openhands-sdk 1.43.0__tar.gz → 1.44.0__tar.gz

{openhands_sdk-1.43.0 → openhands_sdk-1.44.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhands-sdk
-Version: 1.43.0
+Version: 1.44.0
 Summary: OpenHands SDK - Core functionality for building AI agents
 Project-URL: Source, https://github.com/OpenHands/software-agent-sdk
 Project-URL: Homepage, https://github.com/OpenHands/software-agent-sdk

{openhands_sdk-1.43.0 → openhands_sdk-1.44.0}/openhands/sdk/agent/utils.py

@@ -522,10 +522,14 @@ def normalize_tool_call(
                     for key, value in arguments.items()
                     if key in {"security_risk", "summary"}
                 }
-                if original_command:
-                    normalized_arguments["command"] = f"{base_name} {original_command}"
-                else:
+                if not original_command:
                     normalized_arguments["command"] = base_name
+                elif str(original_command).split(maxsplit=1)[:1] == [base_name]:
+                    # Already carries the executable, e.g. git(command="git status").
+                    # Comparing whole tokens keeps "github status" prefixed.
+                    normalized_arguments["command"] = original_command
+                else:
+                    normalized_arguments["command"] = f"{base_name} {original_command}"
         elif "terminal" in available_tools:
             terminal_command = _maybe_rewrite_as_terminal_command(
                 tool_name,

{openhands_sdk-1.43.0 → openhands_sdk-1.44.0}/openhands/sdk/context/condenser/llm_summarizing_condenser.py

@@ -86,7 +86,10 @@ class LLMSummarizingCondenser(RollingCondenser):
         # streaming LLM requires. Disable streaming once so every summary path
         # is covered. model_copy is non-mutating and shares usage_id/metrics,
         # so summary tokens stay attributed to the conversation.
-        if self.llm.stream:
+        # Providers that require streaming are exempt: the Codex API requires
+        # stream=True, and the responses() method drains the stream internally
+        # without an on_token callback.
+        if self.llm.stream and not self.llm.requires_streaming:
             self.llm = self.llm.model_copy(update={"stream": False})
         return self
 
@@ -222,8 +225,11 @@ class LLMSummarizingCondenser(RollingCondenser):
 
         # Do not pass extra_body explicitly. The LLM handles forwarding
         # litellm_extra_body only when it is non-empty.
+        from openhands.sdk.agent.utils import make_llm_completion
+
         try:
-            llm_response = self.llm.completion(
+            llm_response = make_llm_completion(
+                llm=self.llm,
                 messages=messages,
             )
         except Exception as e:
@@ -417,8 +423,13 @@ class LLMSummarizingCondenser(RollingCondenser):
         )
 
         messages = [Message(role="user", content=[TextContent(text=prompt)])]
+        from openhands.sdk.agent.utils import amake_llm_completion
+
         try:
-            llm_response = await self.llm.acompletion(messages=messages)
+            llm_response = await amake_llm_completion(
+                llm=self.llm,
+                messages=messages,
+            )
         except Exception as e:
             raise NoCondensationAvailableException(
                 f"Summarization LLM call failed: {e}"

{openhands_sdk-1.43.0 → openhands_sdk-1.44.0}/openhands/sdk/context/prompts/sections/static.py

@@ -108,6 +108,7 @@ class MemorySection(_StaticTextSection):
     _AGENTS_MD_GUIDANCE = """\
 * Use `AGENTS.md` under the repository root as your persistent memory for repository-specific knowledge and context.
 * Add important insights, patterns, and learnings to this file to improve future task performance.
+* When asked to find a previous local OpenHands conversation, search the workspace's `workspace/conversations/` directory for its event history.
 * This repository skill is automatically loaded for every conversation and helps maintain context across sessions.
 * For more information about skills, see: https://docs.openhands.dev/overview/skills"""
 

{openhands_sdk-1.43.0 → openhands_sdk-1.44.0}/openhands/sdk/conversation/impl/local_conversation.py

@@ -202,7 +202,6 @@ class LocalConversation(BaseConversation):
     _resolved_plugins: list[ResolvedPluginSource] | None
     _plugins_loaded: bool
     _pending_hook_config: HookConfig | None  # Hook config to combine with plugin hooks
-    _subscription_disabled_condenser: Any | None
     _mcp_tool_provider: MCPToolProvider
 
     def __init__(
@@ -238,6 +237,7 @@ class LocalConversation(BaseConversation):
         prompt_cache_key: str | None = None,
         file_store: FileStore | None = None,
         mcp_tool_provider: MCPToolProvider | None = None,
+        profile_store_dir: str | Path | None = None,
         **_: object,
     ):
         """Initialize the conversation.
@@ -296,6 +296,8 @@ class LocalConversation(BaseConversation):
             file_store: Optional FileStore to use for conversation state and EventLog
                 persistence. If provided, this takes precedence over persistence_dir
                 for state and EventLog storage.
+            profile_store_dir: Optional directory containing saved LLM profiles.
+                Defaults to ``~/.openhands/profiles``.
         """
         super().__init__()  # Initialize with span tracking
         # Mark cleanup as initiated as early as possible to avoid races or partially
@@ -314,7 +316,6 @@ class LocalConversation(BaseConversation):
         self._plugins_loaded = False
         self._pending_hook_config = hook_config  # Will be combined with plugin hooks
         self._agent_ready = False  # Agent initialized lazily after plugins loaded
-        self._subscription_disabled_condenser = None
         self._mcp_tool_provider = mcp_tool_provider or DefaultMCPToolProvider()
 
         # Create-or-resume: factory inspects BASE_STATE to decide
@@ -484,7 +485,7 @@ class LocalConversation(BaseConversation):
         # Agent initialization is deferred to _ensure_agent_ready() for lazy loading
         # This ensures plugins are loaded before agent initialization
         self.llm_registry = LLMRegistry()
-        self._profile_store = LLMProfileStore()
+        self._profile_store = LLMProfileStore(profile_store_dir)
         self._cipher = cipher
 
         # Seed agent_context.secrets into the registry for every agent (regular
@@ -1659,21 +1660,10 @@ class LocalConversation(BaseConversation):
         lock = contextlib.nullcontext() if skip_lock else self._state
         with lock:
             update: dict[str, object] = {"llm": new_llm}
-            if new_llm.is_subscription:
-                if self.agent.condenser is not None:
-                    self._subscription_disabled_condenser = self.agent.condenser
-                update["condenser"] = None
-            elif (
-                self.agent.condenser is None
-                and self._subscription_disabled_condenser is not None
-            ):
-                update["condenser"] = self._subscription_disabled_condenser
-                self._subscription_disabled_condenser = None
-            else:
-                update["condenser"] = self._condenser_for_switched_llm(
-                    self.agent.llm,
-                    new_llm,
-                )
+            update["condenser"] = self._condenser_for_switched_llm(
+                self.agent.llm,
+                new_llm,
+            )
             self.agent = self.agent.model_copy(update=update)
             self._state.agent = self.agent
             self._bind_conversation_context(new_llm)

{openhands_sdk-1.43.0 → openhands_sdk-1.44.0}/openhands/sdk/io/local.py

@@ -2,11 +2,13 @@ import os
 import shutil
 from collections.abc import Iterator
 from contextlib import contextmanager
+from pathlib import Path
 
 from filelock import FileLock, Timeout
 
 from openhands.sdk.io.cache import MemoryLRUCache
 from openhands.sdk.logger import get_logger
+from openhands.sdk.utils.files import atomic_write_text
 from openhands.sdk.utils.path import to_posix_path
 
 from .base import FileStore
@@ -62,8 +64,7 @@ class LocalFileStore(FileStore):
         full_path = self.get_full_path(path)
         os.makedirs(os.path.dirname(full_path), exist_ok=True)
         if isinstance(contents, str):
-            with open(full_path, "w", encoding="utf-8") as f:
-                f.write(contents)
+            atomic_write_text(Path(full_path), contents)
             self.cache[full_path] = contents
         else:
             with open(full_path, "wb") as f:

{openhands_sdk-1.43.0 → openhands_sdk-1.44.0}/openhands/sdk/llm/llm.py

@@ -924,6 +924,16 @@ class LLM(BaseModel, RetryMixin, NonNativeToolCallingMixin):
     def is_subscription(self, value: bool) -> None:
         self._is_subscription = value
 
+    @property
+    def requires_streaming(self) -> bool:
+        """Whether the provider requires stream=True for all requests.
+
+        Set when the underlying endpoint rejects non-streaming requests;
+        callers must leave streaming enabled and must not require an
+        on_token callback because the response is drained internally.
+        """
+        return self._is_subscription
+
     @model_validator(mode="wrap")
     @classmethod
     def _restore_is_subscription(cls, data, handler):
@@ -1765,10 +1775,11 @@ class LLM(BaseModel, RetryMixin, NonNativeToolCallingMixin):
 
         _caller_kwargs = kwargs.copy()
         user_enable_streaming = bool(kwargs.get("stream", False)) or self.stream
-        if user_enable_streaming and on_token is None and not self.is_subscription:
+        if user_enable_streaming and on_token is None and not self.requires_streaming:
             # Gracefully degrade to non-streaming rather than crashing a run when
-            # streaming is requested without a callback wired (subscription mode
-            # is exempt — it streams internally without an on_token). See #4014.
+            # streaming is requested without a callback wired. Providers that
+            # require streaming are exempt — they drain the stream internally
+            # without an on_token callback. See requires_streaming and #4014.
             logger.debug(
                 "Streaming requested without an on_token callback; "
                 "falling back to a non-streaming responses call."
@@ -1915,10 +1926,11 @@ class LLM(BaseModel, RetryMixin, NonNativeToolCallingMixin):
 
         _caller_kwargs = kwargs.copy()
         user_enable_streaming = bool(kwargs.get("stream", False)) or self.stream
-        if user_enable_streaming and on_token is None and not self.is_subscription:
+        if user_enable_streaming and on_token is None and not self.requires_streaming:
             # Gracefully degrade to non-streaming rather than crashing a run when
-            # streaming is requested without a callback wired (subscription mode
-            # is exempt — it streams internally without an on_token). See #4014.
+            # streaming is requested without a callback wired. Providers that
+            # require streaming are exempt — they drain the stream internally
+            # without an on_token callback. See requires_streaming and #4014.
             logger.debug(
                 "Streaming requested without an on_token callback; "
                 "falling back to a non-streaming responses call."

{openhands_sdk-1.43.0 → openhands_sdk-1.44.0}/openhands/sdk/settings/model.py

@@ -1389,7 +1389,7 @@ class OpenHandsAgentSettings(AgentSettingsBase):
             include_default_tools.append(SwitchLLMTool.__name__)
 
         llm = create_subscription_llm_from_config(self.llm)
-        condenser = None if llm.is_subscription else self.build_condenser(llm)
+        condenser = self.build_condenser(llm)
         return Agent(
             llm=llm,
             tools=tools,

{openhands_sdk-1.43.0 → openhands_sdk-1.44.0}/openhands/sdk/tool/builtins/__init__.py

@@ -1,8 +1,9 @@
-"""Implementing essential tools that doesn't interact with the environment.
+"""SDK-resident tools that do not interact with the environment.
 
-These are built in and are *required* for the agent to work.
+`BUILT_IN_TOOLS` contains tools attached to every agent. `BUILT_IN_TOOL_CLASSES`
+also includes optional SDK tools that are resolved by name from agent setup.
 
-For tools that require interacting with the environment, add them to `openhands-tools`.
+Tools that require interacting with the environment belong in `openhands-tools`.
 """
 
 from openhands.sdk.tool.builtins.finish import (

openhands_sdk-1.44.0/openhands/sdk/utils/async_executor.py

@@ -0,0 +1,233 @@
+import atexit
+import inspect
+import threading
+import weakref
+from collections.abc import Callable
+from typing import Any
+
+import anyio
+from anyio.from_thread import BlockingPortal, start_blocking_portal
+
+from openhands.sdk.logger import get_logger
+
+
+logger = get_logger(__name__)
+
+# Upper bound on how long close() waits for the portal thread to wind down.
+# The portal thread is a daemon thread, so abandoning it is safe; blocking the
+# caller forever is not.
+#
+# The default is intentionally short for lifecycle teardown: a successful
+# portal stop + join normally completes in milliseconds once remaining tasks
+# are cancelled, so 10s is already a generous margin for a healthy shutdown.
+# It is deliberately *not* the 30s inherited from BrowserToolExecutor cleanup
+# — that value predates the lifecycle-lock path and is too long for teardown
+# that may hold a conversation lock while waiting. See PR #4548 and the
+# discussion of #4598 in its description.
+DEFAULT_CLOSE_TIMEOUT = 10.0
+
+
+class AsyncExecutor:
+    """
+    Thin wrapper around AnyIO's BlockingPortal to execute async code
+    from synchronous contexts with proper resource and timeout handling.
+    """
+
+    def __init__(self):
+        self._portal = None
+        self._portal_cm = None
+        self._lock = threading.Lock()
+        self._atexit_registered = False
+
+    @property
+    def portal(self) -> BlockingPortal:
+        """The lazily-started ``BlockingPortal`` — public accessor.
+
+        Callers that need to schedule work directly on the portal loop
+        (e.g. ``ACPAgent.astep`` bridges ACP awaits across loops via
+        ``portal.start_task_soon`` + ``asyncio.wrap_future``) use this
+        instead of ``run_async`` because they need the future, not the
+        result.
+        """
+        return self._ensure_portal()
+
+    def _ensure_portal(self) -> BlockingPortal:
+        with self._lock:
+            if self._portal is None:
+                self._portal_cm = start_blocking_portal()
+                self._portal = self._portal_cm.__enter__()
+                # Register atexit handler to ensure cleanup on interpreter shutdown
+                if not self._atexit_registered:
+                    # Use weakref to avoid keeping the executor alive
+                    weak_self = weakref.ref(self)
+
+                    def cleanup():
+                        executor = weak_self()
+                        if executor is not None:
+                            try:
+                                executor.close()
+                            except Exception:
+                                pass
+
+                    atexit.register(cleanup)
+                    self._atexit_registered = True
+            return self._portal
+
+    def run_async(
+        self,
+        awaitable_or_fn: Callable[..., Any] | Any,
+        *args,
+        timeout: float | None = None,
+        **kwargs,
+    ) -> Any:
+        """
+        Run a coroutine or async function from sync code.
+
+        Args:
+            awaitable_or_fn: coroutine or async function
+            *args: positional arguments (only used if awaitable_or_fn is a function)
+            timeout: optional timeout in seconds
+            **kwargs: keyword arguments (only used if awaitable_or_fn is a function)
+        """
+        portal = self._ensure_portal()
+
+        # Construct coroutine
+        if inspect.iscoroutine(awaitable_or_fn):
+            coro = awaitable_or_fn
+        elif inspect.iscoroutinefunction(awaitable_or_fn):
+            coro = awaitable_or_fn(*args, **kwargs)
+        else:
+            raise TypeError("run_async expects a coroutine or async function")
+
+        # Apply timeout by wrapping in an async function with fail_after
+        if timeout is not None:
+
+            async def _with_timeout():
+                with anyio.fail_after(timeout):
+                    return await coro
+
+            return portal.call(_with_timeout)
+        else:
+
+            async def _execute():
+                return await coro
+
+            return portal.call(_execute)
+
+    def close(self, timeout: float | None = DEFAULT_CLOSE_TIMEOUT):
+        """Shut down the portal, without ever blocking the caller forever.
+
+        Semantics
+        ---------
+        This is **bounded, best-effort shutdown, not guaranteed cleanup.**
+
+        - It first cancels any remaining portal tasks (``portal.stop(True)``)
+          and then waits up to ``timeout`` seconds for the portal thread to
+          exit.
+        - If the portal thread is stuck on work that does *not* honour
+          cancellation — for example a task awaiting inside a worker thread,
+          which anyio cannot interrupt until the thread returns (see #4598) —
+          the wait expires and the helper thread is **abandoned**. The portal
+          thread is a daemon, so the process can still exit; but the thread
+          and any resources it holds (subprocess handles, sockets, file
+          descriptors) may remain alive until process exit. This is a
+          deliberate trade-off: blocking the caller forever is worse.
+        - The shutdown path is non-raising. Failures inside the portal
+          teardown are logged (with traceback) and swallowed so that
+          ``close()`` is always safe to call from a destructor or
+          ``__exit__``.
+        - **Idempotent.** Calling ``close()`` on an already-closed executor
+          is a no-op.
+
+        Args:
+            timeout: seconds to wait for the portal thread to exit. ``None``
+                waits indefinitely (the previous, pre-#4548 behaviour) and
+                is kept only for compatibility — **do not use it on any
+                production path**, since it reintroduces the unbounded hang
+                this fix exists to prevent. See PR #4548 / issue #4598.
+        """
+        with self._lock:
+            portal_cm = self._portal_cm
+            portal = self._portal
+            self._portal_cm = None
+            self._portal = None
+
+        if portal_cm is None:
+            return
+
+        # Stamp the owner into the thread name so an abandoned thread is
+        # identifiable in py-spy / py-dump traces (the portal thread itself
+        # does not carry the executor identity).
+        owner = type(self).__qualname__
+        thread_name = f"{owner}-close"
+
+        def _shutdown() -> None:
+            try:
+                # Cancel whatever is still running. Without this, anyio's
+                # graceful path (portal.stop(cancel_remaining=False)) waits
+                # for in-flight tasks that may never complete on their own.
+                if portal is not None:
+                    portal.call(portal.stop, True)
+            except RuntimeError:
+                pass  # portal already stopped
+            except Exception:
+                # Teardown must stay non-raising: close() is called from
+                # __del__/__exit__/atexit. Log with traceback so the failure
+                # remains diagnosable instead of being reduced to str(exc).
+                logger.warning(
+                    "Error stopping BlockingPortal during AsyncExecutor.close "
+                    "(owner=%s); teardown continues.",
+                    owner,
+                    exc_info=True,
+                )
+            try:
+                portal_cm.__exit__(None, None, None)
+            except Exception:
+                logger.warning(
+                    "Error closing BlockingPortal context manager during "
+                    "AsyncExecutor.close (owner=%s); teardown continues.",
+                    owner,
+                    exc_info=True,
+                )
+
+        # Run the shutdown on a helper thread so we can bound the wait: the
+        # portal thread can be stuck on work that does not honour cancellation
+        # (for example an await blocked inside a worker thread), and anyio
+        # joins it with no timeout.
+        try:
+            waiter = threading.Thread(target=_shutdown, name=thread_name, daemon=True)
+            waiter.start()
+        except RuntimeError:
+            # Interpreter is shutting down and will not start new threads.
+            # The portal thread is a daemon; let the process reap it.
+            return
+
+        waiter.join(timeout)
+        if waiter.is_alive():
+            # Abandonment is observable: name the owner, the timeout, and
+            # that cancellation was already attempted, so the operator can
+            # correlate with py-spy / the wedged resource. Per #4598 the
+            # thread may genuinely be un-interruptible from Python.
+            logger.warning(
+                "AsyncExecutor (owner=%s): BlockingPortal did not shut down "
+                "within %.1fs; abandoning its helper thread. Cancellation was "
+                "attempted but the portal thread appears to be stuck on work "
+                "that does not honour cancellation. Its resources (subprocess "
+                "handles, sockets, fds) may remain alive until process exit. "
+                "See issue #4598.",
+                owner,
+                float(timeout) if timeout is not None else -1.0,
+            )
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        self.close()
+        return False
+
+    def __del__(self):
+        try:
+            self.close()
+        except Exception:
+            pass

{openhands_sdk-1.43.0 → openhands_sdk-1.44.0}/openhands/sdk/workspace/remote/base.py

@@ -321,27 +321,30 @@ class RemoteWorkspace(RemoteWorkspaceMixin, BaseWorkspace):
     # settings endpoints. Subclasses like OpenHandsCloudWorkspace may override
     # to use alternative endpoints (e.g., Cloud API).
 
+    def _fetch_settings_response(
+        self, *, expose_secrets: bool = True
+    ) -> SettingsResponse:
+        """Call ``GET /api/settings`` and return the validated response."""
+        headers = dict(self._headers)
+        if expose_secrets:
+            headers["X-Expose-Secrets"] = "plaintext"
+
+        response = self.client.get("/api/settings", headers=headers)
+        response.raise_for_status()
+        return SettingsResponse.model_validate(response.json())
+
     def _fetch_agent_settings(
         self,
     ) -> "OpenHandsAgentSettings | LLMAgentSettings | ACPAgentSettings":
-        """Call ``GET /api/settings`` and return a validated settings model.
+        """Return the validated agent settings from ``GET /api/settings``.
 
         Uses ``X-Expose-Secrets: plaintext`` so secret fields (e.g. LLM
-        api_key) are returned as plain strings.  The outer response is
-        validated via :class:`SettingsResponse`, then the ``agent_settings``
-        dict is validated through :meth:`SettingsResponse.get_agent_settings`,
-        which applies the persisted settings migration entry point before
-        picking the correct discriminated-union variant
-        (``OpenHandsAgentSettings`` or ``ACPAgentSettings``).
+        api_key) are returned as plain strings. The validated
+        ``SettingsResponse`` is narrowed through
+        :meth:`SettingsResponse.get_agent_settings`, which selects the correct
+        discriminated-union variant.
         """
-        headers = dict(self._headers)
-        headers["X-Expose-Secrets"] = "plaintext"
-
-        response = self.client.get("/api/settings", headers=headers)
-        response.raise_for_status()
-
-        data = SettingsResponse.model_validate(response.json())
-        return data.get_agent_settings()
+        return self._fetch_settings_response().get_agent_settings()
 
     def _fetch_llm_profile_config(self, profile_name: str) -> dict[str, Any]:
         """Call ``GET /api/profiles/{name}`` and return plaintext LLM config."""
@@ -368,16 +371,23 @@ class RemoteWorkspace(RemoteWorkspaceMixin, BaseWorkspace):
         reraise=True,
     )
     def get_llm(self, profile_name: str | None = None, **llm_kwargs: Any) -> "LLM":
-        """Fetch LLM settings from persisted settings or a named profile.
+        """Fetch the active or explicitly named LLM profile.
+
+        When no ``profile_name`` is given, the persisted ``active_profile``
+        pointer is resolved first (so the UI-advertised default is honored).
+        If no ``active_profile`` is configured, the legacy
+        ``agent_settings.llm`` payload is used as a fallback (preserving
+        backward compatibility for servers that have not adopted named
+        profiles).
 
         Args:
             profile_name: Optional LLM profile name. When provided, loads that
-                named profile instead of the active persisted LLM settings.
-            **llm_kwargs: Additional keyword arguments that override persisted
-                or profile values (e.g., ``model``, ``temperature``).
+                named profile instead of resolving the active profile.
+            **llm_kwargs: Additional keyword arguments that override profile
+                values (e.g., ``model``, ``temperature``).
 
         Returns:
-            An LLM instance configured with the persisted settings or profile.
+            An LLM instance configured with the active or named profile.
 
         Raises:
             FileNotFoundError: If ``profile_name`` does not exist.
@@ -394,14 +404,23 @@ class RemoteWorkspace(RemoteWorkspaceMixin, BaseWorkspace):
         if not self.host or self.host == "undefined":
             raise RuntimeError("Workspace host is not set")
 
-        if profile_name:
+        if profile_name is None:
+            settings_response = self._fetch_settings_response(expose_secrets=False)
+            resolved_profile_name = settings_response.active_profile
+            if resolved_profile_name in (None, ""):
+                settings_response = self._fetch_settings_response()
+                agent_settings = settings_response.get_agent_settings()
+                if not llm_kwargs:
+                    return agent_settings.llm
+                llm_data = agent_settings.llm.model_dump(
+                    context={"expose_secrets": "plaintext"}
+                )
+            else:
+                llm_data = self._fetch_llm_profile_config(resolved_profile_name)
+                llm_data["usage_id"] = f"profile:{resolved_profile_name}"
+        else:
             llm_data = self._fetch_llm_profile_config(profile_name)
             llm_data["usage_id"] = f"profile:{profile_name}"
-        else:
-            settings = self._fetch_agent_settings()
-            if not llm_kwargs:
-                return settings.llm
-            llm_data = settings.llm.model_dump(context={"expose_secrets": "plaintext"})
 
         llm_data.update(llm_kwargs)
         return LLM(**llm_data)

{openhands_sdk-1.43.0 → openhands_sdk-1.44.0}/openhands/sdk/workspace/repo.py

@@ -294,10 +294,17 @@ _PROVIDER_CONFIG: dict[GitProvider, tuple[str, str]] = {
 }
 
 
-def _build_clone_url(url: str, provider: GitProvider, token: str | None) -> str:
+def _build_clone_url(
+    url: str,
+    provider: GitProvider,
+    token: str | None,
+    *,
+    explicit_provider: bool = False,
+) -> str:
     """Build authenticated clone URL based on the repository URL and provider.
 
-    Uses proper URL parsing to prevent token injection into malicious URLs.
+    The token is injected into the provider's public host, or into the URL's own
+    host when the caller set `provider` explicitly (self-hosted instances).
     """
     config = _PROVIDER_CONFIG.get(provider)
     if not config:
@@ -311,16 +318,21 @@ def _build_clone_url(url: str, provider: GitProvider, token: str | None) -> str:
     if is_short_format:
         return f"https://{auth_prefix}{base_url}/{url}.git"
 
-    # Handle full URLs - inject authentication only if hostname matches exactly
-    if token:
-        parsed = urllib.parse.urlparse(url)
-        if parsed.netloc.lower() == base_url:
-            # Replace only the first occurrence to prevent double injection
-            return url.replace(
-                f"https://{base_url}", f"https://{auth_prefix}{base_url}", 1
-            )
+    if not token:
+        return url
 
-    return url
+    parsed = urllib.parse.urlparse(url)
+    hostname = (parsed.hostname or "").lower()
+    if parsed.scheme != "https" or parsed.username or not hostname:
+        return url
+    if hostname != base_url:
+        # An auto-detected provider is derived from the URL, so it cannot
+        # authorize another host - and never a lookalike of the public one.
+        if not explicit_provider or hostname.startswith(f"{base_url}."):
+            return url
+
+    netloc = hostname if parsed.port is None else f"{hostname}:{parsed.port}"
+    return urllib.parse.urlunparse(parsed._replace(netloc=f"{auth_prefix}{netloc}"))
 
 
 # Type for functions that fetch tokens by name (e.g., "github_token" -> token value)
@@ -367,7 +379,9 @@ def _clone_single_repo(repo: RepoSource, dest: Path, token: str | None) -> bool:
     """Clone a single repository. Returns True on success."""
     try:
         provider = repo.get_provider()
-        clone_url = _build_clone_url(repo.url, provider, token)
+        clone_url = _build_clone_url(
+            repo.url, provider, token, explicit_provider=repo.provider is not None
+        )
         provider_str = provider.value
     except ValueError:
         # No provider detected (e.g., file:// URLs) - use URL as-is

{openhands_sdk-1.43.0 → openhands_sdk-1.44.0}/openhands_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhands-sdk
-Version: 1.43.0
+Version: 1.44.0
 Summary: OpenHands SDK - Core functionality for building AI agents
 Project-URL: Source, https://github.com/OpenHands/software-agent-sdk
 Project-URL: Homepage, https://github.com/OpenHands/software-agent-sdk

{openhands_sdk-1.43.0 → openhands_sdk-1.44.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "openhands-sdk"
-version = "1.43.0"
+version = "1.44.0"
 description = "OpenHands SDK - Core functionality for building AI agents"
 
 requires-python = ">=3.12"