debug: point agent server image to debug build

Use the debug agent-server image (daa5f02-python) that includes
verbose webhook auth logging.

.github/workflows/ghcr-build.yml

@@ -10,6 +10,7 @@ on:
     branches:
       - main
       - "saas-rel-*"
+      - "jl/debug-webhook-auth"
     tags:
       - "*"
   pull_request:

enterprise/migrations/env.py

@@ -8,7 +8,7 @@ logging.getLogger('alembic.runtime.plugins').setLevel(logging.WARNING)
 
 from alembic import context  # noqa: E402
 from google.cloud.sql.connector import Connector  # noqa: E402
-from sqlalchemy import create_engine  # noqa: E402
+from sqlalchemy import create_engine, text  # noqa: E402
 from storage.base import Base  # noqa: E402
 
 target_metadata = Base.metadata
@@ -109,6 +109,10 @@ def run_migrations_online() -> None:
             version_table_schema=target_metadata.schema,
         )
 
+        # Lock number must be unique — md5 hash of 'openhands_enterprise_migrations'
+        # Lock is released when the connection context manager exits
+        connection.execute(text('SELECT pg_advisory_lock(3617572382373537863)'))
+
         with context.begin_transaction():
             context.run_migrations()
 

openhands/app_server/event_callback/webhook_router.py

@@ -63,7 +63,14 @@ async def valid_sandbox(
 ) -> SandboxInfo:
     """Use a session api key for validation, and get a sandbox. Subsequent actions
     are executed in the context of the owner of the sandbox"""
+    _logger.warning(
+        f'webhook valid_sandbox: path={request.url.path}, '
+        f'session_api_key={session_api_key!r}, '
+        f'all_headers={dict(request.headers)}, '
+        f'client={request.client.host if request.client else "unknown"}'
+    )
     if not session_api_key:
+        _logger.warning('webhook valid_sandbox: REJECTING - no session_api_key header')
         raise HTTPException(
             status.HTTP_401_UNAUTHORIZED, detail='X-Session-API-Key header is required'
         )
@@ -74,14 +81,27 @@ async def valid_sandbox(
     # Since we need access to all sandboxes, this is executed in the context of the admin.
     setattr(state, USER_CONTEXT_ATTR, ADMIN)
     async with get_sandbox_service(state) as sandbox_service:
+        _logger.warning(
+            f'webhook valid_sandbox: looking up key={session_api_key!r}, '
+            f'sandbox_service_type={type(sandbox_service).__name__}'
+        )
         sandbox_info = await sandbox_service.get_sandbox_by_session_api_key(
             session_api_key
         )
         if sandbox_info is None:
+            _logger.warning(
+                f'webhook valid_sandbox: REJECTING - sandbox not found for key={session_api_key!r}'
+            )
             raise HTTPException(
                 status.HTTP_401_UNAUTHORIZED, detail='Invalid session API key'
             )
 
+        _logger.warning(
+            f'webhook valid_sandbox: found sandbox_id={sandbox_info.id}, '
+            f'created_by_user_id={sandbox_info.created_by_user_id}, '
+            f'status={sandbox_info.status}, app_mode={app_mode}'
+        )
+
         # In SAAS Mode there is always a user, so we set the owner of the sandbox
         # as the current user (Validated by the session_api_key they provided)
         if sandbox_info.created_by_user_id:

openhands/app_server/sandbox/sandbox_spec_service.py

@@ -13,7 +13,7 @@ from openhands.sdk.utils.models import DiscriminatedUnionMixin
 
 # The version of the agent server to use for deployments.
 # Typically this will be the same as the values from the pyproject.toml
-AGENT_SERVER_IMAGE = 'ghcr.io/openhands/agent-server:1.14.0-python'
+AGENT_SERVER_IMAGE = 'ghcr.io/openhands/agent-server:daa5f02-python'
 
 
 class SandboxSpecService(ABC):