warn_legacy_api_key(cls, value: object) -> object:
-        if isinstance(value, dict) and value.get("api_key") is not None:
-            warn_deprecated(
-                "_RemoteMCPServerSpec.api_key",
-                deprecated_in="1.36.0",
-                removed_in="1.41.0",
-                details="Use auth.strategy='bearer' with auth.value instead.",
-                stacklevel=3,
-            )
-        return value
-
     @model_validator(mode="after")
     def _reject_ambiguous_auth(self) -> _RemoteMCPServerSpec:
-        api_key = self.__dict__.get("api_key")
-        if api_key is not None and self.auth is not None:
-            raise ValueError("api_key cannot be combined with auth.")
-        if api_key is not None and any(
-            name.lower() == "authorization" for name in self.headers
-        ):
-            raise ValueError(
-                "api_key cannot be combined with an explicit top-level "
-                "'Authorization' header; use auth.strategy='header' instead."
-            )
         if self.auth is not None and any(
             name.lower() == "authorization" for name in self.headers
         ):
@@ -149,7 +117,6 @@ class _RemoteMCPServerSpec(BaseModel):
 
     def to_mcp_server(self) -> MCPServer:
         transport = "http" if self.type == "shttp" else self.type
-        api_key = self.__dict__.get("api_key")
         data: dict[str, Any] = {
             "url": self.url,
             "transport": transport,
@@ -160,8 +127,6 @@ class _RemoteMCPServerSpec(BaseModel):
         }
         if self.auth is not None:
             data["auth"] = self.auth
-        elif api_key is not None:
-            data["auth"] = {"strategy": "bearer", "value": api_key}
         return MCPServer.model_validate(data)
 
 

{openhands_agent_server-1.40.1 → openhands_agent_server-1.41.0}/openhands/agent_server/models.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 from abc import ABC
 from datetime import datetime
 from enum import Enum, StrEnum
-from typing import TYPE_CHECKING, Any, TypeAlias
+from typing import Any
 from uuid import UUID, uuid4
 
 from pydantic import BaseModel, Field, field_validator
@@ -14,7 +14,6 @@ from openhands.sdk.conversation.conversation_stats import ConversationStats
 from openhands.sdk.conversation.request import (  # re-export for backward compat
     ACPEnabledAgent as ACPEnabledAgent,
     SendMessageRequest as SendMessageRequest,
-    StartACPConversationRequest as StartACPConversationRequest,
     StartConversationRequest as StartConversationRequest,
 )
 from openhands.sdk.conversation.secret_registry import SecretRegistry
@@ -38,7 +37,6 @@ from openhands.sdk.security.confirmation_policy import (
 )
 from openhands.sdk.tool.client_tool import ClientToolSpec
 from openhands.sdk.utils import OpenHandsUUID, utc_now
-from openhands.sdk.utils.deprecation import warn_deprecated
 from openhands.sdk.utils.models import (
     DiscriminatedUnionMixin,
     OpenHandsModel,
@@ -392,36 +390,6 @@ def trim_conversation_response_skills(info: ConversationInfo) -> ConversationInf
     return info.model_copy(update={"agent": trimmed_agent})
 
 
-# Deprecated compatibility aliases for the old ACP-specific response names.
-# Keep runtime assignment aliases so existing imports still resolve to the
-# canonical Pydantic models; PEP 695 ``type`` aliases would not preserve that.
-if TYPE_CHECKING:
-    ACPConversationInfo: TypeAlias = ConversationInfo  # noqa: UP040
-    ACPConversationPage: TypeAlias = ConversationPage  # noqa: UP040
-
-
-_DEPRECATED_ACP_RESPONSE_ALIASES: dict[str, type[BaseModel]] = {
-    "ACPConversationInfo": ConversationInfo,
-    "ACPConversationPage": ConversationPage,
-}
-
-
-def __getattr__(name: str) -> Any:
-    if name in _DEPRECATED_ACP_RESPONSE_ALIASES:
-        warn_deprecated(
-            f"openhands.agent_server.models.{name}",
-            deprecated_in="1.36.0",
-            removed_in="1.41.0",
-            details=(
-                "The ACP-specific response model names are compatibility aliases. "
-                "Use ConversationInfo or ConversationPage instead."
-            ),
-            stacklevel=2,
-        )
-        return _DEPRECATED_ACP_RESPONSE_ALIASES[name]
-    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
-
-
 class ConfirmationResponseRequest(BaseModel):
     """Payload to accept or reject a pending action."""
 

{openhands_agent_server-1.40.1 → openhands_agent_server-1.41.0}/openhands_agent_server.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhands-agent-server
-Version: 1.40.1
+Version: 1.41.0
 Summary: OpenHands Agent Server - REST/WebSocket interface for OpenHands AI Agent
 Project-URL: Source, https://github.com/OpenHands/software-agent-sdk
 Project-URL: Homepage, https://github.com/OpenHands/software-agent-sdk

{openhands_agent_server-1.40.1 → openhands_agent_server-1.41.0}/openhands_agent_server.egg-info/SOURCES.txt

@@ -49,6 +49,9 @@ pyproject.toml
 ./openhands/agent_server/vscode_service.py
 ./openhands/agent_server/workspace_router.py
 ./openhands/agent_server/workspaces_router.py
+./openhands/agent_server/canvas_extensions/__init__.py
+./openhands/agent_server/canvas_extensions/installed.py
+./openhands/agent_server/canvas_extensions/manifest.py
 ./openhands/agent_server/docker/Dockerfile
 ./openhands/agent_server/docker/build.py
 ./openhands/agent_server/docker/wallpaper.svg
@@ -121,6 +124,9 @@ openhands/agent_server/vscode_router.py
 openhands/agent_server/vscode_service.py
 openhands/agent_server/workspace_router.py
 openhands/agent_server/workspaces_router.py
+openhands/agent_server/canvas_extensions/__init__.py
+openhands/agent_server/canvas_extensions/installed.py
+openhands/agent_server/canvas_extensions/manifest.py
 openhands/agent_server/docker/Dockerfile
 openhands/agent_server/docker/build.py
 openhands/agent_server/docker/wallpaper.svg

{openhands_agent_server-1.40.1 → openhands_agent_server-1.41.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "openhands-agent-server"
-version = "1.40.1"
+version = "1.41.0"
 description = "OpenHands Agent Server - REST/WebSocket interface for OpenHands AI Agent"
 
 requires-python = ">=3.12"