From 0887d528167bb599b42c3d27b3697d652c6b24b1 Mon Sep 17 00:00:00 2001 From: openhands Date: Thu, 17 Sep 2026 07:25:21 +0000 Subject: [PATCH] docs: update documentation for OpenHands v1.20.0 - Add secret scoping section to agent-profiles.mdx (PR #17237) - Add Docker conversation runtime forwarding to environment-variables.mdx (PR #17462) - Add agent profile selection for automations to prebuilt-automations.mdx (PR #17396) - Create v1.20.0 release notes page - Add v1.20.0 to docs.json navigation Co-authored-by: openhands --- docs.json | 1 + .../usage/agent-canvas/agent-profiles.mdx | 14 ++++++++++ .../agent-canvas/prebuilt-automations.mdx | 13 ++++++++++ .../agent-canvas/release-notes/v1.20.0.mdx | 26 +++++++++++++++++++ openhands/usage/environment-variables.mdx | 17 ++++++++++++ 5 files changed, 71 insertions(+) create mode 100644 openhands/usage/agent-canvas/release-notes/v1.20.0.mdx diff --git a/docs.json b/docs.json index 133c95ce5..a3459df62 100644 --- a/docs.json +++ b/docs.json @@ -317,6 +317,7 @@ { "group": "Release Notes", "pages": [ + "openhands/usage/agent-canvas/release-notes/v1.20.0", "openhands/usage/agent-canvas/release-notes/v1.18.0", "openhands/usage/agent-canvas/release-notes/v1.17.0", "openhands/usage/agent-canvas/release-notes/v1.16.0", diff --git a/openhands/usage/agent-canvas/agent-profiles.mdx b/openhands/usage/agent-canvas/agent-profiles.mdx index bb639cdce..15ea7be38 100644 --- a/openhands/usage/agent-canvas/agent-profiles.mdx +++ b/openhands/usage/agent-canvas/agent-profiles.mdx @@ -44,6 +44,20 @@ Use an OpenHands profile when you want Agent Canvas to run the built-in OpenHand An OpenHands profile references an LLM profile, so model and credential changes are managed in `Settings > LLM`. Use this when you want Agent Canvas to own both the agent behavior and the model configuration. +### Secret Scope + +When the connected Agent Server advertises the `profile_secret_scope_v1` capability, the profile editor in `Settings > Agent` includes a **secret scope** picker. Use it to control which saved secrets an agent profile can access: + +- **All** — the profile can access every saved secret (default for existing profiles). +- **None** — the profile cannot access any saved secrets. +- **Selected** — choose specific secret names from the list of saved secrets. + +Secret references that no longer exist (for example, a secret that was deleted after being selected) are preserved in the profile rather than silently removed. This prevents an unrelated edit from widening or narrowing the profile's secret access. + +Agent Server is the sole enforcement point for secret scoping. Canvas only stores the profile's secret scope selection; it does not perform client-side secret filtering. + +On Agent Servers that do not advertise `profile_secret_scope_v1`, the picker is hidden and profiles remain unrestricted. + ### Let the Agent Switch LLM Profiles The OpenHands profile editor includes a **"Let the agent switch LLM profiles"** toggle. When enabled, the agent is given the `SwitchLLMTool`, which lets it switch between available LLM profiles during a conversation. When disabled, the tool is removed from the agent's toolset. diff --git a/openhands/usage/agent-canvas/prebuilt-automations.mdx b/openhands/usage/agent-canvas/prebuilt-automations.mdx index 91ef67f80..7cf3a8783 100644 --- a/openhands/usage/agent-canvas/prebuilt-automations.mdx +++ b/openhands/usage/agent-canvas/prebuilt-automations.mdx @@ -55,3 +55,16 @@ Automations run against the active backend. Use [Manage Backends](/openhands/usa Open an automation, select `Edit`, and use the `LLM profile` dropdown to change which saved profile future runs use. If an automation already has a profile, the edit dialog pre-selects it. Changing the LLM profile affects future automation runs. It does not rewrite previous run history. + +## Select an Agent Profile for an Automation + +When the active backend advertises agent-profile support, the automation setup and edit dialogs include an optional **agent profile** selector. Choose a saved agent profile to use for automation runs instead of the default agent. + +When a saved agent profile is selected: + +- The stable `agent_profile_id` is sent to the backend. +- The legacy model field is omitted. + +If a previously selected agent profile has been deleted, it remains visible in the selector rather than silently switching to another profile. This lets you review the configuration before choosing a replacement. + +The agent profile selector appears only on backends that support agent profiles. On backends without agent-profile support, only the LLM profile dropdown is available. diff --git a/openhands/usage/agent-canvas/release-notes/v1.20.0.mdx b/openhands/usage/agent-canvas/release-notes/v1.20.0.mdx new file mode 100644 index 000000000..fe3406c0e --- /dev/null +++ b/openhands/usage/agent-canvas/release-notes/v1.20.0.mdx @@ -0,0 +1,26 @@ +--- +title: Agent Canvas 1.20.0 +description: Release notes for Agent Canvas version 1.20.0 +--- + +# Agent Canvas 1.20.0 + +Released September 17, 2026. + +[View the full release on GitHub](https://github.com/OpenHands/OpenHands/releases/tag/v1.20.0). + +## Highlights + +- **Agent profile secret scoping** — Choose which saved secrets an agent profile can access (all, none, or selected names) from the profile editor in `Settings > Agent`. The control appears when Agent Server advertises the `profile_secret_scope_v1` capability. Deleted secret references are preserved rather than silently removed. See [Agent Profiles](/openhands/usage/agent-canvas/agent-profiles). +- **Docker conversation runtime forwarding** — Canvas now forwards six conversation-runtime settings (runtime, image, memory, CPU, PID limits, startup timeout) to its bundled Agent Server when the operator explicitly sets them, enabling `OH_CONVERSATION_RUNTIME=docker` in local Canvas deployments. See [Environment Variables](/openhands/usage/environment-variables). +- **Agent profile selection for automations** — Select a saved agent profile during automation setup and editing when the backend supports agent profiles. When selected, the stable `agent_profile_id` is sent and the legacy model field is omitted. Unavailable selections remain visible. See [Pre-built Automations](/openhands/usage/agent-canvas/prebuilt-automations). + +## Maintenance + +- Mock-LLM test profiles are isolated from ambient secrets to avoid environment-dependent secret lookups in E2E tests. +- Released agent runtime dependencies bumped: Agent Server 1.49.1, TypeScript client 1.49.1, Automation 1.13.1, Extensions 0.22.1. + +## Full Changelog + +- [GitHub release notes](https://github.com/OpenHands/OpenHands/releases/tag/v1.20.0) +- [Compare v1.18.0 to v1.20.0](https://github.com/OpenHands/OpenHands/compare/v1.18.0...v1.20.0) diff --git a/openhands/usage/environment-variables.mdx b/openhands/usage/environment-variables.mdx index 8a7fd1c43..4b8f50a53 100644 --- a/openhands/usage/environment-variables.mdx +++ b/openhands/usage/environment-variables.mdx @@ -150,6 +150,23 @@ These variables correspond to the `[security]` section in `config.toml`: |---------------------|------|---------|-------------| | `SANDBOX_VOLUME_OVERLAYS` | string | `""` | Volume overlay configurations | +### Docker Conversation Runtime (Canvas) + +When running Agent Canvas locally via the `dev-safe.mjs` launcher, Canvas can forward conversation-runtime settings to its bundled Agent Server. This enables `OH_CONVERSATION_RUNTIME=docker`, which runs each conversation in an isolated Docker container instead of the default local process runtime. + +Canvas forwards these settings only when the operator explicitly sets them. Unset values remain absent so Agent Server defaults stay authoritative. + +| Environment Variable | Type | Default | Description | +|---------------------|------|---------|-------------| +| `OH_CONVERSATION_RUNTIME` | string | unset | Conversation runtime type. Set to `docker` to run conversations in Docker containers. | +| `OH_CONVERSATION_IMAGE` | string | unset | Docker image to use for conversation containers. | +| `OH_CONVERSATION_CONTAINER_MEMORY` | string | unset | Memory limit for conversation containers (e.g., `2g`). | +| `OH_CONVERSATION_CONTAINER_CPUS` | string | unset | CPU limit for conversation containers. | +| `OH_CONVERSATION_CONTAINER_PIDS_LIMIT` | string | unset | PID limit for conversation containers. | +| `OH_CONVERSATION_CONTAINER_STARTUP_TIMEOUT` | string | unset | Startup timeout for conversation containers (seconds). | + +These variables are specific to Canvas's `dev-safe.mjs` launcher and are forwarded to the bundled Agent Server process. Docker provisioning and setting interpretation are handled by Agent Server. + ### Remote Runtime | Environment Variable | Type | Default | Description | |---------------------|------|---------|-------------|