openhands-sdk 1.58.0__tar.gz → 1.58.2__tar.gz

{openhands_sdk-1.58.0 → openhands_sdk-1.58.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhands-sdk
-Version: 1.58.0
+Version: 1.58.2
 Summary: OpenHands SDK - Core functionality for building AI agents
 Project-URL: Source, https://github.com/OpenHands/software-agent-sdk
 Project-URL: Homepage, https://github.com/OpenHands/software-agent-sdk
@@ -8,6 +8,7 @@ Project-URL: Documentation, https://docs.openhands.dev/sdk
 Project-URL: Bug Tracker, https://github.com/OpenHands/software-agent-sdk/issues
 Requires-Python: >=3.12
 Requires-Dist: agent-client-protocol<0.13.0,>=0.12.1
+Requires-Dist: certifi>=2026.10.19
 Requires-Dist: deprecation>=2.1.0
 Requires-Dist: fakeredis[lua]>=2.32.1
 Requires-Dist: fastmcp<4,>=3.2.0

{openhands_sdk-1.58.0 → openhands_sdk-1.58.2}/openhands/sdk/agent/acp_agent.py

@@ -126,7 +126,7 @@ from openhands.sdk.event import (
 from openhands.sdk.event.conversation_error import ConversationErrorEvent
 from openhands.sdk.llm import LLM, ImageContent, Message, MessageToolCall, TextContent
 from openhands.sdk.logger import get_logger
-from openhands.sdk.mcp.config import MCPServer
+from openhands.sdk.mcp.config import MCPOAuthAuthCredential, MCPServer
 from openhands.sdk.observability.laminar import maybe_init_laminar, observe
 from openhands.sdk.settings.acp_providers import (
     ACP_PROVIDERS,
@@ -672,20 +672,65 @@ def _extract_session_models(
 _ACPMcpServer = HttpMcpServer | SseMcpServer | McpServerStdio | AcpMcpServer
 
 
+def _oauth_bearer_header(auth: MCPOAuthAuthCredential, name: str) -> dict[str, str]:
+    """Forward a stored OAuth2 access token as an ``Authorization`` header.
+
+    The ACP subprocess owns its own MCP transport and has no access to the
+    FastMCP token store the native path uses, so the token persisted in the
+    connection's ``auth.state`` is the only credential available here. Without
+    this the server is forwarded as a bare URL and the ACP agent reports it is
+    not logged in (``codex mcp login ...``).
+
+    A missing or expired token still forwards what exists: a 401 from the
+    server is more actionable than an unauthenticated URL. Both cases are
+    logged so the drop is not silent.
+    """
+    state = auth.state
+    token = state.tokens.access_token if state is not None and state.tokens else None
+    if token is None:
+        logger.warning(
+            "ACP MCP server %r has an OAuth2 connection with no stored access "
+            "token; forwarding it unauthenticated",
+            name,
+        )
+        return {}
+    if (
+        state is not None
+        and state.token_expires_at is not None
+        and state.token_expires_at <= time.time()
+    ):
+        logger.warning(
+            "ACP MCP server %r has an expired OAuth2 access token; the ACP path "
+            "cannot refresh it, forwarding it as-is",
+            name,
+        )
+    return {"Authorization": f"Bearer {token.get_secret_value()}"}
+
+
 def _remote_mcp_headers(server: MCPServer, name: str) -> list[HttpHeader]:
-    """Convert remote MCP headers/auth into ACP's header-only representation."""
+    """Convert remote MCP headers/auth into ACP's header-only representation.
+
+    Header-compatible auth (api key / bearer / basic / explicit headers)
+    converts directly. OAuth2 does not -- ``to_http_headers()`` returns ``None``
+    because the native path materializes tokens through FastMCP's token store --
+    so its stored access token is forwarded explicitly instead.
+    """
     headers = [
         HttpHeader(name=name, value=value.get_secret_value())
         for name, value in (server.headers or {}).items()
     ]
 
-    auth_headers = server.auth.to_http_headers() if server.auth is not None else {}
+    auth = server.auth
+    if isinstance(auth, MCPOAuthAuthCredential):
+        auth_headers = _oauth_bearer_header(auth, name)
+    else:
+        auth_headers = auth.to_http_headers() if auth is not None else {}
     if auth_headers is None:
         logger.warning(
             "ACP MCP server %r uses unsupported remote MCP auth type %r; "
             "only header-compatible auth can be forwarded",
             name,
-            type(server.auth).__name__,
+            type(auth).__name__,
         )
         return headers
     headers.extend(
@@ -724,7 +769,8 @@ def _mcp_config_to_acp_servers(
     with a warning rather than failing init — one misconfigured server should
     not sink the whole conversation.  ``env`` / ``headers`` maps are converted
     to the protocol's ``[{name, value}]`` list form; header-compatible auth
-    credentials are also converted to headers.
+    credentials, and the stored access token of an OAuth2 connection, are also
+    converted to headers.
     """
     caps = normalize_mcp_capabilities(mcp_capabilities)
     http_ok = caps.http

{openhands_sdk-1.58.0 → openhands_sdk-1.58.2}/openhands/sdk/llm/call_context.py

@@ -69,12 +69,19 @@ def apply_llm_call_context(
     context: LLMCallContext,
     *,
     supports_prompt_cache_key: bool = False,
+    openrouter: bool = False,
 ) -> None:
     """Apply SDK-owned call context to provider request options in one place.
 
     ``prompt_cache_key`` is only sent to providers that accept it as an OpenAI
     param (OpenAI Responses/Chat). Anthropic and Gemini reject it with a 400
     ``UnsupportedParamsError`` when litellm validates non-default params.
+
+    ``openrouter`` selects OpenRouter's own affinity parameter: OpenRouter keys
+    sticky routing off ``session_id``, so later turns of a conversation return
+    to the endpoint holding the warm prompt cache. Without it OpenRouter derives
+    the routing key by hashing the opening messages, which agent conversations
+    rewrite as they compact, so affinity is lost mid-run.
     """
     if context.prompt_cache_key and supports_prompt_cache_key:
         options["prompt_cache_key"] = context.prompt_cache_key
@@ -84,3 +91,10 @@ def apply_llm_call_context(
             **existing,
             "x-litellm-session-id": context.session_id,
         }
+        if openrouter:
+            # Merge rather than replace: extra_body may already carry caller
+            # routing (e.g. provider.only) that must survive. An explicit
+            # session_id from the caller wins over the conversation id.
+            extra_body = dict(options.get("extra_body") or {})
+            extra_body.setdefault("session_id", context.session_id)
+            options["extra_body"] = extra_body

{openhands_sdk-1.58.0 → openhands_sdk-1.58.2}/openhands/sdk/llm/options/chat_options.py

@@ -10,6 +10,7 @@ from openhands.sdk.llm.options.common import (
     apply_defaults_if_absent,
     apply_extra_body,
     apply_extra_headers,
+    is_openrouter,
 )
 
 
@@ -96,6 +97,7 @@ def select_chat_options(
         out,
         context,
         supports_prompt_cache_key=model_features.supports_prompt_cache_key,
+        openrouter=is_openrouter(llm),
     )
 
     return out

{openhands_sdk-1.58.0 → openhands_sdk-1.58.2}/openhands/sdk/llm/options/common.py

@@ -55,3 +55,15 @@ def apply_extra_body(user_kwargs: dict[str, Any], llm: LLM) -> dict[str, Any]:
     if llm.litellm_extra_body:
         out["extra_body"] = llm.litellm_extra_body
     return out
+
+
+def is_openrouter(llm: LLM) -> bool:
+    """Return whether this LLM routes through OpenRouter.
+
+    Matches the ``openrouter/`` model prefix and the ``openrouter.ai`` base URL
+    that the OpenRouter runtime-metadata resolver also keys off, so the two
+    agree on what counts as OpenRouter.
+    """
+    model = llm.model or ""
+    base_url = llm.base_url or ""
+    return model.startswith("openrouter/") or "openrouter.ai" in base_url

{openhands_sdk-1.58.0 → openhands_sdk-1.58.2}/openhands/sdk/llm/options/responses_options.py

@@ -10,6 +10,7 @@ from openhands.sdk.llm.options.common import (
     apply_defaults_if_absent,
     apply_extra_body,
     apply_extra_headers,
+    is_openrouter,
 )
 
 
@@ -90,6 +91,7 @@ def select_responses_options(
         out,
         context,
         supports_prompt_cache_key=model_features.supports_prompt_cache_key,
+        openrouter=is_openrouter(llm),
     )
 
     return out

{openhands_sdk-1.58.0 → openhands_sdk-1.58.2}/openhands_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhands-sdk
-Version: 1.58.0
+Version: 1.58.2
 Summary: OpenHands SDK - Core functionality for building AI agents
 Project-URL: Source, https://github.com/OpenHands/software-agent-sdk
 Project-URL: Homepage, https://github.com/OpenHands/software-agent-sdk
@@ -8,6 +8,7 @@ Project-URL: Documentation, https://docs.openhands.dev/sdk
 Project-URL: Bug Tracker, https://github.com/OpenHands/software-agent-sdk/issues
 Requires-Python: >=3.12
 Requires-Dist: agent-client-protocol<0.13.0,>=0.12.1
+Requires-Dist: certifi>=2026.10.19
 Requires-Dist: deprecation>=2.1.0
 Requires-Dist: fakeredis[lua]>=2.32.1
 Requires-Dist: fastmcp<4,>=3.2.0

{openhands_sdk-1.58.0 → openhands_sdk-1.58.2}/openhands_sdk.egg-info/requires.txt

@@ -1,4 +1,5 @@
 agent-client-protocol<0.13.0,>=0.12.1
+certifi>=2026.10.19
 deprecation>=2.1.0
 fakeredis[lua]>=2.32.1
 fastmcp<4,>=3.2.0

{openhands_sdk-1.58.0 → openhands_sdk-1.58.2}/pyproject.toml

@@ -1,11 +1,12 @@
 [project]
 name = "openhands-sdk"
-version = "1.58.0"
+version = "1.58.2"
 description = "OpenHands SDK - Core functionality for building AI agents"
 
 requires-python = ">=3.12"
 dependencies = [
     "agent-client-protocol>=0.12.1,<0.13.0",  # 0.11.0 reordered prompt() args, broke the client (#4830)
+    "certifi>=2026.10.19",  # eMudhra CA distrust: GHSA-6q48-6c7w-9gw2
     "deprecation>=2.1.0",
     "fakeredis[lua]>=2.32.1",  # Explicit dependency for docket/fastmcp background tasks
     # 3.2.0 reads back the stored absolute OAuth token expiry; 4.x requires