openhands-sdk 1.45.0__tar.gz → 1.46.0__tar.gz

{openhands_sdk-1.45.0 → openhands_sdk-1.46.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhands-sdk
-Version: 1.45.0
+Version: 1.46.0
 Summary: OpenHands SDK - Core functionality for building AI agents
 Project-URL: Source, https://github.com/OpenHands/software-agent-sdk
 Project-URL: Homepage, https://github.com/OpenHands/software-agent-sdk

{openhands_sdk-1.45.0 → openhands_sdk-1.46.0}/openhands/sdk/extensions/fetch.py

@@ -109,7 +109,7 @@ def _resolve_local_source(url: str) -> Path:
 
 
 def _apply_subpath(base_path: Path, subpath: str | None, context: str) -> Path:
-    """Apply a subpath to a base path, validating it exists.
+    """Apply a subpath to a base path, validating it exists and stays inside.
 
     Args:
         base_path: The root path.
@@ -120,12 +120,16 @@ def _apply_subpath(base_path: Path, subpath: str | None, context: str) -> Path:
         The final path (base_path if no subpath, otherwise base_path/subpath).
 
     Raises:
-        ExtensionFetchError: If subpath doesn't exist.
+        ExtensionFetchError: If subpath escapes base_path or doesn't exist.
     """
     if not subpath:
         return base_path
 
     final_path = base_path / subpath.strip("/")
+    # Containment: a subpath must not climb out of the base via ".." or a symlink.
+    resolved_base = base_path.resolve()
+    if not final_path.resolve().is_relative_to(resolved_base):
+        raise ExtensionFetchError(f"Subdirectory '{subpath}' escapes {context}")
     if not final_path.exists():
         raise ExtensionFetchError(f"Subdirectory '{subpath}' not found in {context}")
     return final_path
@@ -191,13 +195,8 @@ def fetch_with_resolution(
     source_type, url = parse_extension_source(source)
 
     if source_type == SourceType.LOCAL:
-        if repo_path is not None:
-            raise ExtensionFetchError(
-                f"repo_path is not supported for local extension sources. "
-                f"Specify the full path directly instead of "
-                f"source='{source}' + repo_path='{repo_path}'"
-            )
-        return _resolve_local_source(url), None
+        base_path = _resolve_local_source(url)
+        return _apply_subpath(base_path, repo_path, f"local source '{source}'"), None
 
     git = git_helper if git_helper is not None else GitHelper()
 

{openhands_sdk-1.45.0 → openhands_sdk-1.46.0}/openhands/sdk/llm/utils/model_info.py

@@ -5,6 +5,7 @@ from logging import getLogger
 from typing import Any
 
 import httpx
+import litellm
 from litellm import model_cost
 from litellm.utils import get_model_info
 from pydantic import SecretStr
@@ -24,6 +25,66 @@ def _merge_raw_model_metadata(model_info: Mapping[str, Any]) -> dict[str, Any]:
     return {**raw, **model_info}
 
 
+# Pricing fields copied from the underlying model so a custom proxy alias
+# becomes priceable in litellm's global `model_cost` map (#4816).
+_PRICING_FIELDS: tuple[str, ...] = (
+    "input_cost_per_token",
+    "output_cost_per_token",
+    "cache_read_input_token_cost",
+    "cache_creation_input_token_cost",
+    "max_input_tokens",
+    "max_output_tokens",
+    "litellm_provider",
+    "mode",
+)
+
+
+def _register_proxy_alias_pricing(
+    alias: str,
+    underlying_model_info: Mapping[str, Any] | None,
+    proxy_model_info: Mapping[str, Any] | None,
+) -> None:
+    """Register a `litellm_proxy/*` alias into litellm's `model_cost` (#4816).
+
+    litellm strips the `litellm_proxy/` prefix and parses the first segment as
+    the provider, so a custom name like `prod/claude-sonnet-4-5-bedrock` makes
+    `cost_per_token` raise and the span is silently priced $0. Registering the
+    alias with the underlying model's pricing makes it priceable without
+    renaming the proxy model.
+    """
+    if not alias or alias in model_cost:
+        return
+    try:
+        litellm.cost_per_token(model=alias, prompt_tokens=1, completion_tokens=1)
+        return
+    except Exception:
+        pass
+
+    entry: dict[str, Any] = {}
+    for src in (underlying_model_info, proxy_model_info):
+        if isinstance(src, Mapping):
+            entry.update({f: src[f] for f in _PRICING_FIELDS if f in src})
+
+    # litellm's `get_llm_provider` cannot resolve `bedrock_converse` as a
+    # provider label for an unknown alias id (only ``bedrock`` is accepted), so
+    # normalize it before registering or `cost_per_token` keeps raising.
+
+    if entry.get("litellm_provider") == "bedrock_converse":
+        entry["litellm_provider"] = "bedrock"
+
+    if (
+        entry.get("input_cost_per_token") is None
+        and entry.get("output_cost_per_token") is None
+    ):
+        return
+
+    entry.setdefault("mode", "chat")
+    try:
+        litellm.register_model({alias: entry})
+    except Exception as e:
+        logger.debug("Failed to register litellm_proxy alias %r: %s", alias, e)
+
+
 @lru_cache
 def _get_model_info_from_litellm_proxy(
     secret_api_key: SecretStr | str | None,
@@ -61,6 +122,24 @@ def _get_model_info_from_litellm_proxy(
         if current:
             model_info = current.get("model_info")
             logger.debug(f"Got model info from litellm proxy: {model_info}")
+
+            # Make custom proxy aliases priceable so cost instrumentation does
+            # not silently record $0 (#4816).
+            underlying_model = current.get("litellm_params", {}).get("model")
+            underlying_model_info = None
+            if isinstance(underlying_model, str) and underlying_model != stripped:
+                try:
+                    underlying_model_info = get_model_info(underlying_model)
+                except Exception as e:
+                    logger.debug(
+                        f"get_model_info(underlying={underlying_model}) failed: {e}"
+                    )
+            _register_proxy_alias_pricing(
+                alias=stripped,
+                underlying_model_info=underlying_model_info,
+                proxy_model_info=model_info,
+            )
+
             return model_info
     except Exception as e:
         logger.debug(

{openhands_sdk-1.45.0 → openhands_sdk-1.46.0}/openhands/sdk/llm/utils/telemetry.py

@@ -50,6 +50,8 @@ class Telemetry(BaseModel):
         default=None
     )
     _stats_update_callback: Callable[[], None] | None = PrivateAttr(default=None)
+    _span_cm: Any = PrivateAttr(default=None)
+    _span: Any = PrivateAttr(default=None)
 
     model_config: ClassVar[ConfigDict] = ConfigDict(
         extra="forbid", arbitrary_types_allowed=True
@@ -79,6 +81,7 @@ class Telemetry(BaseModel):
     def on_request(self, telemetry_ctx: dict | None) -> None:
         self._req_start = time.time()
         self._req_ctx = telemetry_ctx or {}
+        self._open_span()
 
     def on_response(
         self,
@@ -115,7 +118,11 @@ class Telemetry(BaseModel):
         if self.log_enabled:
             self.log_llm_call(resp, cost, raw_resp=raw_resp)
 
-        # 5) notify about stats update
+        # 5) authoritative cost + cache buckets onto the span, before it closes
+        self._annotate_span(cost, usage)
+        self._close_span()
+
+        # 6) notify about stats update
         if self._stats_update_callback is not None:
             try:
                 self._stats_update_callback()
@@ -128,6 +135,7 @@ class Telemetry(BaseModel):
         # Best-effort logging for failed requests (so we can debug malformed
         # request payloads, e.g. orphaned Responses reasoning items).
         self._last_latency = time.time() - (self._req_start or time.time())
+        self._close_span(_err)
 
         if not self.log_enabled:
             return
@@ -217,16 +225,7 @@ class Telemetry(BaseModel):
             or 0
         )
 
-        cache_read = 0
-        p_details = getattr(usage, "prompt_tokens_details", None) or getattr(
-            usage, "input_tokens_details", None
-        )
-        if p_details is not None:
-            cache_read = int(getattr(p_details, "cached_tokens", 0) or 0)
-
-        # Kimi-K2-thinking populate usage.cached_tokens field
-        if not cache_read and hasattr(usage, "cached_tokens"):
-            cache_read = int(getattr(usage, "cached_tokens", 0) or 0)
+        cache_read, cache_write = self._cache_buckets(usage)
 
         reasoning_tokens = 0
         c_details = getattr(usage, "completion_tokens_details", None) or getattr(
@@ -235,9 +234,6 @@ class Telemetry(BaseModel):
         if c_details is not None:
             reasoning_tokens = int(getattr(c_details, "reasoning_tokens", 0) or 0)
 
-        # Chat-specific: litellm may set a hidden cache write field
-        cache_write = int(getattr(usage, "_cache_creation_input_tokens", 0) or 0)
-
         self.metrics.add_token_usage(
             prompt_tokens=prompt_tokens,
             completion_tokens=completion_tokens,
@@ -248,6 +244,88 @@ class Telemetry(BaseModel):
             response_id=response_id,
         )
 
+    @staticmethod
+    def _cache_buckets(usage: Usage | ResponseAPIUsage) -> tuple[int, int]:
+        """Return ``(cache_read, cache_write)`` for either usage shape.
+
+        Single source of truth for both ``metrics`` and the span, so the trace
+        and the app's cost cannot disagree about the buckets.
+        """
+        cache_read = 0
+        p_details = getattr(usage, "prompt_tokens_details", None) or getattr(
+            usage, "input_tokens_details", None
+        )
+        if p_details is not None:
+            cache_read = int(getattr(p_details, "cached_tokens", 0) or 0)
+        # Kimi-K2-thinking populates usage.cached_tokens instead.
+        if not cache_read:
+            cache_read = int(getattr(usage, "cached_tokens", 0) or 0)
+        if not cache_read:
+            cache_read = int(getattr(usage, "cache_read_input_tokens", 0) or 0)
+
+        # litellm mirrors this onto a private attr; the public one and the
+        # details dict are both populated on some provider shapes only.
+        cache_write = int(getattr(usage, "_cache_creation_input_tokens", 0) or 0)
+        if not cache_write:
+            cache_write = int(getattr(usage, "cache_creation_input_tokens", 0) or 0)
+        if not cache_write and p_details is not None:
+            cache_write = int(getattr(p_details, "cache_creation_tokens", 0) or 0)
+        return cache_read, cache_write
+
+    # ---------- Observability span ----------
+    # These bracket one LLM call: ``on_request`` -> transport -> ``on_response``
+    # all run inside a single retry attempt, so the span is current while
+    # litellm executes and still open when the cost is known.
+    def _open_span(self) -> None:
+        self._close_span()  # a retry re-enters on_request; never leak the old one
+        try:
+            # Imported lazily: openhands.sdk.observability pulls in
+            # openhands.sdk.event, which imports this module.
+            from openhands.sdk.observability.laminar import llm_call_span
+
+            cm = llm_call_span(f"llm.{self.model_name}")
+            self._span = cm.__enter__()
+            self._span_cm = cm
+        except Exception:
+            logger.debug("Failed to open LLM span", exc_info=True)
+            self._span = self._span_cm = None
+
+    def _annotate_span(
+        self, cost: float | None, usage: Usage | ResponseAPIUsage | None
+    ) -> None:
+        span = self._span
+        if span is None:
+            return
+        try:
+            if cost:
+                # Authoritative: _compute_cost prefers the proxy's
+                # x-litellm-response-cost header, which is already cache-aware
+                # and priced by the real backend rather than by a name lookup.
+                span.set_attribute("gen_ai.usage.cost", float(cost))
+            if usage is not None:
+                cache_read, cache_write = self._cache_buckets(usage)
+                # Emitted unconditionally: lmnr only reports these when
+                # prompt_tokens_details is populated, which not every provider
+                # shape does.
+                span.set_attribute("gen_ai.usage.cache_read_input_tokens", cache_read)
+                span.set_attribute(
+                    "gen_ai.usage.cache_creation_input_tokens", cache_write
+                )
+        except Exception:
+            logger.debug("Failed to annotate LLM span", exc_info=True)
+
+    def _close_span(self, err: BaseException | None = None) -> None:
+        cm, self._span_cm, self._span = self._span_cm, None, None
+        if cm is None:
+            return
+        try:
+            if err is not None:
+                cm.__exit__(type(err), err, err.__traceback__)
+            else:
+                cm.__exit__(None, None, None)
+        except Exception:
+            logger.debug("Failed to close LLM span", exc_info=True)
+
     def _compute_cost(
         self,
         resp: ModelResponse | ResponsesAPIResponse,

{openhands_sdk-1.45.0 → openhands_sdk-1.46.0}/openhands/sdk/observability/laminar.py

@@ -404,6 +404,34 @@ def start_child_span(
         logger.debug("Failed to create observability child span", exc_info=True)
 
 
+@contextlib.contextmanager
+def llm_call_span(name: str) -> Iterator[Any]:
+    """Open a span that stays current for the duration of one LLM call.
+
+    lmnr's LiteLLM instrumentation builds its span with ``Laminar.start_span``
+    (detached from the OTel context) and ends it in a ``finally`` before
+    ``litellm.completion`` returns, so attributes cannot be attached to it
+    afterwards -- OTel silently drops writes to an ended span. This span is
+    *current* while the call runs, so lmnr's span nests underneath it, and it
+    stays open long enough for Telemetry to attach the authoritative cost.
+
+    Yields ``None`` when observability is disabled, so callers stay branch-free.
+    """
+    if not should_enable_observability():
+        yield None
+        return
+    try:
+        from lmnr import Laminar
+
+        cm = Laminar.start_as_current_span(name=name, span_type="LLM")
+    except Exception:
+        logger.debug("Failed to open LLM observability span", exc_info=True)
+        yield None
+        return
+    with cm as span:
+        yield span
+
+
 # Trace-metadata key set by software-agent-sdk#4010 on the parent's `task`
 # TOOL span; copied onto a detached delegate trace when present so the
 # originating tool call is visible from the delegate's trace alone.

{openhands_sdk-1.45.0 → openhands_sdk-1.46.0}/openhands_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhands-sdk
-Version: 1.45.0
+Version: 1.46.0
 Summary: OpenHands SDK - Core functionality for building AI agents
 Project-URL: Source, https://github.com/OpenHands/software-agent-sdk
 Project-URL: Homepage, https://github.com/OpenHands/software-agent-sdk

{openhands_sdk-1.45.0 → openhands_sdk-1.46.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "openhands-sdk"
-version = "1.45.0"
+version = "1.46.0"
 description = "OpenHands SDK - Core functionality for building AI agents"
 
 requires-python = ">=3.12"