diff --git a/docs.json b/docs.json index befd4e38..53980be7 100644 --- a/docs.json +++ b/docs.json @@ -317,6 +317,7 @@ { "group": "Release Notes", "pages": [ + "openhands/usage/agent-canvas/release-notes/v1.20.0", "openhands/usage/agent-canvas/release-notes/v1.19.0", "openhands/usage/agent-canvas/release-notes/v1.18.0", "openhands/usage/agent-canvas/release-notes/v1.17.0", diff --git a/openhands/usage/agent-canvas/agent-profiles.mdx b/openhands/usage/agent-canvas/agent-profiles.mdx index c379b7a6..6f421d49 100644 --- a/openhands/usage/agent-canvas/agent-profiles.mdx +++ b/openhands/usage/agent-canvas/agent-profiles.mdx @@ -38,6 +38,20 @@ Before starting a conversation, you can open the `+` tools menu in the chat laun The LLM Model selector always remains visible in the chat launcher and allows you to select from any available LLM that the current Agent Profile supports. Once a conversation is started with an Agent Profile you are unable to switch to a different Agent Profile during the conversation. +## Scope an Agent Profile's Secrets + +When the connected Agent Server advertises the `profile_secret_scope_v1` capability, the profile editor in `Settings > Agent` includes a **secret scope** picker for OpenHands and ACP profiles. Use it to control which saved secrets a profile can access: + +- **All** — the profile can access every saved secret (default for existing profiles). +- **None** — the profile cannot access any saved secrets. +- **Selected** — choose specific secret names from the list of saved secrets. + +Secret references that no longer exist (for example, a secret that was deleted after being selected) are preserved in the profile rather than silently removed. This prevents an unrelated edit from widening or narrowing the profile's secret access. + +Agent Server is the sole enforcement point for secret scoping. Canvas only stores the profile's secret scope selection; it does not perform client-side secret filtering. + +On Agent Servers that do not advertise `profile_secret_scope_v1`, the picker is hidden and profiles remain unrestricted. + ## OpenHands Profiles Use an OpenHands profile when you want Agent Canvas to run the built-in OpenHands agent. diff --git a/openhands/usage/agent-canvas/prebuilt-automations.mdx b/openhands/usage/agent-canvas/prebuilt-automations.mdx index 91ef67f8..f5792313 100644 --- a/openhands/usage/agent-canvas/prebuilt-automations.mdx +++ b/openhands/usage/agent-canvas/prebuilt-automations.mdx @@ -55,3 +55,16 @@ Automations run against the active backend. Use [Manage Backends](/openhands/usa Open an automation, select `Edit`, and use the `LLM profile` dropdown to change which saved profile future runs use. If an automation already has a profile, the edit dialog pre-selects it. Changing the LLM profile affects future automation runs. It does not rewrite previous run history. + +## Select an Agent Profile for an Automation + +When the active backend advertises agent-profile support, the automation setup and edit dialogs include an optional **agent profile** selector. Choose a saved agent profile to use for automation runs instead of the default agent. + +When a saved agent profile is selected: + +- The stable `agent_profile_id` identifies the profile sent to the backend. +- The automation uses the selected agent profile instead of an LLM profile. Editing an automation clears any existing legacy model selection. + +If a previously selected agent profile has been deleted, it remains visible in the selector rather than silently switching to another profile. This lets you review the configuration before choosing a replacement. + +The agent profile selector appears only on backends that support agent profiles. On backends without agent-profile support, only the LLM profile dropdown is available. diff --git a/openhands/usage/agent-canvas/release-notes/v1.20.0.mdx b/openhands/usage/agent-canvas/release-notes/v1.20.0.mdx new file mode 100644 index 00000000..44341085 --- /dev/null +++ b/openhands/usage/agent-canvas/release-notes/v1.20.0.mdx @@ -0,0 +1,26 @@ +--- +title: Agent Canvas 1.20.0 +description: Release notes for Agent Canvas version 1.20.0 +--- + +# Agent Canvas 1.20.0 + +Released September 17, 2026. + +[View the full release on GitHub](https://github.com/OpenHands/OpenHands/releases/tag/v1.20.0). + +## Highlights + +- **Agent profile secret scoping** — Choose which saved secrets an agent profile can access (all, none, or selected names) from the profile editor in `Settings > Agent`. The control appears when Agent Server advertises the `profile_secret_scope_v1` capability. Deleted secret references are preserved rather than silently removed. See [Agent Profiles](/openhands/usage/agent-canvas/agent-profiles). +- **Docker conversation runtime forwarding** — Canvas now forwards six conversation-runtime settings (runtime, image, memory, CPU, PID limits, startup timeout) to its bundled Agent Server when the operator explicitly sets them, enabling `OH_CONVERSATION_RUNTIME=docker` in local Canvas deployments. See [Environment Variables](/openhands/usage/environment-variables). +- **Agent profile selection for automations** — Select a saved agent profile during automation setup and editing when the backend supports agent profiles. The selected profile is sent with `agent_profile_id` and replaces any legacy model selection. Unavailable selections remain visible. See [Pre-built Automations](/openhands/usage/agent-canvas/prebuilt-automations). + +## Maintenance + +- Mock-LLM test profiles are isolated from ambient secrets to avoid environment-dependent secret lookups in E2E tests. +- Released agent runtime dependencies bumped: Agent Server 1.49.1, TypeScript client 1.49.1, Automation 1.13.1, Extensions 0.22.1. + +## Full Changelog + +- [GitHub release notes](https://github.com/OpenHands/OpenHands/releases/tag/v1.20.0) +- [Compare v1.19.0 to v1.20.0](https://github.com/OpenHands/OpenHands/compare/v1.19.0...v1.20.0) diff --git a/openhands/usage/environment-variables.mdx b/openhands/usage/environment-variables.mdx index 8a7fd1c4..4b8f50a5 100644 --- a/openhands/usage/environment-variables.mdx +++ b/openhands/usage/environment-variables.mdx @@ -150,6 +150,23 @@ These variables correspond to the `[security]` section in `config.toml`: |---------------------|------|---------|-------------| | `SANDBOX_VOLUME_OVERLAYS` | string | `""` | Volume overlay configurations | +### Docker Conversation Runtime (Canvas) + +When running Agent Canvas locally via the `dev-safe.mjs` launcher, Canvas can forward conversation-runtime settings to its bundled Agent Server. This enables `OH_CONVERSATION_RUNTIME=docker`, which runs each conversation in an isolated Docker container instead of the default local process runtime. + +Canvas forwards these settings only when the operator explicitly sets them. Unset values remain absent so Agent Server defaults stay authoritative. + +| Environment Variable | Type | Default | Description | +|---------------------|------|---------|-------------| +| `OH_CONVERSATION_RUNTIME` | string | unset | Conversation runtime type. Set to `docker` to run conversations in Docker containers. | +| `OH_CONVERSATION_IMAGE` | string | unset | Docker image to use for conversation containers. | +| `OH_CONVERSATION_CONTAINER_MEMORY` | string | unset | Memory limit for conversation containers (e.g., `2g`). | +| `OH_CONVERSATION_CONTAINER_CPUS` | string | unset | CPU limit for conversation containers. | +| `OH_CONVERSATION_CONTAINER_PIDS_LIMIT` | string | unset | PID limit for conversation containers. | +| `OH_CONVERSATION_CONTAINER_STARTUP_TIMEOUT` | string | unset | Startup timeout for conversation containers (seconds). | + +These variables are specific to Canvas's `dev-safe.mjs` launcher and are forwarded to the bundled Agent Server process. Docker provisioning and setting interpretation are handled by Agent Server. + ### Remote Runtime | Environment Variable | Type | Default | Description | |---------------------|------|---------|-------------|