openhands-agent-server 1.46.0__tar.gz → 1.48.0__tar.gz

{openhands_agent_server-1.46.0 → openhands_agent_server-1.48.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhands-agent-server
-Version: 1.46.0
+Version: 1.48.0
 Summary: OpenHands Agent Server - REST/WebSocket interface for OpenHands AI Agent
 Project-URL: Source, https://github.com/OpenHands/software-agent-sdk
 Project-URL: Homepage, https://github.com/OpenHands/software-agent-sdk
@@ -15,7 +15,7 @@ Requires-Dist: openhands-sdk
 Requires-Dist: openai<3,>=2.33.0
 Requires-Dist: pydantic>=2
 Requires-Dist: sqlalchemy>=2
-Requires-Dist: uvicorn>=0.31.1
+Requires-Dist: uvicorn>=0.52.4
 Requires-Dist: websockets>=12
 Requires-Dist: wsproto>=1.2.0
 Provides-Extra: posthog

{openhands_agent_server-1.46.0 → openhands_agent_server-1.48.0}/openhands/agent_server/api.py

@@ -40,7 +40,7 @@ from openhands.agent_server.dependencies import (
 )
 from openhands.agent_server.desktop_router import desktop_router
 from openhands.agent_server.event_router import event_router
-from openhands.agent_server.file_router import file_router
+from openhands.agent_server.file_router import file_discovery_router, file_router
 from openhands.agent_server.git_router import git_router
 from openhands.agent_server.hooks_router import hooks_router
 from openhands.agent_server.init_router import (
@@ -60,6 +60,7 @@ from openhands.agent_server.profiles_router import profiles_router
 from openhands.agent_server.provider_connections_router import (
     provider_connections_router,
 )
+from openhands.agent_server.runtime_router import create_runtime_router
 from openhands.agent_server.server_details_router import (
     get_server_info,
     mark_initialization_complete,
@@ -411,6 +412,8 @@ def _add_api_routes(app: FastAPI) -> None:
     ]
 
     api_router = APIRouter(prefix="/api", dependencies=dependencies)
+    api_router.include_router(file_discovery_router)
+    api_router.include_router(create_runtime_router())
     api_router.include_router(event_router)
     api_router.include_router(conversation_router)
     api_router.include_router(credential_binding_router)

{openhands_agent_server-1.46.0 → openhands_agent_server-1.48.0}/openhands/agent_server/bash_router.py

@@ -2,6 +2,7 @@
 
 import logging
 from datetime import datetime
+from pathlib import Path
 from typing import Annotated, Literal, cast
 from uuid import UUID
 
@@ -52,13 +53,11 @@ async def search_bash_events(
     ] = None,
     limit: Annotated[
         int,
-        Query(title="The max number of results in the page", gt=0, lte=100),
+        Query(title="The max number of results in the page", gt=0, le=100),
     ] = 100,
     bash_event_service: BashEventService = Depends(get_bash_event_service),
 ) -> BashEventPage:
     """Search / List bash event events"""
-    assert limit > 0
-    assert limit <= 100
 
     return await bash_event_service.search_bash_events(
         kind__eq=kind__eq,
@@ -104,6 +103,7 @@ async def start_bash_command(
 ) -> BashCommand:
     """Execute a bash command in the background"""
     update_last_execution_time()
+    _validate_cwd(request, bash_event_service)
     command, _ = await bash_event_service.start_bash_command(request)
     return command
 
@@ -115,6 +115,7 @@ async def execute_bash_command(
 ) -> BashOutput:
     """Execute a bash command and wait for a result"""
     update_last_execution_time()
+    _validate_cwd(request, bash_event_service)
     command, task = await bash_event_service.start_bash_command(request)
     await task
     page = await bash_event_service.search_bash_events(command_id__eq=command.id)
@@ -129,3 +130,13 @@ async def clear_all_bash_events(
     """Clear all bash events from storage"""
     count = await bash_event_service.clear_all_events()
     return {"cleared_count": count}
+
+
+def _validate_cwd(request: ExecuteBashRequest, service: BashEventService) -> None:
+    if service.default_cwd is not None and request.cwd is not None:
+        if (
+            not Path(request.cwd)
+            .resolve()
+            .is_relative_to(Path(service.default_cwd).resolve())
+        ):
+            raise HTTPException(422, "cwd must be inside the conversation workspace")

{openhands_agent_server-1.46.0 → openhands_agent_server-1.48.0}/openhands/agent_server/bash_service.py

@@ -31,6 +31,9 @@ class BashEventService:
     will not be visible to the agent."""
 
     bash_events_dir: Path = field()
+    default_cwd: str | None = None
+    _tasks: set[asyncio.Task] = field(default_factory=set, init=False)
+    _closed: bool = field(default=False, init=False)
     _pub_sub: PubSub[BashEventBase] = field(
         default_factory=lambda: PubSub[BashEventBase](max_subscribers=50),
         init=False,
@@ -255,13 +258,17 @@ class BashEventService:
         self, request: ExecuteBashRequest
     ) -> tuple[BashCommand, asyncio.Task]:
         """Execute a bash command. The output will be published separately."""
-        command = BashCommand(**request.model_dump())
+        if self._closed:
+            raise RuntimeError("Bash event service is closed")
+        cwd = request.cwd or self.default_cwd
+        command = BashCommand(**{**request.model_dump(), "cwd": cwd})
         self._save_event_to_file(command)
         await self._pub_sub(command)
 
         # Execute the bash command in a background task
         task = asyncio.create_task(self._execute_bash_command(command))
-
+        self._tasks.add(task)
+        task.add_done_callback(self._tasks.discard)
         return command, task
 
     async def _execute_bash_command(self, command: BashCommand) -> None:
@@ -347,6 +354,10 @@ class BashEventService:
                     timeout=command.timeout,
                 )
                 exit_code = process.returncode
+            except asyncio.CancelledError:
+                self._signal_process_group(process, signal.SIGKILL)
+                await process.wait()
+                raise
             except TimeoutError:
                 # Send SIGTERM to the whole process group so user-installed
                 # cleanup traps can run, then escalate to SIGKILL if needed.
@@ -509,6 +520,11 @@ class BashEventService:
 
     async def close(self):
         """Close the bash event service and clean up resources."""
+        self._closed = True
+        tasks = list(self._tasks)
+        for task in tasks:
+            task.cancel()
+        await asyncio.gather(*tasks, return_exceptions=True)
         await self._pub_sub.close()
 
     async def __aenter__(self):

{openhands_agent_server-1.46.0 → openhands_agent_server-1.48.0}/openhands/agent_server/conversation_router.py

@@ -31,6 +31,8 @@ from openhands.agent_server.models import (
     AskAgentResponse,
     ConversationInfo,
     ConversationPage,
+    ConversationRuntimeInfo,
+    ConversationRuntimeStatus,
     ConversationSortOrder,
     ForkConversationRequest,
     NavigateConversationRequest,
@@ -94,7 +96,7 @@ async def search_conversations(
     ] = None,
     limit: Annotated[
         int,
-        Query(title="The max number of results in the page", gt=0, lte=100),
+        Query(title="The max number of results in the page", gt=0, le=100),
     ] = 100,
     status: Annotated[
         ConversationExecutionStatus | None,
@@ -108,8 +110,6 @@ async def search_conversations(
     conversation_service: ConversationService = Depends(get_conversation_service),
 ) -> ConversationPage:
     """Search / List conversations"""
-    assert limit > 0
-    assert limit <= 100
     page = await conversation_service.search_conversations(
         page_id, limit, status, sort_order
     )
@@ -158,6 +158,29 @@ async def get_conversation(
     return conversation
 
 
+@conversation_router.get("/{conversation_id}/runtime")
+async def get_local_conversation_runtime(
+    conversation_id: UUID,
+    conversation_service: ConversationService = Depends(get_conversation_service),
+) -> ConversationRuntimeInfo:
+    """Inspect the always-available in-process runtime."""
+    if await conversation_service.get_conversation(conversation_id) is None:
+        raise HTTPException(status.HTTP_404_NOT_FOUND)
+    return ConversationRuntimeInfo(
+        runtime_status=ConversationRuntimeStatus.AVAILABLE,
+        can_resume=True,
+    )
+
+
+@conversation_router.post("/{conversation_id}/runtime/reprovision")
+async def reprovision_local_conversation_runtime(
+    conversation_id: UUID,
+    conversation_service: ConversationService = Depends(get_conversation_service),
+) -> ConversationRuntimeInfo:
+    """Return local runtime state; local mode has no infrastructure to provision."""
+    return await get_local_conversation_runtime(conversation_id, conversation_service)
+
+
 @conversation_router.get(
     "/{conversation_id}/agent_final_response",
     responses={404: {"description": "Conversation not found"}},

{openhands_agent_server-1.46.0 → openhands_agent_server-1.48.0}/openhands/agent_server/conversation_service.py

@@ -61,7 +61,11 @@ from openhands.sdk.conversation.title_utils import (
     extract_message_text,
     generate_title_from_message,
 )
-from openhands.sdk.credential import CredentialBindingError, VersionedCredentialBinding
+from openhands.sdk.credential import (
+    CredentialAuthorizationRejected,
+    CredentialBindingError,
+    VersionedCredentialBinding,
+)
 from openhands.sdk.event import MessageEvent
 from openhands.sdk.event.conversation_state import ConversationStateUpdateEvent
 from openhands.sdk.git.exceptions import GitCommandError, GitRepositoryError
@@ -352,9 +356,13 @@ def _resolve_agent_from_profile(
     cipher: "Cipher | None",
     mcp_config: "dict[str, MCPServer]",
     acp_skill_sourcing: ACPSkillSourcing = "native",
-) -> "tuple[AgentBase, LaunchedAgentProfile]":
+) -> "tuple[AgentBase, LaunchedAgentProfile, set[str] | None]":
     """Load and resolve an agent profile by id, returning the built agent + provenance.
 
+    The third element is the profile's secret allow-list (``None`` = unrestricted)
+    — strictly ``secret_refs``, with nothing added back. It is returned rather
+    than applied here because the secrets ride the start request, not the agent.
+
     Runs synchronously (call via ``asyncio.to_thread`` from async context).
 
     Args:
@@ -449,8 +457,10 @@ def _resolve_agent_from_profile(
     launched = LaunchedAgentProfile(
         agent_profile_id=profile.id,
         revision=profile.revision,
+        secret_refs=profile.secret_refs,
     )
-    return agent, launched
+    allowed_secrets = None if profile.secret_refs is None else set(profile.secret_refs)
+    return agent, launched, allowed_secrets
 
 
 def _compose_conversation_info(
@@ -819,6 +829,18 @@ class ConversationService:
                 if event_services is not None
                 else None
             )
+            record = self._conversation_records.get(conversation_id)
+            stored = (
+                event_service.stored
+                if event_service is not None
+                else (record.stored if record is not None else None)
+            )
+            if stored is not None and not self._profile_allows_secret(
+                stored, secret_name
+            ):
+                raise CredentialAuthorizationRejected(
+                    "The launched agent profile excludes this credential"
+                )
             if event_service is not None and event_service.is_open():
                 await event_service.activate_credential_binding(secret_name, binding)
                 record = self._conversation_records.get(conversation_id)
@@ -860,6 +882,11 @@ class ConversationService:
                 raise first_error
             self._credential_bindings = {}
 
+    @staticmethod
+    def _profile_allows_secret(stored: StoredConversation, name: str) -> bool:
+        profile = stored.launched_agent_profile
+        return profile is None or profile.allows_secret(name)
+
     @staticmethod
     def _is_codex_agent(agent: AgentBase | None) -> bool:
         return isinstance(agent, ACPAgent) and agent.acp_server == "codex"
@@ -885,9 +912,14 @@ class ConversationService:
         # ``_load_persisted_state_sync`` usage elsewhere.
         if agent is None:
             agent = await asyncio.to_thread(self._agent_from_base_state, stored.id)
-        bindings = self._credential_bindings.pop(stored.id, {})
+        bindings = {
+            name: binding
+            for name, binding in self._credential_bindings.pop(stored.id, {}).items()
+            if self._profile_allows_secret(stored, name)
+        }
         if (
-            CODEX_AUTH_SECRET_NAME not in bindings
+            self._profile_allows_secret(stored, CODEX_AUTH_SECRET_NAME)
+            and CODEX_AUTH_SECRET_NAME not in bindings
             and self._is_codex_agent(agent)
             and await self._has_local_codex_credential()
         ):
@@ -1427,6 +1459,23 @@ class ConversationService:
         ):
             async with self._conversation_lifecycle(conversation_id):
                 existing_event_service = self._event_services.get(conversation_id)
+                stored = (
+                    existing_event_service.stored
+                    if existing_event_service is not None
+                    else existing_record.stored
+                    if existing_record is not None
+                    else None
+                )
+                if stored is not None:
+                    request = request.model_copy(
+                        update={
+                            "secrets": {
+                                name: value
+                                for name, value in request.secrets.items()
+                                if self._profile_allows_secret(stored, name)
+                            }
+                        }
+                    )
                 if (
                     existing_event_service is not None
                     and existing_event_service.is_open()
@@ -1595,14 +1644,27 @@ class ConversationService:
 
         if request.agent_profile_id is not None:
             mcp_config = settings.agent_settings.mcp_config
-            resolved_agent, launched_agent_profile = await asyncio.to_thread(
+            (
+                resolved_agent,
+                launched_agent_profile,
+                allowed_secrets,
+            ) = await asyncio.to_thread(
                 _resolve_agent_from_profile,
                 request.agent_profile_id,
                 self.cipher,
                 mcp_config,
                 acp_skill_sourcing=self.acp_skill_sourcing,
             )
-            request = request.model_copy(update={"agent": resolved_agent})
+            updates: dict[str, Any] = {"agent": resolved_agent}
+            # Enforced here, not client-side: a caller that sends more secrets
+            # than the profile allows must not widen the agent's scope.
+            if allowed_secrets is not None:
+                updates["secrets"] = {
+                    name: value
+                    for name, value in request.secrets.items()
+                    if name in allowed_secrets
+                }
+            request = request.model_copy(update=updates)
 
         # Applied unconditionally: a serialized agent always carries
         # ``load_memory`` (model_dump emits defaults), so there is no way to

{openhands_agent_server-1.46.0 → openhands_agent_server-1.48.0}/openhands/agent_server/dependencies.py

@@ -70,7 +70,15 @@ def get_conversation_service(request: Request) -> ConversationService:
     return service
 
 
-def get_bash_event_service(request: Request) -> BashEventService:
+async def get_bash_event_service(request: Request) -> BashEventService:
+    if "runtime_conversation_id" in request.path_params:
+        event_service: EventService = request.state.runtime_event_service
+        if event_service.bash_event_service is None:
+            event_service.bash_event_service = BashEventService(
+                bash_events_dir=event_service.conversation_dir / "bash_events",
+                default_cwd=event_service.get_conversation().workspace.working_dir,
+            )
+        return event_service.bash_event_service
     service = getattr(request.app.state, "bash_event_service", None)
     if service is None:
         raise HTTPException(

{openhands_agent_server-1.46.0 → openhands_agent_server-1.48.0}/openhands/agent_server/docker/Dockerfile

@@ -3,7 +3,7 @@
 # NOTE: LC_ALL/LANG must be set to C.UTF-8 for libtmux to work correctly with
 # PyInstaller builds. Without proper locale, tmux converts UTF-8 separator
 # characters to underscores, breaking libtmux's format parsing.
-ARG BASE_IMAGE=nikolaik/python-nodejs:python3.13-nodejs22-slim
+ARG BASE_IMAGE=python-node-runtime
 ARG USERNAME=openhands
 ARG UID=10001
 ARG GID=10001
@@ -26,6 +26,70 @@ ARG INSTALL_ACP_PROVIDERS=claude-code,codex,gemini-cli
 # below is written so that's a one-case addition, not a signature change.
 ARG INSTALL_CAPABILITIES=vscode,browser,docker
 
+####################################################################################
+# Canonical Python + Node runtime
+#
+# Start from Debian itself and copy only the language runtimes from their official
+# images. The final stage installs only the shared libraries required by Python
+# and Node; developer and package-manager tooling is added by the agent-server
+# stages below when needed. Package upgrades resolve against a dated snapshot so
+# newly published Debian packages have a seven-day observation period.
+####################################################################################
+FROM python:3.13.15-slim-trixie AS python-runtime
+FROM node:24.21.0-trixie-slim AS node-runtime
+FROM debian:trixie-slim AS python-node-runtime
+# Temporary exception to pick up Debian 13.7 before the normal observation period.
+ARG DEBIAN_SNAPSHOT=20260913T000000Z
+
+COPY --from=python-runtime /usr/local /usr/local
+COPY --from=node-runtime /usr/local/bin/node /usr/local/bin/node
+COPY --from=node-runtime /usr/local/lib/node_modules /usr/local/lib/node_modules
+
+RUN set -eux; \
+    ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm; \
+    ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx; \
+    ln -s ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack; \
+    printf '%s\n' \
+        'Types: deb' \
+        "URIs: http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}/" \
+        'Suites: trixie' \
+        'Components: main' \
+        'Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg' \
+        'Check-Valid-Until: no' \
+        '' \
+        'Types: deb' \
+        "URIs: http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}/" \
+        'Suites: trixie-security' \
+        'Components: main' \
+        'Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg' \
+        'Check-Valid-Until: no' \
+        > /etc/apt/sources.list.d/debian.sources; \
+    apt-get update; \
+    apt-get upgrade -y; \
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        libbz2-1.0 \
+        libdb5.3t64 \
+        libffi8 \
+        libgcc-s1 \
+        libgdbm6t64 \
+        liblzma5 \
+        libncursesw6 \
+        libreadline8t64 \
+        libsqlite3-0 \
+        libssl3t64 \
+        libstdc++6 \
+        libtinfo6 \
+        libuuid1 \
+        libzstd1 \
+        netbase \
+        tzdata \
+        zlib1g; \
+    rm -rf /var/lib/apt/lists/*; \
+    python3 --version; \
+    node --version; \
+    npm --version
+
 ####################################################################################
 # Builder (source mode)
 # We copy source + build a venv here for local dev and debugging.
@@ -168,9 +232,8 @@ RUN set -eux; \
 
 ####################################################################################
 # Base image (minimal)
-# It includes only basic packages and the UV runtime.
-# No Docker, no browser, no VSCode Web.
-# Suitable for running in headless/evaluation mode.
+# It includes only the packages required to run the agent server and its Bash
+# and Git APIs. Development tools and optional capabilities live in base-image.
 ####################################################################################
 FROM ${BASE_IMAGE} AS base-image-minimal
 ARG USERNAME UID GID PORT
@@ -192,36 +255,22 @@ RUN set -eux; \
     if command -v apt-get >/dev/null 2>&1; then \
         apt-get -o Acquire::Retries=5 update; \
         apt-get -o Acquire::Retries=5 install -y --no-install-recommends \
-            bash ca-certificates curl wget sudo apt-utils git jq tmux tar \
-            build-essential coreutils util-linux procps findutils grep sed \
-            tini apt-transport-https gnupg lsb-release xz-utils; \
+            bash ca-certificates git tini tmux; \
         rm -rf /var/lib/apt/lists/*; \
     elif command -v apk >/dev/null 2>&1; then \
-        apk add --no-cache \
-            bash ca-certificates curl wget sudo git jq tmux tar build-base \
-            coreutils util-linux procps findutils grep sed tini gnupg shadow xz; \
+        apk add --no-cache bash ca-certificates git shadow tini tmux; \
     elif command -v microdnf >/dev/null 2>&1; then \
-        microdnf install -y \
-            bash ca-certificates curl wget sudo git jq tmux tar make gcc gcc-c++ \
-            coreutils util-linux procps-ng findutils grep sed shadow-utils \
-            gnupg2 xz; \
+        microdnf install -y bash ca-certificates git shadow-utils tmux; \
         microdnf clean all; \
     elif command -v dnf >/dev/null 2>&1; then \
-        dnf install -y \
-            bash ca-certificates curl wget sudo git jq tmux tar make gcc gcc-c++ \
-            coreutils util-linux procps-ng findutils grep sed shadow-utils \
-            gnupg2 xz; \
+        dnf install -y bash ca-certificates git shadow-utils tmux; \
         dnf clean all; \
     elif command -v yum >/dev/null 2>&1; then \
-        yum install -y \
-            bash ca-certificates curl wget sudo git jq tmux tar make gcc gcc-c++ \
-            coreutils util-linux procps-ng findutils grep sed shadow-utils \
-            gnupg2 xz; \
+        yum install -y bash ca-certificates git shadow-utils tmux; \
         yum clean all; \
     elif command -v zypper >/dev/null 2>&1; then \
         zypper --non-interactive install --no-recommends \
-            bash ca-certificates curl wget sudo git jq tmux tar make gcc gcc-c++ \
-            coreutils util-linux procps findutils grep sed shadow gpg2 xz; \
+            bash ca-certificates git shadow tmux; \
         zypper clean --all; \
     else \
         echo "Unsupported base image: no known package manager found" >&2; \
@@ -230,11 +279,6 @@ RUN set -eux; \
     grep -Eq "^[^:]*:[^:]*:${GID}:" /etc/group || groupadd -g "${GID}" "${USERNAME}"; \
     grep -Eq "^${USERNAME}:" /etc/passwd || \
         useradd -m -u "${UID}" -g "${GID}" -s /bin/bash "${USERNAME}"; \
-    # Best-effort: add user to a sudo group when one exists (Debian-style
-    # `sudo` group). On Alpine/RHEL/SUSE there is no `sudo` group by default,
-    # and the NOPASSWD sudoers line below grants sudo regardless of group.
-    usermod -aG sudo "${USERNAME}" 2>/dev/null || true; \
-    echo "${USERNAME} ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers; \
     mkdir -p /workspace/project; \
     chown -R "${USERNAME}:${USERNAME}" /workspace
 
@@ -274,10 +318,6 @@ RUN if ! "$ACP_NODE_DIR/bin/node" --version >/dev/null 2>&1; then \
 RUN mkdir -p /etc/claude-code && \
     echo '{"permissions":{"allow":["Edit","Read","Bash"]}}' > /etc/claude-code/managed-settings.json
 
-# NOTE: we should NOT include UV_PROJECT_ENVIRONMENT here,
-# since the agent might use it to perform other work (e.g. tools that use Python)
-COPY --from=ghcr.io/astral-sh/uv:0.11.6 /uv /uvx /bin/
-
 USER ${USERNAME}
 WORKDIR /
 # Locale settings required for libtmux to work with PyInstaller builds
@@ -299,6 +339,47 @@ ARG INSTALL_CAPABILITIES
 
 USER root
 
+# Full images are general-purpose development environments. Keep compilers,
+# package/repository helpers, and command-line utilities out of binary-minimal.
+RUN set -eux; \
+    if command -v apt-get >/dev/null 2>&1; then \
+        apt-get -o Acquire::Retries=5 update; \
+        apt-get -o Acquire::Retries=5 install -y --no-install-recommends \
+            apt-transport-https apt-utils build-essential coreutils curl \
+            findutils gnupg grep jq lsb-release procps sed sudo tar util-linux \
+            wget xz-utils; \
+        rm -rf /var/lib/apt/lists/*; \
+    elif command -v apk >/dev/null 2>&1; then \
+        apk add --no-cache \
+            build-base coreutils curl findutils gnupg grep jq procps sudo tar \
+            util-linux wget xz; \
+    elif command -v microdnf >/dev/null 2>&1; then \
+        microdnf install -y \
+            coreutils curl findutils gcc gcc-c++ gnupg2 grep jq make procps-ng \
+            sed sudo tar util-linux wget xz; \
+        microdnf clean all; \
+    elif command -v dnf >/dev/null 2>&1; then \
+        dnf install -y \
+            coreutils curl findutils gcc gcc-c++ gnupg2 grep jq make procps-ng \
+            sed sudo tar util-linux wget xz; \
+        dnf clean all; \
+    elif command -v yum >/dev/null 2>&1; then \
+        yum install -y \
+            coreutils curl findutils gcc gcc-c++ gnupg2 grep jq make procps-ng \
+            sed sudo tar util-linux wget xz; \
+        yum clean all; \
+    elif command -v zypper >/dev/null 2>&1; then \
+        zypper --non-interactive install --no-recommends \
+            coreutils curl findutils gcc gcc-c++ gpg2 grep jq make procps sed \
+            sudo tar util-linux wget xz; \
+        zypper clean --all; \
+    fi; \
+    usermod -aG sudo "${USERNAME}" 2>/dev/null || true; \
+    echo "${USERNAME} ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
+
+# Keep uv as part of the full development environment, but not binary-minimal.
+COPY --from=ghcr.io/astral-sh/uv:0.11.6 /uv /uvx /bin/
+
 # Fail fast on a typo'd capability name before spending any time on the
 # installs below (each block only checks for ITS OWN keyword's presence, so
 # an unrecognized one would otherwise be silently ignored rather than erroring).

{openhands_agent_server-1.46.0 → openhands_agent_server-1.48.0}/openhands/agent_server/docker/build.py

@@ -393,9 +393,7 @@ _DEFAULT_PACKAGE_VERSION = _package_version()
 
 
 class BuildOptions(BaseModel):
-    # NOTE: Using Python 3.12 due to PyInstaller+libtmux compatibility issue
-    # with Python 3.13. See issue #1886 for details.
-    base_image: str = Field(default="nikolaik/python-nodejs:python3.12-nodejs22-slim")
+    base_image: str = Field(default="python-node-runtime")
     custom_tags: str = Field(
         default="", description="Comma-separated list of custom tags."
     )
@@ -1069,9 +1067,7 @@ def main(argv: list[str]) -> int:
     )
     parser.add_argument(
         "--base-image",
-        # NOTE: Using Python 3.12 due to PyInstaller+libtmux compatibility issue
-        # with Python 3.13. See issue #1886.
-        default=_env("BASE_IMAGE", "nikolaik/python-nodejs:python3.12-nodejs22-slim"),
+        default=_env("BASE_IMAGE", "python-node-runtime"),
         help="Base image to use (default from $BASE_IMAGE).",
     )
     parser.add_argument(

{openhands_agent_server-1.46.0 → openhands_agent_server-1.48.0}/openhands/agent_server/event_router.py

@@ -70,7 +70,7 @@ async def search_conversation_events(
     ] = None,
     limit: Annotated[
         int,
-        Query(title="The max number of results in the page", gt=0, lte=100),
+        Query(title="The max number of results in the page", gt=0, le=100),
     ] = 100,
     kind: Annotated[
         str | None,
@@ -101,8 +101,6 @@ async def search_conversation_events(
     event_service: EventService = Depends(get_event_service),
 ) -> JSONResponse:
     """Search / List local events"""
-    assert limit > 0
-    assert limit <= 100
 
     # Normalize timezone-aware datetimes to server timezone
     normalized_gte = (