Merge branch 'main' into openhands/issue-2788-agent-settings-migrations

Author: neubig

.github/workflows/pypi-release.yml

@@ -10,6 +10,12 @@ on:
 
 jobs:
     publish:
+        # Skip PyPI publishing for pre-releases (e.g., release candidates).
+        # Pre-releases can still be created on GitHub for testing without
+        # pushing packages to PyPI.  Manual workflow_dispatch always runs.
+        if: >
+            github.event_name == 'workflow_dispatch' ||
+            !github.event.release.prerelease
         runs-on: ubuntu-24.04
         outputs:
             version: ${{ steps.extract_version.outputs.version }}

.github/workflows/server.yml

@@ -210,8 +210,9 @@ jobs:
             ARCH: ${{ matrix.arch }}
             TARGET: binary
             PLATFORM: ${{ matrix.platform }}
-            # Use PR head SHA for pull requests to match the image tag expected by run-examples.yml
-            GITHUB_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+            # Use SDK_SHA for PR head SHA - GITHUB_SHA is a built-in that gets overwritten by checkout
+            # build.py checks SDK_SHA before GITHUB_SHA (see _git_info priority order)
+            SDK_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
             GITHUB_REF: ${{ github.ref }}
             CI: 'true'
 
@@ -254,7 +255,8 @@ jobs:
                   echo "tags=$TAGS" >> $GITHUB_OUTPUT
 
                   # Extract short SHA for consolidation
-                  SHORT_SHA=$(echo ${{ github.sha }} | cut -c1-7)
+                  # Use SDK_SHA env var (set above to PR head SHA for PRs)
+                  SHORT_SHA=$(echo $SDK_SHA | cut -c1-7)
                   echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT
 
                   # Extract versioned tags CSV for consolidation

examples/01_standalone_sdk/43_mixed_marketplace_skills/main.py

@@ -37,7 +37,7 @@
 import sys
 from pathlib import Path
 
-from openhands.sdk.plugin import Marketplace
+from openhands.sdk.marketplace import Marketplace
 from openhands.sdk.skills import (
     install_skills_from_marketplace,
     list_installed_skills,

examples/05_skills_and_plugins/01_loading_agentskills/main.py

@@ -27,7 +27,7 @@
 from pydantic import SecretStr
 
 from openhands.sdk import LLM, Agent, AgentContext, Conversation
-from openhands.sdk.context.skills import (
+from openhands.sdk.skills import (
     discover_skill_resources,
     load_skills_from_dir,
 )

openhands-agent-server/openhands/agent_server/docker/Dockerfile

@@ -13,22 +13,32 @@ ARG PORT=8000
 # Builder (source mode)
 # We copy source + build a venv here for local dev and debugging.
 #
-# NOTE: We use the base image's system Python (--python-preference only-system)
-# instead of uv-managed python-build-standalone. The python-build-standalone
-# builds ship libpython with an executable stack (PT_GNU_STACK PF_X).
-# Docker containers running under seccomp restrictions (e.g. GitHub Actions
-# Docker-in-Docker) reject dlopen() on such libraries with:
-#   "cannot enable executable stack as shared object requires: Invalid argument"
-# Debian's CPython packages do not have this issue.
+# SELF-CONTAINED /agent-server CONTRACT:
+# uv installs python-build-standalone into /agent-server/uv-managed-python and
+# creates .venv against it. Both live under /agent-server, so downstream
+# consumers can COPY /agent-server onto any base image and the venv works.
+#
+# uv >= 0.11.5 pulls python-build-standalone >= 20260408, which ships
+# libpython without PT_GNU_STACK PF_X (executable stack). Earlier releases
+# had this flag set due to LLVM/BOLT bugs, causing glibc >= 2.41 and
+# DinD/sysbox/seccomp to reject dlopen() with "cannot enable executable
+# stack". No sanitizer or workaround is needed on fixed releases.
+# See OpenHands/software-agent-sdk#2761.
 ####################################################################################
 FROM python:3.13-bookworm AS builder
 ARG USERNAME UID GID
 ENV UV_PROJECT_ENVIRONMENT=/agent-server/.venv
+ENV UV_PYTHON_INSTALL_DIR=/agent-server/uv-managed-python
 
-COPY --from=ghcr.io/astral-sh/uv /uv /uvx /bin/
+# uv 0.11.5+ embeds python-build-standalone 20260408 metadata, which is the
+# first release with the PT_GNU_STACK fix. Pin to 0.11.6 (latest at time of
+# writing) rather than :latest so builds are reproducible.
+COPY --from=ghcr.io/astral-sh/uv:0.11.6 /uv /uvx /bin/
 
 RUN groupadd -g ${GID} ${USERNAME} \
- && useradd -m -u ${UID} -g ${GID} -s /usr/sbin/nologin ${USERNAME}
+ && useradd -m -u ${UID} -g ${GID} -s /usr/sbin/nologin ${USERNAME} \
+ && mkdir -p /agent-server/uv-managed-python \
+ && chown -R ${USERNAME}:${USERNAME} /agent-server
 USER ${USERNAME}
 WORKDIR /agent-server
 # Cache-friendly: lockfiles first
@@ -38,7 +48,10 @@ COPY --chown=${USERNAME}:${USERNAME} openhands-tools ./openhands-tools
 COPY --chown=${USERNAME}:${USERNAME} openhands-workspace ./openhands-workspace
 COPY --chown=${USERNAME}:${USERNAME} openhands-agent-server ./openhands-agent-server
 RUN --mount=type=cache,target=/home/${USERNAME}/.cache,uid=${UID},gid=${GID} \
-    uv venv --python-preference only-system .venv && uv sync --frozen --no-editable --extra boto3
+    uv python install 3.13 && \
+    uv venv --python-preference only-managed --python 3.13 .venv && \
+    uv sync --frozen --no-editable --managed-python --extra boto3 && \
+    readlink -f .venv/bin/python | grep -q '^/agent-server/uv-managed-python/'
 
 ####################################################################################
 # Binary Builder (binary mode)
@@ -135,7 +148,7 @@ RUN mkdir -p /etc/claude-code && \
 
 # NOTE: we should NOT include UV_PROJECT_ENVIRONMENT here,
 # since the agent might use it to perform other work (e.g. tools that use Python)
-COPY --from=ghcr.io/astral-sh/uv /uv /uvx /bin/
+COPY --from=ghcr.io/astral-sh/uv:0.11.6 /uv /uvx /bin/
 
 USER ${USERNAME}
 WORKDIR /

openhands-agent-server/openhands/agent_server/skills_router.py

@@ -14,7 +14,7 @@
     load_all_skills,
     sync_public_skills,
 )
-from openhands.sdk.context.skills.skill import DEFAULT_MARKETPLACE_PATH
+from openhands.sdk.skills.skill import DEFAULT_MARKETPLACE_PATH
 
 
 skills_router = APIRouter(prefix="/skills", tags=["Skills"])

openhands-agent-server/openhands/agent_server/skills_service.py

@@ -20,21 +20,21 @@
 from dataclasses import dataclass
 from pathlib import Path
 
-from openhands.sdk.context.skills import (
+from openhands.sdk.logger import get_logger
+from openhands.sdk.skills import (
     Skill,
     load_available_skills,
 )
-from openhands.sdk.context.skills.skill import (
+from openhands.sdk.skills.skill import (
     DEFAULT_MARKETPLACE_PATH,
     PUBLIC_SKILLS_BRANCH,
     PUBLIC_SKILLS_REPO,
     load_skills_from_dir,
 )
-from openhands.sdk.context.skills.utils import (
+from openhands.sdk.skills.utils import (
     get_skills_cache_dir,
     update_skills_repository,
 )
-from openhands.sdk.logger import get_logger
 from openhands.sdk.utils import sanitized_env
 
 

openhands-sdk/openhands/sdk/__init__.py

@@ -5,12 +5,7 @@
     AgentBase,
 )
 from openhands.sdk.banner import _print_banner
-from openhands.sdk.context import (
-    AgentContext,
-    load_project_skills,
-    load_skills_from_dir,
-    load_user_skills,
-)
+from openhands.sdk.context import AgentContext
 from openhands.sdk.context.condenser import (
     LLMSummarizingCondenser,
 )
@@ -66,6 +61,11 @@
     SettingsSectionMetadata,
     field_meta,
 )
+from openhands.sdk.skills import (
+    load_project_skills,
+    load_skills_from_dir,
+    load_user_skills,
+)
 from openhands.sdk.subagent import (
     agent_definition_to_factory,
     load_agents_from_dir,

openhands-sdk/openhands/sdk/context/__init__.py

@@ -1,6 +1,8 @@
 from openhands.sdk.context.agent_context import AgentContext
 from openhands.sdk.context.prompts import render_template
-from openhands.sdk.context.skills import (
+
+# Import from canonical location (openhands.sdk.skills)
+from openhands.sdk.skills import (
     BaseTrigger,
     KeywordTrigger,
     Skill,

openhands-sdk/openhands/sdk/context/agent_context.py

@@ -7,17 +7,17 @@
 from pydantic import BaseModel, Field, field_validator, model_validator
 
 from openhands.sdk.context.prompts import render_template
-from openhands.sdk.context.skills import (
+from openhands.sdk.llm import Message, TextContent
+from openhands.sdk.llm.utils.model_prompt_spec import get_model_prompt_spec
+from openhands.sdk.logger import get_logger
+from openhands.sdk.secret import SecretSource, SecretValue
+from openhands.sdk.skills import (
     Skill,
     SkillKnowledge,
     load_available_skills,
     to_prompt,
 )
-from openhands.sdk.context.skills.skill import DEFAULT_MARKETPLACE_PATH
-from openhands.sdk.llm import Message, TextContent
-from openhands.sdk.llm.utils.model_prompt_spec import get_model_prompt_spec
-from openhands.sdk.logger import get_logger
-from openhands.sdk.secret import SecretSource, SecretValue
+from openhands.sdk.skills.skill import DEFAULT_MARKETPLACE_PATH
 
 
 logger = get_logger(__name__)