openhands-sdk 1.29.2__tar.gz → 1.29.3__tar.gz

{openhands_sdk-1.29.2 → openhands_sdk-1.29.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhands-sdk
-Version: 1.29.2
+Version: 1.29.3
 Summary: OpenHands SDK - Core functionality for building AI agents
 Project-URL: Source, https://github.com/OpenHands/software-agent-sdk
 Project-URL: Homepage, https://github.com/OpenHands/software-agent-sdk

{openhands_sdk-1.29.2 → openhands_sdk-1.29.3}/openhands/sdk/agent/agent.py

@@ -61,6 +61,7 @@ from openhands.sdk.llm import (
 )
 from openhands.sdk.llm.exceptions import (
     FunctionCallValidationError,
+    LLMContentPolicyViolationError,
     LLMContextWindowExceedError,
     LLMMalformedConversationHistoryError,
 )
@@ -607,6 +608,28 @@ class Agent(CriticMixin, ResponseDispatchMixin, AgentBase):
             )
             on_event(error_message)
             return
+        except LLMContentPolicyViolationError as e:
+            # Content-policy blocks are deterministic; nudge the model and let the
+            # run loop continue instead of emitting a fatal error.
+            logger.warning(f"LLM output blocked by content filter: {e}")
+            on_event(
+                MessageEvent(
+                    source="user",
+                    llm_message=Message(
+                        role="user",
+                        content=[
+                            TextContent(
+                                text=(
+                                    "Your previous response was blocked by the "
+                                    "model's content filter. Please continue, "
+                                    "rephrasing to avoid the flagged content."
+                                )
+                            )
+                        ],
+                    ),
+                )
+            )
+            return
         except LLMMalformedConversationHistoryError as e:
             # The provider rejected the current message history as structurally
             # invalid (for example, broken tool_use/tool_result pairing). Route
@@ -747,6 +770,28 @@ class Agent(CriticMixin, ResponseDispatchMixin, AgentBase):
             )
             on_event(error_message)
             return
+        except LLMContentPolicyViolationError as e:
+            # Content-policy blocks are deterministic; nudge the model and let the
+            # run loop continue instead of emitting a fatal error.
+            logger.warning(f"LLM output blocked by content filter: {e}")
+            on_event(
+                MessageEvent(
+                    source="user",
+                    llm_message=Message(
+                        role="user",
+                        content=[
+                            TextContent(
+                                text=(
+                                    "Your previous response was blocked by the "
+                                    "model's content filter. Please continue, "
+                                    "rephrasing to avoid the flagged content."
+                                )
+                            )
+                        ],
+                    ),
+                )
+            )
+            return
         except LLMMalformedConversationHistoryError as e:
             # The provider rejected the current message history as
             # structurally invalid (for example, broken

{openhands_sdk-1.29.2 → openhands_sdk-1.29.3}/openhands/sdk/agent/base.py

@@ -9,6 +9,7 @@ from abc import ABC, abstractmethod
 from collections import Counter
 from collections.abc import Generator, Iterable, Sequence
 from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
 from typing import TYPE_CHECKING, Any, Literal
 
 from pydantic import (
@@ -248,10 +249,14 @@ class AgentBase(DiscriminatedUnionMixin, ABC):
     security_policy_filename: str = Field(
         default="security_policy.j2",
         description=(
-            "Security policy template filename. Can be either:\n"
-            "- A relative filename (e.g., 'security_policy.j2') loaded from the "
-            "agent's prompts directory\n"
-            "- An absolute path (e.g., '/path/to/custom_security_policy.j2')\n"
+            "Security policy filename. The default 'security_policy.j2' is a "
+            "back-compat sentinel (the file was removed) that selects the built-in "
+            "default policy from the prompt registry -- it is not loaded from disk. "
+            "Any other value names a custom policy file whose contents are inserted "
+            "verbatim (NOT rendered as a Jinja template). Can be either:\n"
+            "- A relative filename (e.g., 'custom_security_policy.md') loaded from "
+            "the agent's prompts directory\n"
+            "- An absolute path (e.g., '/path/to/custom_security_policy.md')\n"
             "- Empty string to disable security policy"
         ),
     )
@@ -464,12 +469,10 @@ class AgentBase(DiscriminatedUnionMixin, ABC):
         per-conversation context. This static portion can be cached and reused
         across conversations for better prompt caching efficiency.
 
-        The default prompt is assembled from the typed section registry
-        (``create_registry``). Escape hatches keep the Jinja render path: an inline
-        ``system_prompt`` is returned verbatim; a custom/absolute
-        ``system_prompt_filename`` renders through ``render_template``; a subclass
-        with its own ``prompt_dir`` still renders its default-named template; and a
-        custom ``security_policy_filename`` renders so its policy file is included.
+        The default prompt is assembled from the typed section registry, which also
+        resolves a custom ``security_policy_filename``. Escape hatches keep the Jinja
+        path: an inline ``system_prompt`` is returned verbatim; a custom
+        ``system_prompt_filename`` or subclass ``prompt_dir`` renders its own template.
 
         Returns:
             The static system prompt without dynamic context.
@@ -477,14 +480,11 @@ class AgentBase(DiscriminatedUnionMixin, ABC):
         if self.system_prompt is not None:
             return self.system_prompt
 
-        # Escape hatch: custom/absolute filename, a subclass with its own
-        # prompt_dir, or a custom security policy. The registry reproduces only
-        # the built-in default prompt (default template + default policy); a
-        # non-default security_policy_filename must keep the Jinja include path.
+        # Escape hatch: a custom filename or a subclass's own prompt_dir renders its
+        # own Jinja template; everything else (incl. custom policies) uses the registry.
         if (
             self.system_prompt_filename != "system_prompt.j2"
             or os.path.realpath(self.prompt_dir) != _BUILTIN_PROMPT_DIR
-            or self.security_policy_filename != "security_policy.j2"
         ):
             return render_template(
                 prompt_dir=self.prompt_dir,
@@ -525,6 +525,24 @@ class AgentBase(DiscriminatedUnionMixin, ABC):
                 template_kwargs["model_variant"] = spec.variant
         return template_kwargs
 
+    def _read_custom_security_policy(self) -> str | None:
+        """Raw contents of a custom security policy file -- inserted verbatim, NOT
+        rendered as a Jinja template.
+
+        Returns ``None`` -- so ``SecuritySection`` keeps its built-in default policy
+        -- when ``security_policy_filename`` is the default sentinel
+        ``"security_policy.j2"`` (a string only; the file was removed, so it is never
+        read) or ``""`` (an empty *filename*, which disables the policy). A configured
+        file whose own contents are empty still returns ``""`` (an empty custom
+        policy), not ``None``.
+
+        Relative names resolve against ``prompt_dir``; absolute paths are used as-is.
+        """
+        filename = self.security_policy_filename
+        if not filename or filename == "security_policy.j2":
+            return None
+        return (Path(self.prompt_dir) / filename).read_text(encoding="utf-8")
+
     def _build_prompt_context(
         self,
         additional_secret_infos: list[dict[str, str | None]] | None = None,
@@ -578,8 +596,17 @@ class AgentBase(DiscriminatedUnionMixin, ABC):
             # secrets (additional_secret_infos), matching what <CUSTOM_SECRETS> shows.
             secret_names = tuple(name for name, _ in secret_infos if name)
 
+        template_kwargs = self._resolved_template_kwargs()
+        # A custom security policy's content for SecuritySection (registry path only).
+        policy_content = self._read_custom_security_policy()
+        if policy_content is not None:
+            template_kwargs = {
+                **template_kwargs,
+                "security_policy_content": policy_content,
+            }
+
         return PromptContext(
-            template_kwargs=self._resolved_template_kwargs(),
+            template_kwargs=template_kwargs,
             tool_names=tuple(t.name for t in self.tools),
             platform=Platform.current(),
             working_dir=None,

{openhands_sdk-1.29.2 → openhands_sdk-1.29.3}/openhands/sdk/context/agent_context.py

@@ -16,6 +16,8 @@ from pydantic import (
 )
 
 from openhands.sdk.context.prompts import render_template
+from openhands.sdk.context.prompts.presets import create_registry
+from openhands.sdk.context.prompts.section import PromptContext
 from openhands.sdk.llm import Message, TextContent
 from openhands.sdk.llm.utils.model_prompt_spec import get_model_prompt_spec
 from openhands.sdk.logger import get_logger
@@ -41,8 +43,8 @@ PROMPT_DIR = pathlib.Path(__file__).parent / "prompts" / "templates"
 
 
 class ResolvedDynamicData(NamedTuple):
-    """Dynamic-tier inputs resolved once, shared by the legacy ``.j2`` renderer and
-    the section registry (skills gated by model family, secrets merged)."""
+    """Dynamic-tier inputs resolved once, fed into the section registry
+    (skills gated by model family, secrets merged)."""
 
     repo_skills: list[Skill]
     available_skills_prompt: str
@@ -327,27 +329,16 @@ class AgentContext(BaseModel):
         data = self._resolve_dynamic_data(
             llm_model, llm_model_canonical, additional_secret_infos
         )
-        has_content = (
-            data.repo_skills
-            or self.system_message_suffix
-            or data.secret_infos
-            or data.available_skills_prompt
-            or data.formatted_datetime
+        ctx = PromptContext(
+            now=data.formatted_datetime,
+            repo_skills=tuple((s.name, s.content) for s in data.repo_skills),
+            available_skills_prompt=data.available_skills_prompt or None,
+            custom_suffix=self.system_message_suffix or None,
+            secret_infos=tuple(
+                (info["name"] or "", info["description"]) for info in data.secret_infos
+            ),
         )
-        if has_content:
-            formatted_text = render_template(
-                prompt_dir=str(PROMPT_DIR),
-                template_name="system_message_suffix.j2",
-                repo_skills=data.repo_skills,
-                system_message_suffix=self.system_message_suffix or "",
-                secret_infos=data.secret_infos,
-                available_skills_prompt=data.available_skills_prompt,
-                current_datetime=data.formatted_datetime,
-            ).strip()
-            return formatted_text
-        elif self.system_message_suffix and self.system_message_suffix.strip():
-            return self.system_message_suffix.strip()
-        return None
+        return create_registry().build(ctx).dynamic
 
     def _resolve_dynamic_data(
         self,
@@ -433,9 +424,10 @@ class AgentContext(BaseModel):
         this adapter only emits prompt-only context.  Unsupported AgentContext
         fields are rejected by :meth:`validate_acp_compatibility`.
 
-        The rendering reuses :meth:`get_system_message_suffix` with the same
-        ``system_message_suffix.j2`` template so that ACP agents receive the
-        identical prompt layout as the regular agent.  This includes the
+        The rendering reuses :meth:`get_system_message_suffix`, which assembles
+        the dynamic-tier sections via the shared prompt registry, so that ACP
+        agents receive the identical prompt layout as the regular agent.  This
+        includes the
         ``<CUSTOM_SECRETS>`` block when secrets are present, informing the ACP
         subprocess which environment variables are available.  The actual secret
         values are injected into the subprocess environment by
@@ -455,7 +447,8 @@ class AgentContext(BaseModel):
         """
         self.validate_acp_compatibility()
         # No model-specific skill filtering for ACP — delegate to the shared
-        # renderer which also renders the <CUSTOM_SECRETS> block from secrets.
+        # builder, whose dynamic-tier sections also emit the <CUSTOM_SECRETS>
+        # block from secrets.
         return self.get_system_message_suffix(
             additional_secret_infos=additional_secret_infos
         )

{openhands_sdk-1.29.2 → openhands_sdk-1.29.3}/openhands/sdk/context/prompts/presets.py

@@ -2,8 +2,8 @@
 
 ``create_registry()`` registers the static-tier sections in the exact order
 ``agent/prompts/system_prompt.j2`` emits them, so ``registry.build(ctx).static``
-reproduces ``AgentBase.static_system_message``. The dynamic-tier sections
-(``system_message_suffix.j2``) are appended separately. It will gain a ``preset``
+reproduces ``AgentBase.static_system_message``. The dynamic-tier sections are
+appended separately. It will gain a ``preset``
 flag to select among prompt variants (interactive, planning, ...) over the same
 engine; today it returns the default composition.
 """
@@ -62,7 +62,7 @@ def create_registry() -> PromptRegistry:
     r.register(TroubleshootingSection())
     r.register(ProcessManagementSection())
     r.register(ModelSpecificSection())  # guard: model_family resolved
-    # dynamic tier -- ported verbatim from system_message_suffix.j2 (#3610)
+    # dynamic tier (#3610)
     r.register(DateTimeSection())
     r.register(RepoContextSection())  # guard: gated repo skills present
     r.register(AvailableSkillsSection())  # guard: available_skills_prompt

{openhands_sdk-1.29.2 → openhands_sdk-1.29.3}/openhands/sdk/context/prompts/sections/dynamic.py

@@ -1,5 +1,4 @@
-"""Dynamic-tier prompt sections ported verbatim from
-``context/prompts/templates/system_message_suffix.j2``.
+"""Dynamic-tier prompt sections.
 
 These render per-conversation content (datetime, repo context, available skills,
 custom suffix, secrets) into the ``DYNAMIC`` block. All inputs are resolved into the

{openhands_sdk-1.29.2 → openhands_sdk-1.29.3}/openhands/sdk/context/prompts/sections/static.py

@@ -219,11 +219,9 @@ Always provide links to the relevant documentation pages for users who want to l
 
 
 class SecuritySection(_StaticTextSection):
-    """The ``<SECURITY>`` block wrapping the default security policy.
-
-    Guarded by ``security_policy_filename`` (empty string disables it). The body is
-    the default policy; a custom ``security_policy_filename`` would resolve its content
-    into the context instead (a follow-up; not exercised by the snapshot matrix).
+    """The ``<SECURITY>`` block: the built-in default policy, or a custom policy's
+    ``security_policy_content`` when configured. Guarded by ``security_policy_filename``
+    (empty string disables it).
     """
 
     name = "security"
@@ -261,6 +259,13 @@ class SecuritySection(_StaticTextSection):
     def guard(self, ctx: PromptContext) -> bool:
         return bool(ctx.template_kwargs.get("security_policy_filename"))
 
+    def render(self, ctx: PromptContext) -> str | None:
+        content = ctx.template_kwargs.get("security_policy_content")
+        # `is not None`: an explicitly empty custom policy must not fall back to body.
+        if content is not None:
+            return _refine(f"<SECURITY>\n\n{content}\n\n</SECURITY>", ctx.platform)
+        return self.body
+
 
 class SecurityRiskAssessmentSection:
     """``<SECURITY_RISK_ASSESSMENT>`` -- the LOW/MEDIUM/HIGH tiers swap with ``cli_mode``."""

{openhands_sdk-1.29.2 → openhands_sdk-1.29.3}/openhands/sdk/conversation/impl/local_conversation.py

@@ -61,6 +61,7 @@ from openhands.sdk.plugin import (
     PluginSource,
     ResolvedPluginSource,
     fetch_plugin_with_resolution,
+    load_available_plugins,
 )
 from openhands.sdk.secret import StaticSecret
 from openhands.sdk.security.analyzer import SecurityAnalyzerBase
@@ -662,6 +663,10 @@ class LocalConversation(BaseConversation):
 
         all_plugin_hooks: list[HookConfig] = []
         all_plugin_agents: list[AgentDefinition] = []
+        # Names of explicitly-attached plugins (populated in the loop below). Used
+        # to keep explicit attach authoritative over ambient installed/local
+        # plugins (and to avoid double-registering their hooks/agents).
+        explicit_plugin_names: set[str] = set()
 
         merged_context = self.agent.agent_context
         merged_mcp = dict(self.agent.mcp_config) if self.agent.mcp_config else {}
@@ -743,6 +748,7 @@ class LocalConversation(BaseConversation):
                     f"Loaded plugin '{plugin.manifest.name}'"
                     + (f" @ {resolved_ref[:8]}" if resolved_ref else "")
                 )
+                explicit_plugin_names.add(plugin.name)
 
                 # Merge plugin contents
                 merged_context = plugin.add_skills_to(merged_context)
@@ -759,6 +765,54 @@ class LocalConversation(BaseConversation):
 
             logger.info(f"Loaded {len(plugins_to_load)} plugin(s) via Conversation")
 
+        # Ambient plugins: enabled installed plugins plus local user/project
+        # plugins, mirroring how installed/local skills already auto-load. These
+        # are additive to the explicit plugins above, de-duplicated by plugin
+        # name. Explicit attach wins: an ambient plugin whose name was already
+        # attached above is skipped (this also avoids double-registering its
+        # hooks/agents). Best-effort — a failure here must not prevent the
+        # conversation from starting.
+        #
+        # Ambient plugins have no pinned commit SHA, so (unlike explicit attach)
+        # they are intentionally NOT recorded in self._resolved_plugins. On
+        # resume they are re-discovered from disk / current enabled state, just
+        # like project skills. Automation/sandbox runs lack the user's installed
+        # and home directories, so discovery naturally yields nothing there.
+        ambient_plugins_loaded = False
+        try:
+            ambient_plugins = load_available_plugins(
+                work_dir=self.workspace.working_dir,
+                include_user=True,
+                include_project=True,
+            )
+        except Exception:
+            logger.warning(
+                "Failed to load ambient (installed/local) plugins; "
+                "continuing without them",
+                exc_info=True,
+            )
+            ambient_plugins = {}
+
+        for plugin in ambient_plugins.values():
+            if plugin.name in explicit_plugin_names:
+                logger.debug(
+                    f"Skipping ambient plugin '{plugin.name}' "
+                    "(explicitly attached to this conversation)"
+                )
+                continue
+
+            merged_context = plugin.add_skills_to(merged_context)
+            merged_mcp = plugin.add_mcp_config_to(merged_mcp)
+            has_mcp_config = has_mcp_config or bool(merged_mcp)
+
+            if plugin.hooks and not plugin.hooks.is_empty():
+                all_plugin_hooks.append(plugin.hooks)
+            if plugin.agents:
+                all_plugin_agents.extend(plugin.agents)
+
+            ambient_plugins_loaded = True
+            logger.debug(f"Loaded ambient plugin '{plugin.name}'")
+
         # Resolve project skills from the workspace. AgentContext can't do this
         # itself (the workspace path is unknown at validation time), so it is done
         # here, where the path is known. Project skills take precedence over
@@ -810,7 +864,12 @@ class LocalConversation(BaseConversation):
 
         # Update agent with merged content only if something changed.
         # Skip update otherwise to avoid unnecessary agent state mutations.
-        if plugins_to_load or has_mcp_config or project_skills_loaded:
+        if (
+            plugins_to_load
+            or has_mcp_config
+            or project_skills_loaded
+            or ambient_plugins_loaded
+        ):
             self.agent = self.agent.model_copy(
                 update={
                     "agent_context": merged_context,

{openhands_sdk-1.29.2 → openhands_sdk-1.29.3}/openhands/sdk/llm/exceptions/__init__.py

@@ -1,4 +1,5 @@
 from .classifier import (
+    is_content_policy_violation,
     is_context_window_exceeded,
     is_prompt_cache_too_small,
     looks_like_auth_error,
@@ -11,6 +12,7 @@ from .types import (
     FunctionCallValidationError,
     LLMAuthenticationError,
     LLMBadRequestError,
+    LLMContentPolicyViolationError,
     LLMContextWindowExceedError,
     LLMContextWindowTooSmallError,
     LLMError,
@@ -40,6 +42,7 @@ __all__ = [
     "LLMContextWindowExceedError",
     "LLMMalformedConversationHistoryError",
     "LLMContextWindowTooSmallError",
+    "LLMContentPolicyViolationError",
     "LLMAuthenticationError",
     "LLMRateLimitError",
     "LLMTimeoutError",
@@ -48,6 +51,7 @@ __all__ = [
     "UserCancelledError",
     "OperationCancelled",
     # Helpers
+    "is_content_policy_violation",
     "is_context_window_exceeded",
     "is_prompt_cache_too_small",
     "looks_like_auth_error",

{openhands_sdk-1.29.2 → openhands_sdk-1.29.3}/openhands/sdk/llm/exceptions/classifier.py

@@ -1,9 +1,12 @@
 from __future__ import annotations
 
+from typing import Final
+
 from litellm.exceptions import (
     APIConnectionError,
     AuthenticationError,
     BadRequestError,
+    ContentPolicyViolationError,
     ContextWindowExceededError,
     InternalServerError,
     OpenAIError,
@@ -17,7 +20,7 @@ from .types import (
 
 
 # Minimal, provider-agnostic context-window detection
-LONG_PROMPT_PATTERNS: list[str] = [
+LONG_PROMPT_PATTERNS: Final[list[str]] = [
     "contextwindowexceedederror",
     "prompt is too long",
     "input length and `max_tokens` exceed context limit",
@@ -32,7 +35,7 @@ LONG_PROMPT_PATTERNS: list[str] = [
 # provider. They are tracked separately from true context-window errors so the
 # logs and agent control flow can preserve that distinction while still routing
 # into condensation-based recovery.
-MALFORMED_HISTORY_PATTERNS: list[str] = [
+MALFORMED_HISTORY_PATTERNS: Final[list[str]] = [
     "tool_use ids were found without `tool_result` blocks immediately after",
     # Anthropic backtick variant
     "`tool_use` ids were found without `tool_result` blocks immediately after",
@@ -54,6 +57,30 @@ MALFORMED_HISTORY_PATTERNS: list[str] = [
     "failed to parse tool call arguments as json",
 ]
 
+# Vertex AI (Gemini) rejects context-caching requests when the cached content
+# is below the provider's minimum token threshold (currently 4096 tokens).
+# Example error: "The cached content is of 1171 tokens. The minimum token
+# count to start caching is 4096." — the `.lower()` comparison handles case
+# variation across providers but won't match reworded messages; update this
+# pattern if the API phrasing changes.
+PROMPT_CACHE_TOO_SMALL_PATTERNS: Final[list[str]] = [
+    "minimum token count to start caching",
+]
+
+AUTH_PATTERNS: Final[list[str]] = [
+    "invalid api key",
+    "unauthorized",
+    "missing api key",
+    "invalid authentication",
+    "access denied",
+]
+
+CONTENT_POLICY_PATTERNS: Final[list[str]] = [
+    "content_policy",
+    "content filtering policy",
+    "output blocked by content filtering",
+]
+
 
 def is_context_window_exceeded(exception: Exception) -> bool:
     if isinstance(exception, (ContextWindowExceededError, LLMContextWindowExceedError)):
@@ -86,25 +113,6 @@ def looks_like_malformed_conversation_history_error(exception: Exception) -> boo
     return any(p in s for p in MALFORMED_HISTORY_PATTERNS)
 
 
-# Vertex AI (Gemini) rejects context-caching requests when the cached content
-# is below the provider's minimum token threshold (currently 4096 tokens).
-# Example error: "The cached content is of 1171 tokens. The minimum token
-# count to start caching is 4096." — the `.lower()` comparison handles case
-# variation across providers but won't match reworded messages; update this
-# pattern if the API phrasing changes.
-PROMPT_CACHE_TOO_SMALL_PATTERNS: list[str] = [
-    "minimum token count to start caching",
-]
-
-AUTH_PATTERNS: list[str] = [
-    "invalid api key",
-    "unauthorized",
-    "missing api key",
-    "invalid authentication",
-    "access denied",
-]
-
-
 def is_prompt_cache_too_small(exception: Exception) -> bool:
     """Return True if the error indicates the prompt cache content is too small.
 
@@ -134,3 +142,12 @@ def looks_like_auth_error(exception: Exception) -> bool:
         if code in s:
             return True
     return False
+
+
+def is_content_policy_violation(exception: Exception) -> bool:
+    if isinstance(exception, ContentPolicyViolationError):
+        return True
+    if not isinstance(exception, (BadRequestError, OpenAIError)):
+        return False
+    s = str(exception).lower()
+    return any(p in s for p in CONTENT_POLICY_PATTERNS)

{openhands_sdk-1.29.2 → openhands_sdk-1.29.3}/openhands/sdk/llm/exceptions/mapping.py

@@ -10,6 +10,7 @@ from litellm.exceptions import (
 )
 
 from .classifier import (
+    is_content_policy_violation,
     is_context_window_exceeded,
     looks_like_auth_error,
     looks_like_malformed_conversation_history_error,
@@ -17,6 +18,7 @@ from .classifier import (
 from .types import (
     LLMAuthenticationError,
     LLMBadRequestError,
+    LLMContentPolicyViolationError,
     LLMContextWindowExceedError,
     LLMMalformedConversationHistoryError,
     LLMRateLimitError,
@@ -56,6 +58,11 @@ def map_provider_exception(exception: Exception) -> Exception:
     ):
         return LLMServiceUnavailableError(str(exception))
 
+    # Content-policy blocks are deterministic 4xx; distinguish them from generic
+    # bad requests so the agent can recover softly instead of hard-erroring.
+    if is_content_policy_violation(exception):
+        return LLMContentPolicyViolationError(str(exception))
+
     # Generic client-side 4xx errors
     if isinstance(exception, BadRequestError):
         return LLMBadRequestError(str(exception))

{openhands_sdk-1.29.2 → openhands_sdk-1.29.3}/openhands/sdk/llm/exceptions/types.py

@@ -131,6 +131,20 @@ class LLMBadRequestError(LLMError):
         super().__init__(message)
 
 
+class LLMContentPolicyViolationError(LLMBadRequestError):
+    """Provider blocked the request/response via its content filter.
+
+    Subclasses LLMBadRequestError for back-compat. Deterministic in
+    (messages, model): a bare retry trips the same filter, so recovery
+    requires changing the request, not re-sending it.
+    """
+
+    def __init__(
+        self, message: str = "Output blocked by content filtering policy"
+    ) -> None:
+        super().__init__(message)
+
+
 # Other
 class UserCancelledError(Exception):
     def __init__(self, message: str = "User cancelled the request") -> None:

{openhands_sdk-1.29.2 → openhands_sdk-1.29.3}/openhands/sdk/llm/utils/retry_mixin.py

@@ -50,7 +50,15 @@ class RetryMixin:
             if isinstance(exc, LLMNoResponseError):
                 kwargs = getattr(retry_state, "kwargs", None)
                 if isinstance(kwargs, dict):
-                    current_temp = kwargs.get("temperature", 0)
+                    current_temp = kwargs.get(
+                        "temperature", getattr(self, "temperature", None)
+                    )
+                    if current_temp is None:
+                        logger.warning(
+                            "LLMNoResponseError with no configured temperature, "
+                            "leaving temperature unset for next attempt."
+                        )
+                        return
                     if current_temp == 0:
                         kwargs["temperature"] = 1.0
                         logger.warning(

{openhands_sdk-1.29.2 → openhands_sdk-1.29.3}/openhands/sdk/plugin/__init__.py

@@ -12,6 +12,11 @@ user's home directory (~/.openhands/plugins/installed/).
 Note: Marketplace classes live in ``openhands.sdk.marketplace``.
 """
 
+from openhands.sdk.plugin.discovery import (
+    load_available_plugins,
+    load_project_plugins,
+    load_user_plugins,
+)
 from openhands.sdk.plugin.fetch import (
     PluginFetchError,
     fetch_plugin_with_resolution,
@@ -58,6 +63,10 @@ __all__ = [
     # Plugin loading
     "load_plugins",
     "fetch_plugin_with_resolution",
+    # Local plugin discovery (ambient auto-load)
+    "load_user_plugins",
+    "load_project_plugins",
+    "load_available_plugins",
     # Source path utilities
     "GitHubURLComponents",
     "parse_github_url",