Update dockerfile

Co-authored-by: openhands <openhands@all-hands.dev>

.github/workflows/e2e-tests.yml

@@ -187,6 +187,7 @@ jobs:
             test_settings.py::test_github_token_configuration \
             test_conversation.py::test_conversation_start \
             test_browsing_catchphrase.py::test_browsing_catchphrase \
+            test_multi_conversation_resume.py::test_multi_conversation_resume \
             -v --no-header --capture=no --timeout=900
 
       - name: Upload test results

.github/workflows/stale.yml

@@ -15,7 +15,7 @@ jobs:
           stale-issue-message: 'This issue is stale because it has been open for 40 days with no activity. Remove the stale label or leave a comment, otherwise it will be closed in 10 days.'
           stale-pr-message: 'This PR is stale because it has been open for 40 days with no activity. Remove the stale label or leave a comment, otherwise it will be closed in 10 days.'
           days-before-stale: 40
-          exempt-issue-labels: 'roadmap'
+          exempt-issue-labels: roadmap,backlog
           close-issue-message: 'This issue was automatically closed due to 50 days of inactivity. We do this to help keep the issues somewhat manageable and focus on active issues.'
           close-pr-message: 'This PR was closed because it had no activity for 50 days. If you feel this was closed in error, and you would like to continue the PR, please resubmit or let us know.'
           days-before-close: 10

.gitignore

@@ -257,3 +257,5 @@ containers/runtime/code
 
 # test results
 test-results
+.sessions
+.eval_sessions

config.template.toml

@@ -363,10 +363,11 @@ classpath = "my_package.my_module.MyCustomAgent"
 #confirmation_mode = false
 
 # The security analyzer to use (For Headless / CLI only -  In Web this is overridden by Session Init)
-#security_analyzer = ""
+# Available options: 'llm' (default), 'invariant'
+#security_analyzer = "llm"
 
 # Whether to enable security analyzer
-#enable_security_analyzer = false
+#enable_security_analyzer = true
 
 #################################### Condenser #################################
 # Condensers control how conversation history is managed and compressed when

containers/app/Dockerfile

@@ -58,34 +58,34 @@ RUN sed -i 's/^UID_MIN.*/UID_MIN 499/' /etc/login.defs
 # Default is 60000, but we've seen up to 200000
 RUN sed -i 's/^UID_MAX.*/UID_MAX 1000000/' /etc/login.defs
 
-RUN groupadd --gid $OPENHANDS_USER_ID app
+RUN groupadd --gid $OPENHANDS_USER_ID openhands
 RUN useradd -l -m -u $OPENHANDS_USER_ID --gid $OPENHANDS_USER_ID -s /bin/bash openhands && \
-    usermod -aG app openhands && \
+    usermod -aG openhands openhands && \
     usermod -aG sudo openhands && \
     echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
-RUN chown -R openhands:app /app && chmod -R 770 /app
-RUN sudo chown -R openhands:app $WORKSPACE_BASE && sudo chmod -R 770 $WORKSPACE_BASE
+RUN chown -R openhands:openhands /app && chmod -R 770 /app
+RUN sudo chown -R openhands:openhands $WORKSPACE_BASE && sudo chmod -R 770 $WORKSPACE_BASE
 USER openhands
 
 ENV VIRTUAL_ENV=/app/.venv \
     PATH="/app/.venv/bin:$PATH" \
     PYTHONPATH='/app'
 
-COPY --chown=openhands:app --chmod=770 --from=backend-builder ${VIRTUAL_ENV} ${VIRTUAL_ENV}
+COPY --chown=openhands:openhands --chmod=770 --from=backend-builder ${VIRTUAL_ENV} ${VIRTUAL_ENV}
 
-COPY --chown=openhands:app --chmod=770 ./microagents ./microagents
-COPY --chown=openhands:app --chmod=770 ./openhands ./openhands
-COPY --chown=openhands:app --chmod=777 ./openhands/runtime/plugins ./openhands/runtime/plugins
-COPY --chown=openhands:app pyproject.toml poetry.lock README.md MANIFEST.in LICENSE ./
+COPY --chown=openhands:openhands --chmod=770 ./microagents ./microagents
+COPY --chown=openhands:openhands --chmod=770 ./openhands ./openhands
+COPY --chown=openhands:openhands --chmod=777 ./openhands/runtime/plugins ./openhands/runtime/plugins
+COPY --chown=openhands:openhands pyproject.toml poetry.lock README.md MANIFEST.in LICENSE ./
 
 # This is run as "openhands" user, and will create __pycache__ with openhands:openhands ownership
 RUN python openhands/core/download.py # No-op to download assets
 # Add this line to set group ownership of all files/directories not already in "app" group
-# openhands:openhands -> openhands:app
-RUN find /app \! -group app -exec chgrp app {} +
+# openhands:openhands -> openhands:openhands
+RUN find /app \! -group openhands -exec chgrp openhands {} +
 
-COPY --chown=openhands:app --chmod=770 --from=frontend-builder /app/build ./frontend/build
-COPY --chown=openhands:app --chmod=770 ./containers/app/entrypoint.sh /app/entrypoint.sh
+COPY --chown=openhands:openhands --chmod=770 --from=frontend-builder /app/build ./frontend/build
+COPY --chown=openhands:openhands --chmod=770 ./containers/app/entrypoint.sh /app/entrypoint.sh
 
 USER root
 

docs/usage/cloud/project-management/jira-dc-integration.mdx

@@ -1,5 +1,5 @@
 ---
-title: Jira Data Center Integration (Beta)
+title: Jira Data Center Integration (Coming soon...)
 description: Complete guide for setting up Jira Data Center integration with OpenHands Cloud, including service account creation, personal access token generation, webhook configuration, and workspace integration setup.
 ---
 

docs/usage/cloud/project-management/jira-integration.mdx

@@ -1,5 +1,5 @@
 ---
-title: Jira Cloud Integration
+title: Jira Cloud Integration (Coming soon...)
 description: Complete guide for setting up Jira Cloud integration with OpenHands Cloud, including service account creation, API token generation, webhook configuration, and workspace integration setup.
 ---
 

docs/usage/cloud/project-management/linear-integration.mdx

@@ -1,5 +1,5 @@
 ---
-title: Linear Integration
+title: Linear Integration (Coming soon...)
 description: Complete guide for setting up Linear integration with OpenHands Cloud, including service account creation, API key generation, webhook configuration, and workspace integration setup.
 ---
 

docs/usage/cloud/project-management/overview.mdx

@@ -1,5 +1,5 @@
 ---
-title: Project Management Tool Integrations
+title: Project Management Tool Integrations (Coming soon...)
 description: Overview of OpenHands Cloud integrations with project management platforms including Jira Cloud, Jira Data Center, and Linear. Learn about setup requirements, usage methods, and troubleshooting.
 ---
 
@@ -18,9 +18,9 @@ Integration requires two levels of setup:
 2. **Workspace Integration** - Self-service configuration through the OpenHands Cloud UI to link your OpenHands account to the target workspace
 
 ### Platform-Specific Setup Guides:
-- [Jira Cloud Integration](./jira-integration.md)
-- [Jira Data Center Integration](./jira-dc-integration.md)
-- [Linear Integration](./linear-integration.md)
+- [Jira Cloud Integration (Coming soon...)](./jira-integration.md)
+- [Jira Data Center Integration (Coming soon...)](./jira-dc-integration.md)
+- [Linear Integration (Coming soon...)](./linear-integration.md)
 
 ## Usage
 

docs/usage/confirmation-mode.mdx

@@ -0,0 +1,52 @@
+# Confirmation Mode and Security Analyzers
+
+OpenHands provides a security framework to help protect users from potentially risky actions through **Confirmation Mode** and **Security Analyzers**. This system analyzes agent actions and prompts users for confirmation when high-risk operations are detected.
+
+## Overview
+
+The security system consists of two main components:
+
+1. **Confirmation Mode**: When enabled, the agent will pause and ask for user confirmation before executing actions that are flagged as high-risk by the security analyzer.
+
+2. **Security Analyzers**: These are modules that evaluate the risk level of agent actions and determine whether user confirmation is required.
+
+## Configuration
+
+### CLI
+In CLI mode, confirmation is enabled by default. You will have an option to uses the LLM Analyzer and will automatically confirm LOW and MEDIUM risk actions, only prompting for HIGH risk actions.
+
+## Security Analyzers
+
+OpenHands includes multiple analyzers:
+
+- **No Analyzer**: Do not use any security analyzer. The agent will prompt you to confirm *EVERY* action.
+- **LLM Risk Analyzer** (default): Uses the same LLM as the agent to assess action risk levels
+- **Invariant Analyzer**: Uses Invariant Labs' policy engine to evaluate action traces against security policies
+
+### LLM Risk Analyzer
+The default analyzer that leverages the agent's LLM to evaluate the security risk of each action. It considers the action type, parameters, and context to assign risk levels.
+
+### Invariant Analyzer
+An advanced analyzer that:
+- Collects conversation events and parses them into a trace
+- Checks the trace against an Invariant policy to classify risk (low, medium, high)
+- Manages an Invariant server container automatically if needed
+- Supports optional browsing-alignment and harmful-content checks
+
+## How It Works
+
+1. **Action Analysis**: When the agent wants to perform an action, the selected security analyzer evaluates its risk level.
+
+2. **Risk Assessment**: The analyzer returns one of three risk levels:
+   - **LOW**: Action proceeds without confirmation
+   - **MEDIUM**: Action proceeds without confirmation (may be configurable in future)
+   - **HIGH**: Action is paused, and user confirmation is requested
+
+3. **User Confirmation**: For high-risk actions, a confirmation dialog appears with:
+   - Description of the action
+   - Risk assessment explanation
+   - Options to approve or deny action
+
+4. **Action Execution**: Based on user response:
+   - **Approve**: Action proceeds as planned
+   - **Deny**: Action is cancelled

docs/usage/local-setup.mdx

@@ -45,6 +45,13 @@ A system with a modern processor and a minimum of **4GB RAM** is recommended to
   1. [Install WSL](https://learn.microsoft.com/en-us/windows/wsl/install).
   2. Run `wsl --version` in powershell and confirm `Default Version: 2`.
 
+  **Ubuntu (Linux Distribution)**
+
+  1. Install Ubuntu: `wsl --install -d Ubuntu` in PowerShell as Administrator.
+  2. Restart computer when prompted.
+  3. Open Ubuntu from Start menu to complete setup.
+  4. Verify installation: `wsl --list` should show Ubuntu.
+
   **Docker Desktop**
 
   1. [Install Docker Desktop on Windows](https://docs.docker.com/desktop/setup/install/windows-install).
@@ -53,7 +60,7 @@ A system with a modern processor and a minimum of **4GB RAM** is recommended to
   - Resources > WSL Integration: `Enable integration with my default WSL distro` is enabled.
 
   <Note>
-  The docker command below to start the app must be run inside the WSL terminal.
+  The docker command below to start the app must be run inside the WSL terminal. Use `wsl -d Ubuntu` in PowerShell or search "Ubuntu" in the Start menu to access the Ubuntu terminal.
   </Note>
 
   **Alternative: Windows without WSL**

evaluation/benchmarks/EDA/run_infer.py

@@ -9,8 +9,8 @@ from evaluation.utils.shared import (
     EvalMetadata,
     EvalOutput,
     compatibility_for_eval_history_pairs,
-    get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -61,18 +61,15 @@ AGENT_CLS_TO_INST_SUFFIX = {
 def get_config(
     metadata: EvalMetadata,
 ) -> OpenHandsConfig:
-    sandbox_config = get_default_sandbox_config_for_eval()
-    sandbox_config.base_container_image = 'python:3.12-bookworm'
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    # Create config with EDA-specific container image
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
     )
+
+    # Override the container image for EDA
+    config.sandbox.base_container_image = 'python:3.12-bookworm'
+
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)
     agent_config.enable_prompt_extensions = False

evaluation/benchmarks/agent_bench/run_infer.py

@@ -17,8 +17,8 @@ from evaluation.utils.shared import (
     EvalMetadata,
     EvalOutput,
     compatibility_for_eval_history_pairs,
-    get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -41,19 +41,12 @@ from openhands.utils.async_utils import call_async_from_sync
 def get_config(
     metadata: EvalMetadata,
 ) -> OpenHandsConfig:
-    sandbox_config = get_default_sandbox_config_for_eval()
-    sandbox_config.base_container_image = 'python:3.12-slim'
+    # Create config with agent_bench-specific container image
+    config = get_openhands_config_for_eval(metadata=metadata)
+
+    # Override the container image for agent_bench
+    config.sandbox.base_container_image = 'python:3.12-slim'
 
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
-        runtime=os.environ.get('RUNTIME', 'docker'),
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
-    )
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)
     agent_config.enable_prompt_extensions = False

evaluation/benchmarks/aider_bench/run_infer.py

@@ -18,6 +18,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -50,15 +51,10 @@ def get_config(
 ) -> OpenHandsConfig:
     sandbox_config = get_default_sandbox_config_for_eval()
     sandbox_config.base_container_image = 'python:3.11-bookworm'
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
+        sandbox_config=sandbox_config,
         runtime=os.environ.get('RUNTIME', 'docker'),
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
     )
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)

evaluation/benchmarks/biocoder/run_infer.py

@@ -16,6 +16,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -61,15 +62,10 @@ def get_config(
     sandbox_config = get_default_sandbox_config_for_eval()
     sandbox_config.base_container_image = BIOCODER_BENCH_CONTAINER_IMAGE
 
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)

evaluation/benchmarks/bird/run_infer.py

@@ -19,6 +19,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -75,15 +76,10 @@ def get_config(
     sandbox_config = get_default_sandbox_config_for_eval()
     sandbox_config.base_container_image = 'python:3.12-bookworm'
 
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)

evaluation/benchmarks/browsing_delegation/run_infer.py

@@ -12,6 +12,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -40,14 +41,8 @@ def get_config(
     )
     sandbox_config = get_default_sandbox_config_for_eval()
     sandbox_config.base_container_image = 'python:3.12-bookworm'
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
-        runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        workspace_base=None,
-        workspace_mount_path=None,
+    config = get_openhands_config_for_eval(
+        metadata=metadata, runtime='docker', sandbox_config=sandbox_config
     )
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)

evaluation/benchmarks/commit0/run_infer.py

@@ -17,6 +17,7 @@ from evaluation.utils.shared import (
     codeact_user_response,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -114,16 +115,11 @@ def get_config(
     sandbox_config = get_default_sandbox_config_for_eval()
     sandbox_config.base_container_image = base_container_image
 
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
-        max_iterations=metadata.max_iterations,
-        enable_browser=RUN_WITH_BROWSING,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
+        sandbox_config=sandbox_config,
         runtime=os.environ.get('RUNTIME', 'docker'),
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        enable_browser=RUN_WITH_BROWSING,
     )
     config.set_llm_config(
         update_llm_config_for_completions_logging(

evaluation/benchmarks/discoverybench/run_infer.py

@@ -18,6 +18,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -65,15 +66,10 @@ def get_config(
 ) -> OpenHandsConfig:
     sandbox_config = get_default_sandbox_config_for_eval()
     sandbox_config.base_container_image = 'python:3.12-bookworm'
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)

evaluation/benchmarks/gaia/run_infer.py

@@ -23,6 +23,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -60,15 +61,10 @@ def get_config(
 ) -> OpenHandsConfig:
     sandbox_config = get_default_sandbox_config_for_eval()
     sandbox_config.base_container_image = 'nikolaik/python-nodejs:python3.12-nodejs22'
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
+        sandbox_config=sandbox_config,
         runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
     )
     config.set_llm_config(metadata.llm_config)
     if metadata.agent_config:

evaluation/benchmarks/gorilla/run_infer.py

@@ -13,6 +13,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -43,15 +44,10 @@ def get_config(
 ) -> OpenHandsConfig:
     sandbox_config = get_default_sandbox_config_for_eval()
     sandbox_config.base_container_image = 'python:3.12-bookworm'
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)

evaluation/benchmarks/gpqa/run_infer.py

@@ -31,6 +31,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -64,15 +65,10 @@ def get_config(
 ) -> OpenHandsConfig:
     sandbox_config = get_default_sandbox_config_for_eval()
     sandbox_config.base_container_image = 'python:3.12-bookworm'
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)

evaluation/benchmarks/humanevalfix/run_infer.py

@@ -24,6 +24,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -85,15 +86,10 @@ def get_config(
 ) -> OpenHandsConfig:
     sandbox_config = get_default_sandbox_config_for_eval()
     sandbox_config.base_container_image = 'python:3.12-bookworm'
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)

evaluation/benchmarks/lca_ci_build_repair/eval_infer.py

@@ -16,6 +16,7 @@ import ruamel.yaml
 from evaluation.utils.shared import (
     EvalMetadata,
     get_default_sandbox_config_for_eval,
+    get_openhands_config_for_eval,
     make_metadata,
 )
 from openhands.core.config import (
@@ -37,15 +38,10 @@ def get_config(
 ) -> OpenHandsConfig:
     sandbox_config = get_default_sandbox_config_for_eval()
     sandbox_config.base_container_image = 'python:3.12-bookworm'
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)

evaluation/benchmarks/lca_ci_build_repair/run_infer.py

@@ -23,6 +23,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -48,15 +49,10 @@ def get_config(
 ) -> OpenHandsConfig:
     sandbox_config = get_default_sandbox_config_for_eval()
     sandbox_config.base_container_image = 'python:3.12-bookworm'
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)

evaluation/benchmarks/logic_reasoning/run_infer.py

@@ -11,6 +11,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -52,15 +53,10 @@ def get_config(
         '$OH_INTERPRETER_PATH -m pip install scitools-pyke'
     )
 
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)

evaluation/benchmarks/miniwob/run_infer.py

@@ -14,6 +14,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -58,15 +59,10 @@ def get_config(
 ) -> OpenHandsConfig:
     sandbox_config = get_default_sandbox_config_for_eval()
     sandbox_config.base_container_image = 'xingyaoww/od-eval-miniwob:v1.0'
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime=os.environ.get('RUNTIME', 'docker'),
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(
         update_llm_config_for_completions_logging(

evaluation/benchmarks/mint/run_infer.py

@@ -16,6 +16,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -110,15 +111,10 @@ def get_config(
         f'$OH_INTERPRETER_PATH -m pip install {" ".join(MINT_DEPENDENCIES)}'
     )
 
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)

evaluation/benchmarks/ml_bench/run_infer.py

@@ -27,6 +27,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -80,15 +81,10 @@ def get_config(
 ) -> OpenHandsConfig:
     sandbox_config = get_default_sandbox_config_for_eval()
     sandbox_config.base_container_image = 'public.ecr.aws/i5g0m1f6/ml-bench'
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)

evaluation/benchmarks/multi_swe_bench/eval_infer.py

@@ -23,6 +23,7 @@ from evaluation.utils.shared import (
     EvalMetadata,
     EvalOutput,
     get_default_sandbox_config_for_eval,
+    get_openhands_config_for_eval,
     prepare_dataset,
     reset_logger_for_multiprocessing,
     run_evaluation,
@@ -87,13 +88,9 @@ def get_config(metadata: EvalMetadata, instance: pd.Series) -> OpenHandsConfig:
         dataset_name=metadata.dataset,
         instance_id=instance['instance_id'],
     )
-    config = OpenHandsConfig(
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
         runtime=os.environ.get('RUNTIME', 'docker'),
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     return config
 

evaluation/benchmarks/multi_swe_bench/run_infer.py

@@ -21,6 +21,7 @@ from evaluation.utils.shared import (
     codeact_user_response,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     is_fatal_evaluation_error,
     make_metadata,
     prepare_dataset,
@@ -341,16 +342,11 @@ def get_config(
         instance_id=instance['instance_id'],
     )
 
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
-        max_iterations=metadata.max_iterations,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         enable_browser=RUN_WITH_BROWSING,
         runtime=os.environ.get('RUNTIME', 'docker'),
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(
         update_llm_config_for_completions_logging(

evaluation/benchmarks/nocode_bench/run_infer_nc.py

@@ -31,6 +31,7 @@ from evaluation.utils.shared import (
     codeact_user_response,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     is_fatal_evaluation_error,
     make_metadata,
     prepare_dataset,
@@ -174,15 +175,10 @@ def get_config(
         instance_id=instance['instance_id'],
     )
 
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
-        max_iterations=metadata.max_iterations,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime=os.environ.get('RUNTIME', 'docker'),
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
 
     config.set_llm_config(

evaluation/benchmarks/scienceagentbench/run_infer.py

@@ -13,6 +13,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -64,16 +65,10 @@ def get_config(
     sandbox_config.base_container_image = (
         'docker.io/xingyaoww/openhands-eval-scienceagentbench'
     )
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime=os.environ.get('RUNTIME', 'docker'),
-        max_budget_per_task=4,
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(
         update_llm_config_for_completions_logging(

evaluation/benchmarks/swe_bench/eval_infer.py

@@ -19,6 +19,7 @@ from evaluation.utils.shared import (
     EvalMetadata,
     EvalOutput,
     get_default_sandbox_config_for_eval,
+    get_openhands_config_for_eval,
     prepare_dataset,
     reset_logger_for_multiprocessing,
     run_evaluation,
@@ -83,13 +84,9 @@ def get_config(metadata: EvalMetadata, instance: pd.Series) -> OpenHandsConfig:
         dataset_name=metadata.dataset,
         instance_id=instance['instance_id'],
     )
-    config = OpenHandsConfig(
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
         runtime=os.environ.get('RUNTIME', 'docker'),
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     return config
 

evaluation/benchmarks/swe_bench/run_infer.py

@@ -32,6 +32,7 @@ from evaluation.utils.shared import (
     codeact_user_response,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     is_fatal_evaluation_error,
     make_metadata,
     prepare_dataset,
@@ -227,16 +228,11 @@ def get_config(
         instance_id=instance['instance_id'],
     )
 
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
-        max_iterations=metadata.max_iterations,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         enable_browser=RUN_WITH_BROWSING,
         runtime=os.environ.get('RUNTIME', 'docker'),
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
 
     config.set_llm_config(

evaluation/benchmarks/swe_bench/run_localize.py

@@ -20,6 +20,7 @@ from evaluation.utils.shared import (
     codeact_user_response,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     is_fatal_evaluation_error,
     make_metadata,
     prepare_dataset,
@@ -199,16 +200,11 @@ def get_config(
         'REPO_PATH': f'/workspace/{workspace_dir_name}/',
     }
 
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
-        max_iterations=metadata.max_iterations,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         enable_browser=RUN_WITH_BROWSING,
         runtime=os.environ.get('RUNTIME', 'docker'),
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(
         update_llm_config_for_completions_logging(

evaluation/benchmarks/testgeneval/eval_infer.py

@@ -37,6 +37,7 @@ from evaluation.benchmarks.testgeneval.utils import load_testgeneval_dataset
 from evaluation.utils.shared import (
     EvalMetadata,
     EvalOutput,
+    get_openhands_config_for_eval,
     prepare_dataset,
     reset_logger_for_multiprocessing,
     run_evaluation,
@@ -58,20 +59,21 @@ def get_config(instance: pd.Series) -> OpenHandsConfig:
         f'Invalid container image for instance {instance["instance_id_swebench"]}.'
     )
     logger.info(f'Using instance container image: {base_container_image}.')
-    return OpenHandsConfig(
-        run_as_openhands=False,
-        runtime=os.environ.get('RUNTIME', 'eventstream'),
-        sandbox=SandboxConfig(
-            base_container_image=base_container_image,
-            use_host_network=False,
-            timeout=1800,
-            api_key=os.environ.get('ALLHANDS_API_KEY'),
-            remote_runtime_api_url=os.environ.get(
-                'SANDBOX_REMOTE_RUNTIME_API_URL', 'http://localhost:8000'
-            ),
+
+    # Create custom sandbox config for testgeneval with specific requirements
+    sandbox_config = SandboxConfig(
+        base_container_image=base_container_image,
+        use_host_network=False,
+        timeout=1800,  # Longer timeout than default (300)
+        api_key=os.environ.get('ALLHANDS_API_KEY'),
+        remote_runtime_api_url=os.environ.get(
+            'SANDBOX_REMOTE_RUNTIME_API_URL', 'http://localhost:8000'
         ),
-        workspace_base=None,
-        workspace_mount_path=None,
+    )
+
+    return get_openhands_config_for_eval(
+        sandbox_config=sandbox_config,
+        runtime=os.environ.get('RUNTIME', 'docker'),  # Different default runtime
     )
 
 

evaluation/benchmarks/testgeneval/run_infer.py

@@ -25,6 +25,7 @@ from evaluation.utils.shared import (
     assert_and_raise,
     codeact_user_response,
     get_metrics,
+    get_openhands_config_for_eval,
     is_fatal_evaluation_error,
     make_metadata,
     prepare_dataset,
@@ -126,29 +127,26 @@ def get_config(
         f'Submit an issue on https://github.com/All-Hands-AI/OpenHands if you run into any issues.'
     )
 
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
-        max_iterations=metadata.max_iterations,
-        runtime=os.environ.get('RUNTIME', 'eventstream'),
-        sandbox=SandboxConfig(
-            base_container_image=base_container_image,
-            enable_auto_lint=True,
-            use_host_network=False,
-            # large enough timeout, since some testcases take very long to run
-            timeout=300,
-            # Add platform to the sandbox config to solve issue 4401
-            platform='linux/amd64',
-            api_key=os.environ.get('ALLHANDS_API_KEY', None),
-            remote_runtime_api_url=os.environ.get(
-                'SANDBOX_REMOTE_RUNTIME_API_URL', 'http://localhost:8000'
-            ),
-            keep_runtime_alive=False,
-            remote_runtime_init_timeout=3600,
+    sandbox_config = SandboxConfig(
+        base_container_image=base_container_image,
+        enable_auto_lint=True,
+        use_host_network=False,
+        # large enough timeout, since some testcases take very long to run
+        timeout=300,
+        # Add platform to the sandbox config to solve issue 4401
+        platform='linux/amd64',
+        api_key=os.environ.get('ALLHANDS_API_KEY', None),
+        remote_runtime_api_url=os.environ.get(
+            'SANDBOX_REMOTE_RUNTIME_API_URL', 'http://localhost:8000'
         ),
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        keep_runtime_alive=False,
+        remote_runtime_init_timeout=3600,
+    )
+
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
+        sandbox_config=sandbox_config,
+        runtime=os.environ.get('RUNTIME', 'docker'),
     )
     config.set_llm_config(
         update_llm_config_for_completions_logging(

evaluation/benchmarks/the_agent_company/run_infer.py

@@ -12,7 +12,10 @@ import tempfile
 import yaml
 from browsing import pre_login
 
-from evaluation.utils.shared import get_default_sandbox_config_for_eval
+from evaluation.utils.shared import (
+    get_default_sandbox_config_for_eval,
+    get_openhands_config_for_eval,
+)
 from openhands.controller.state.state import State
 from openhands.core.config import (
     LLMConfig,
@@ -42,19 +45,17 @@ def get_config(
     sandbox_config.enable_auto_lint = True
     # If the web services are running on the host machine, this must be set to True
     sandbox_config.use_host_network = True
-    config = OpenHandsConfig(
-        run_as_openhands=False,
-        max_budget_per_task=4,
+    config = get_openhands_config_for_eval(
         max_iterations=100,
-        save_trajectory_path=os.path.join(
-            mount_path_on_host, f'traj_{task_short_name}.json'
-        ),
-        sandbox=sandbox_config,
         # we mount trajectories path so that trajectories, generated by OpenHands
         # controller, can be accessible to the evaluator file in the runtime container
+        sandbox_config=sandbox_config,
         workspace_mount_path=mount_path_on_host,
-        workspace_mount_path_in_sandbox='/outputs',
     )
+    config.save_trajectory_path = os.path.join(
+        mount_path_on_host, f'traj_{task_short_name}.json'
+    )
+    config.max_budget_per_task = 4
     config.set_llm_config(llm_config)
     if agent_config:
         config.set_agent_config(agent_config)

evaluation/benchmarks/toolqa/run_infer.py

@@ -12,6 +12,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -44,15 +45,10 @@ def get_config(
 ) -> OpenHandsConfig:
     sandbox_config = get_default_sandbox_config_for_eval()
     sandbox_config.base_container_image = 'python:3.12-bookworm'
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)

evaluation/benchmarks/visual_swe_bench/run_infer.py

@@ -20,6 +20,7 @@ from evaluation.utils.shared import (
     codeact_user_response,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     is_fatal_evaluation_error,
     make_metadata,
     prepare_dataset,
@@ -160,16 +161,11 @@ def get_config(
         instance_id=instance['instance_id'],
     )
 
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
-        max_iterations=metadata.max_iterations,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         enable_browser=RUN_WITH_BROWSING,
         runtime=os.environ.get('RUNTIME', 'docker'),
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(
         update_llm_config_for_completions_logging(

evaluation/benchmarks/visualwebarena/run_infer.py

@@ -13,6 +13,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -73,16 +74,10 @@ def get_config(
         'VWA_WIKIPEDIA': f'{base_url}:8888',
         'VWA_HOMEPAGE': f'{base_url}:4399',
     }
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
-        attach_to_existing=True,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(
         update_llm_config_for_completions_logging(

evaluation/benchmarks/webarena/run_infer.py

@@ -13,6 +13,7 @@ from evaluation.utils.shared import (
     compatibility_for_eval_history_pairs,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -65,15 +66,10 @@ def get_config(
         'MAP': f'{base_url}:3000',
         'HOMEPAGE': f'{base_url}:4399',
     }
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime='docker',
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
+        sandbox_config=sandbox_config,
     )
     config.set_llm_config(metadata.llm_config)
     agent_config = config.get_agent_config(metadata.agent_class)

evaluation/integration_tests/run_infer.py

@@ -10,6 +10,7 @@ from evaluation.utils.shared import (
     EvalOutput,
     get_default_sandbox_config_for_eval,
     get_metrics,
+    get_openhands_config_for_eval,
     make_metadata,
     prepare_dataset,
     reset_logger_for_multiprocessing,
@@ -45,18 +46,12 @@ def get_config(
 ) -> OpenHandsConfig:
     sandbox_config = get_default_sandbox_config_for_eval()
     sandbox_config.platform = 'linux/amd64'
-    config = OpenHandsConfig(
-        default_agent=metadata.agent_class,
-        run_as_openhands=False,
+    config = get_openhands_config_for_eval(
+        metadata=metadata,
         runtime=os.environ.get('RUNTIME', 'docker'),
-        max_iterations=metadata.max_iterations,
-        sandbox=sandbox_config,
-        # do not mount workspace
-        workspace_base=None,
-        workspace_mount_path=None,
-        # debug
-        debug=True,
+        sandbox_config=sandbox_config,
     )
+    config.debug = True
     config.set_llm_config(
         update_llm_config_for_completions_logging(
             metadata.llm_config, metadata.eval_output_dir, instance_id

evaluation/utils/shared.py

@@ -703,3 +703,79 @@ def get_default_sandbox_config_for_eval() -> SandboxConfig:
         remote_runtime_enable_retries=True,
         remote_runtime_class='sysbox',
     )
+
+
+def get_openhands_config_for_eval(
+    metadata: EvalMetadata | None = None,
+    sandbox_config: SandboxConfig | None = None,
+    runtime: str | None = None,
+    max_iterations: int | None = None,
+    default_agent: str | None = None,
+    enable_browser: bool = False,
+    workspace_base: str | None = None,
+    workspace_mount_path: str | None = None,
+):
+    """Create an OpenHandsConfig with common patterns used across evaluation scripts.
+
+    This function provides a standardized way to create OpenHands configurations
+    for evaluation runs, with sensible defaults that match the patterns used in
+    most run_infer.py scripts. Individual evaluation scripts can override specific
+    attributes as needed.
+
+    Args:
+        metadata: EvalMetadata containing agent class, max iterations, etc.
+        sandbox_config: Custom sandbox config. If None, uses get_default_sandbox_config_for_eval()
+        runtime: Runtime type. If None, uses environment RUNTIME or 'docker'
+        max_iterations: Max iterations for the agent. If None, uses metadata.max_iterations
+        default_agent: Agent class name. If None, uses metadata.agent_class
+        enable_browser: Whether to enable browser functionality
+        workspace_base: Workspace base path. Defaults to None
+        workspace_mount_path: Workspace mount path. Defaults to None
+
+    Returns:
+        OpenHandsConfig: Configured for evaluation with eval-specific overrides applied
+    """
+    # Defer import to avoid circular imports at module load time
+    from openhands.core.config.openhands_config import (
+        OpenHandsConfig as _OHConfig,  # type: ignore
+    )
+
+    # Use provided sandbox config or get default
+    if sandbox_config is None:
+        sandbox_config = get_default_sandbox_config_for_eval()
+
+    # Extract values from metadata if provided
+    if metadata is not None:
+        if max_iterations is None:
+            max_iterations = metadata.max_iterations
+        if default_agent is None:
+            default_agent = metadata.agent_class
+
+    # Use environment runtime or default
+    if runtime is None:
+        runtime = os.environ.get('RUNTIME', 'docker')
+
+    # Provide sensible defaults if still None
+    if default_agent is None:
+        default_agent = 'CodeActAgent'
+    if max_iterations is None:
+        max_iterations = 50
+
+    # Always use repo-local .eval_sessions directory (absolute path)
+    eval_store = os.path.abspath(os.path.join(os.getcwd(), '.eval_sessions'))
+
+    # Create the base config with evaluation-specific overrides
+    config = _OHConfig(
+        default_agent=default_agent,
+        run_as_openhands=False,
+        runtime=runtime,
+        max_iterations=max_iterations,
+        enable_browser=enable_browser,
+        sandbox=sandbox_config,
+        workspace_base=workspace_base,
+        workspace_mount_path=workspace_mount_path,
+        file_store='local',
+        file_store_path=eval_store,
+    )
+
+    return config

frontend/__tests__/components/features/microagent-management/microagent-management.test.tsx

@@ -14,21 +14,31 @@ import { Conversation } from "#/api/open-hands.types";
 
 // Mock hooks
 const mockUseUserProviders = vi.fn();
-const mockUseUserRepositories = vi.fn();
+const mockUseGitRepositories = vi.fn();
 const mockUseConfig = vi.fn();
+const mockUseRepositoryMicroagents = vi.fn();
+const mockUseSearchConversations = vi.fn();
 
 vi.mock("#/hooks/use-user-providers", () => ({
   useUserProviders: () => mockUseUserProviders(),
 }));
 
-vi.mock("#/hooks/query/use-user-repositories", () => ({
-  useUserRepositories: () => mockUseUserRepositories(),
+vi.mock("#/hooks/query/use-git-repositories", () => ({
+  useGitRepositories: () => mockUseGitRepositories(),
 }));
 
 vi.mock("#/hooks/query/use-config", () => ({
   useConfig: () => mockUseConfig(),
 }));
 
+vi.mock("#/hooks/query/use-repository-microagents", () => ({
+  useRepositoryMicroagents: () => mockUseRepositoryMicroagents(),
+}));
+
+vi.mock("#/hooks/query/use-search-conversations", () => ({
+  useSearchConversations: () => mockUseSearchConversations(),
+}));
+
 describe("MicroagentManagement", () => {
   const RouterStub = createRoutesStub([
     {
@@ -174,7 +184,7 @@ describe("MicroagentManagement", () => {
       providers: ["github"],
     });
 
-    mockUseUserRepositories.mockReturnValue({
+    mockUseGitRepositories.mockReturnValue({
       data: {
         pages: [
           {
@@ -196,6 +206,18 @@ describe("MicroagentManagement", () => {
       },
     });
 
+    mockUseRepositoryMicroagents.mockReturnValue({
+      data: mockMicroagents,
+      isLoading: false,
+      isError: false,
+    });
+
+    mockUseSearchConversations.mockReturnValue({
+      data: mockConversations,
+      isLoading: false,
+      isError: false,
+    });
+
     // Setup default mock for retrieveUserGitRepositories
     vi.spyOn(OpenHands, "retrieveUserGitRepositories").mockResolvedValue({
       data: [...mockRepositories],
@@ -227,7 +249,7 @@ describe("MicroagentManagement", () => {
 
   it("should display loading state when fetching repositories", async () => {
     // Mock loading state
-    mockUseUserRepositories.mockReturnValue({
+    mockUseGitRepositories.mockReturnValue({
       data: undefined,
       isLoading: true,
       isError: false,
@@ -245,7 +267,7 @@ describe("MicroagentManagement", () => {
 
   it("should handle error when fetching repositories", async () => {
     // Mock error state
-    mockUseUserRepositories.mockReturnValue({
+    mockUseGitRepositories.mockReturnValue({
       data: undefined,
       isLoading: false,
       isError: true,
@@ -258,7 +280,7 @@ describe("MicroagentManagement", () => {
 
     // Wait for the error to be handled
     await waitFor(() => {
-      expect(mockUseUserRepositories).toHaveBeenCalled();
+      expect(mockUseGitRepositories).toHaveBeenCalled();
     });
   });
 
@@ -267,7 +289,7 @@ describe("MicroagentManagement", () => {
 
     // Wait for repositories to be loaded
     await waitFor(() => {
-      expect(mockUseUserRepositories).toHaveBeenCalled();
+      expect(mockUseGitRepositories).toHaveBeenCalled();
     });
 
     // Check that tabs are rendered
@@ -285,7 +307,7 @@ describe("MicroagentManagement", () => {
 
     // Wait for repositories to be loaded and rendered
     await waitFor(() => {
-      expect(mockUseUserRepositories).toHaveBeenCalled();
+      expect(mockUseGitRepositories).toHaveBeenCalled();
     });
 
     // Check that repository names are displayed
@@ -300,7 +322,7 @@ describe("MicroagentManagement", () => {
 
     // Wait for repositories to be loaded
     await waitFor(() => {
-      expect(mockUseUserRepositories).toHaveBeenCalled();
+      expect(mockUseGitRepositories).toHaveBeenCalled();
     });
 
     // Find and click on the first repository accordion
@@ -309,10 +331,7 @@ describe("MicroagentManagement", () => {
 
     // Wait for microagents to be fetched
     await waitFor(() => {
-      expect(OpenHands.getRepositoryMicroagents).toHaveBeenCalledWith(
-        "user",
-        "repo2",
-      );
+      expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
     });
 
     // Check that microagents are displayed
@@ -325,19 +344,17 @@ describe("MicroagentManagement", () => {
 
   it("should display loading state when fetching microagents", async () => {
     const user = userEvent.setup();
-    const getRepositoryMicroagentsSpy = vi.spyOn(
-      OpenHands,
-      "getRepositoryMicroagents",
-    );
-    getRepositoryMicroagentsSpy.mockImplementation(
-      () => new Promise(() => {}), // Never resolves
-    );
+    mockUseRepositoryMicroagents.mockReturnValue({
+      data: undefined,
+      isLoading: true,
+      isError: false,
+    });
 
     renderMicroagentManagement();
 
     // Wait for repositories to be loaded
     await waitFor(() => {
-      expect(mockUseUserRepositories).toHaveBeenCalled();
+      expect(mockUseGitRepositories).toHaveBeenCalled();
     });
 
     // Find and click on the first repository accordion
@@ -350,19 +367,17 @@ describe("MicroagentManagement", () => {
 
   it("should handle error when fetching microagents", async () => {
     const user = userEvent.setup();
-    const getRepositoryMicroagentsSpy = vi.spyOn(
-      OpenHands,
-      "getRepositoryMicroagents",
-    );
-    getRepositoryMicroagentsSpy.mockRejectedValue(
-      new Error("Failed to fetch microagents"),
-    );
+    mockUseRepositoryMicroagents.mockReturnValue({
+      data: undefined,
+      isLoading: false,
+      isError: true,
+    });
 
     renderMicroagentManagement();
 
     // Wait for repositories to be loaded
     await waitFor(() => {
-      expect(mockUseUserRepositories).toHaveBeenCalled();
+      expect(mockUseGitRepositories).toHaveBeenCalled();
     });
 
     // Find and click on the first repository accordion
@@ -371,23 +386,23 @@ describe("MicroagentManagement", () => {
 
     // Wait for the error to be handled
     await waitFor(() => {
-      expect(getRepositoryMicroagentsSpy).toHaveBeenCalledWith("user", "repo2");
+      expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
     });
   });
 
   it("should display empty state when no microagents are found", async () => {
     const user = userEvent.setup();
-    const getRepositoryMicroagentsSpy = vi.spyOn(
-      OpenHands,
-      "getRepositoryMicroagents",
-    );
-    getRepositoryMicroagentsSpy.mockResolvedValue([]);
+    mockUseRepositoryMicroagents.mockReturnValue({
+      data: [],
+      isLoading: false,
+      isError: false,
+    });
 
     renderMicroagentManagement();
 
     // Wait for repositories to be loaded
     await waitFor(() => {
-      expect(mockUseUserRepositories).toHaveBeenCalled();
+      expect(mockUseGitRepositories).toHaveBeenCalled();
     });
 
     // Find and click on the first repository accordion
@@ -396,7 +411,7 @@ describe("MicroagentManagement", () => {
 
     // Wait for microagents to be fetched
     await waitFor(() => {
-      expect(getRepositoryMicroagentsSpy).toHaveBeenCalledWith("user", "repo2");
+      expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
     });
 
     // Check that no microagents are displayed
@@ -410,7 +425,7 @@ describe("MicroagentManagement", () => {
 
     // Wait for repositories to be loaded
     await waitFor(() => {
-      expect(mockUseUserRepositories).toHaveBeenCalled();
+      expect(mockUseGitRepositories).toHaveBeenCalled();
     });
 
     // Find and click on the first repository accordion
@@ -419,10 +434,7 @@ describe("MicroagentManagement", () => {
 
     // Wait for microagents to be fetched
     await waitFor(() => {
-      expect(OpenHands.getRepositoryMicroagents).toHaveBeenCalledWith(
-        "user",
-        "repo2",
-      );
+      expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
     });
 
     // Check that microagent cards display correct information
@@ -449,7 +461,7 @@ describe("MicroagentManagement", () => {
 
     // Wait for repositories to be loaded and processed
     await waitFor(() => {
-      expect(mockUseUserRepositories).toHaveBeenCalled();
+      expect(mockUseGitRepositories).toHaveBeenCalled();
     });
 
     // Wait for repositories to be displayed in the accordion
@@ -468,7 +480,7 @@ describe("MicroagentManagement", () => {
 
     // Wait for repositories to be loaded and processed
     await waitFor(() => {
-      expect(mockUseUserRepositories).toHaveBeenCalled();
+      expect(mockUseGitRepositories).toHaveBeenCalled();
     });
 
     // Wait for repositories to be displayed in the accordion
@@ -492,7 +504,7 @@ describe("MicroagentManagement", () => {
 
     // Wait for repositories to be loaded
     await waitFor(() => {
-      expect(mockUseUserRepositories).toHaveBeenCalled();
+      expect(mockUseGitRepositories).toHaveBeenCalled();
     });
 
     // Find and click the first add microagent button
@@ -513,7 +525,7 @@ describe("MicroagentManagement", () => {
 
   it("should display empty state when no repositories are found", async () => {
     // Mock empty repositories
-    mockUseUserRepositories.mockReturnValue({
+    mockUseGitRepositories.mockReturnValue({
       data: {
         pages: [
           {
@@ -533,7 +545,7 @@ describe("MicroagentManagement", () => {
 
     // Wait for repositories to be loaded
     await waitFor(() => {
-      expect(mockUseUserRepositories).toHaveBeenCalled();
+      expect(mockUseGitRepositories).toHaveBeenCalled();
     });
 
     // Check that empty state messages are displayed
@@ -550,7 +562,7 @@ describe("MicroagentManagement", () => {
 
     // Wait for repositories to be loaded
     await waitFor(() => {
-      expect(mockUseUserRepositories).toHaveBeenCalled();
+      expect(mockUseGitRepositories).toHaveBeenCalled();
     });
 
     // Find and click on the first repository accordion
@@ -559,14 +571,11 @@ describe("MicroagentManagement", () => {
 
     // Wait for microagents to be fetched for first repo
     await waitFor(() => {
-      expect(OpenHands.getRepositoryMicroagents).toHaveBeenCalledWith(
-        "user",
-        "repo2",
-      );
+      expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
     });
 
-    // Check that the API call was made
-    expect(OpenHands.getRepositoryMicroagents).toHaveBeenCalledTimes(1);
+    // Check that the hook was called
+    expect(mockUseRepositoryMicroagents).toHaveBeenCalledTimes(1);
   });
 
   it("should display ready to add microagent message in main area", async () => {
@@ -591,7 +600,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Check that search input is rendered
@@ -611,7 +620,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Initially only repositories with .openhands should be visible
@@ -642,7 +651,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Type in search input with uppercase
@@ -665,7 +674,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Type in search input with partial match
@@ -691,7 +700,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Type in search input
@@ -724,7 +733,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Type in search input with non-existent repository name
@@ -752,7 +761,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Type in search input with special characters
@@ -773,7 +782,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Filter to show only repo2
@@ -788,10 +797,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for microagents to be fetched
       await waitFor(() => {
-        expect(OpenHands.getRepositoryMicroagents).toHaveBeenCalledWith(
-          "user",
-          "repo2",
-        );
+        expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
       });
 
       // Check that microagents are displayed
@@ -808,7 +814,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Type in search input with leading/trailing whitespace
@@ -828,7 +834,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       const searchInput = screen.getByRole("textbox", {
@@ -860,7 +866,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Find and click on the first repository accordion
@@ -869,15 +875,8 @@ describe("MicroagentManagement", () => {
 
       // Wait for both microagents and conversations to be fetched
       await waitFor(() => {
-        expect(OpenHands.getRepositoryMicroagents).toHaveBeenCalledWith(
-          "user",
-          "repo2",
-        );
-        expect(OpenHands.searchConversations).toHaveBeenCalledWith(
-          "user/repo2/.openhands",
-          "microagent_management",
-          1000,
-        );
+        expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
+        expect(mockUseSearchConversations).toHaveBeenCalled();
       });
     });
 
@@ -887,7 +886,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Find and click on the first repository accordion
@@ -896,8 +895,8 @@ describe("MicroagentManagement", () => {
 
       // Wait for both queries to complete
       await waitFor(() => {
-        expect(OpenHands.getRepositoryMicroagents).toHaveBeenCalled();
-        expect(OpenHands.searchConversations).toHaveBeenCalled();
+        expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
+        expect(mockUseSearchConversations).toHaveBeenCalled();
       });
 
       // Check that microagents are displayed
@@ -917,23 +916,22 @@ describe("MicroagentManagement", () => {
 
     it("should show loading state when both microagents and conversations are loading", async () => {
       const user = userEvent.setup();
-      const getRepositoryMicroagentsSpy = vi.spyOn(
-        OpenHands,
-        "getRepositoryMicroagents",
-      );
-      const searchConversationsSpy = vi.spyOn(OpenHands, "searchConversations");
-
-      // Make both queries never resolve
-      getRepositoryMicroagentsSpy.mockImplementation(
-        () => new Promise(() => {}),
-      );
-      searchConversationsSpy.mockImplementation(() => new Promise(() => {}));
+      mockUseRepositoryMicroagents.mockReturnValue({
+        data: undefined,
+        isLoading: true,
+        isError: false,
+      });
+      mockUseSearchConversations.mockReturnValue({
+        data: undefined,
+        isLoading: true,
+        isError: false,
+      });
 
       renderMicroagentManagement();
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Find and click on the first repository accordion
@@ -950,7 +948,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Find and click on the first repository accordion
@@ -959,8 +957,8 @@ describe("MicroagentManagement", () => {
 
       // Wait for both queries to complete
       await waitFor(() => {
-        expect(OpenHands.getRepositoryMicroagents).toHaveBeenCalled();
-        expect(OpenHands.searchConversations).toHaveBeenCalled();
+        expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
+        expect(mockUseSearchConversations).toHaveBeenCalled();
       });
 
       // Check that loading spinner is not displayed
@@ -975,7 +973,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Find and click on the first repository accordion
@@ -984,8 +982,8 @@ describe("MicroagentManagement", () => {
 
       // Wait for both queries to complete
       await waitFor(() => {
-        expect(OpenHands.getRepositoryMicroagents).toHaveBeenCalled();
-        expect(OpenHands.searchConversations).toHaveBeenCalled();
+        expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
+        expect(mockUseSearchConversations).toHaveBeenCalled();
       });
 
       // Check that microagent file paths are displayed for microagents
@@ -1010,21 +1008,22 @@ describe("MicroagentManagement", () => {
 
     it("should show learn this repo component when no microagents and no conversations", async () => {
       const user = userEvent.setup();
-      const getRepositoryMicroagentsSpy = vi.spyOn(
-        OpenHands,
-        "getRepositoryMicroagents",
-      );
-      const searchConversationsSpy = vi.spyOn(OpenHands, "searchConversations");
-
-      // Mock both queries to return empty arrays
-      getRepositoryMicroagentsSpy.mockResolvedValue([]);
-      searchConversationsSpy.mockResolvedValue([]);
+      mockUseRepositoryMicroagents.mockReturnValue({
+        data: [],
+        isLoading: false,
+        isError: false,
+      });
+      mockUseSearchConversations.mockReturnValue({
+        data: [],
+        isLoading: false,
+        isError: false,
+      });
 
       renderMicroagentManagement();
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Find and click on the first repository accordion
@@ -1033,8 +1032,8 @@ describe("MicroagentManagement", () => {
 
       // Wait for both queries to complete
       await waitFor(() => {
-        expect(getRepositoryMicroagentsSpy).toHaveBeenCalled();
-        expect(searchConversationsSpy).toHaveBeenCalled();
+        expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
+        expect(mockUseSearchConversations).toHaveBeenCalled();
       });
 
       // Check that the learn this repo component is displayed
@@ -1046,21 +1045,22 @@ describe("MicroagentManagement", () => {
 
     it("should show learn this repo component when only conversations exist but no microagents", async () => {
       const user = userEvent.setup();
-      const getRepositoryMicroagentsSpy = vi.spyOn(
-        OpenHands,
-        "getRepositoryMicroagents",
-      );
-      const searchConversationsSpy = vi.spyOn(OpenHands, "searchConversations");
-
-      // Mock microagents to return empty array, conversations to return data
-      getRepositoryMicroagentsSpy.mockResolvedValue([]);
-      searchConversationsSpy.mockResolvedValue([...mockConversations]);
+      mockUseRepositoryMicroagents.mockReturnValue({
+        data: [],
+        isLoading: false,
+        isError: false,
+      });
+      mockUseSearchConversations.mockReturnValue({
+        data: [...mockConversations],
+        isLoading: false,
+        isError: false,
+      });
 
       renderMicroagentManagement();
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Find and click on the first repository accordion
@@ -1069,8 +1069,8 @@ describe("MicroagentManagement", () => {
 
       // Wait for both queries to complete
       await waitFor(() => {
-        expect(getRepositoryMicroagentsSpy).toHaveBeenCalled();
-        expect(searchConversationsSpy).toHaveBeenCalled();
+        expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
+        expect(mockUseSearchConversations).toHaveBeenCalled();
       });
 
       // Check that conversations are displayed
@@ -1088,21 +1088,22 @@ describe("MicroagentManagement", () => {
 
     it("should show learn this repo component when only microagents exist but no conversations", async () => {
       const user = userEvent.setup();
-      const getRepositoryMicroagentsSpy = vi.spyOn(
-        OpenHands,
-        "getRepositoryMicroagents",
-      );
-      const searchConversationsSpy = vi.spyOn(OpenHands, "searchConversations");
-
-      // Mock microagents to return data, conversations to return empty array
-      getRepositoryMicroagentsSpy.mockResolvedValue([...mockMicroagents]);
-      searchConversationsSpy.mockResolvedValue([]);
+      mockUseRepositoryMicroagents.mockReturnValue({
+        data: [...mockMicroagents],
+        isLoading: false,
+        isError: false,
+      });
+      mockUseSearchConversations.mockReturnValue({
+        data: [],
+        isLoading: false,
+        isError: false,
+      });
 
       renderMicroagentManagement();
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Find and click on the first repository accordion
@@ -1111,8 +1112,8 @@ describe("MicroagentManagement", () => {
 
       // Wait for both queries to complete
       await waitFor(() => {
-        expect(getRepositoryMicroagentsSpy).toHaveBeenCalled();
-        expect(searchConversationsSpy).toHaveBeenCalled();
+        expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
+        expect(mockUseSearchConversations).toHaveBeenCalled();
       });
 
       // Check that microagents are displayed
@@ -1130,16 +1131,17 @@ describe("MicroagentManagement", () => {
 
     it("should handle error when fetching conversations", async () => {
       const user = userEvent.setup();
-      const searchConversationsSpy = vi.spyOn(OpenHands, "searchConversations");
-      searchConversationsSpy.mockRejectedValue(
-        new Error("Failed to fetch conversations"),
-      );
+      mockUseSearchConversations.mockReturnValue({
+        data: undefined,
+        isLoading: false,
+        isError: true,
+      });
 
       renderMicroagentManagement();
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Find and click on the first repository accordion
@@ -1148,11 +1150,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for the error to be handled
       await waitFor(() => {
-        expect(searchConversationsSpy).toHaveBeenCalledWith(
-          "user/repo2/.openhands",
-          "microagent_management",
-          1000,
-        );
+        expect(mockUseSearchConversations).toHaveBeenCalled();
       });
 
       // Check that the learn this repo component is displayed (since conversations failed)
@@ -1163,27 +1161,22 @@ describe("MicroagentManagement", () => {
       });
 
       // Also check that the microagents query was called successfully
-      expect(OpenHands.getRepositoryMicroagents).toHaveBeenCalledWith(
-        "user",
-        "repo2",
-      );
+      expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
     });
 
     it("should handle error when fetching microagents but conversations succeed", async () => {
       const user = userEvent.setup();
-      const getRepositoryMicroagentsSpy = vi.spyOn(
-        OpenHands,
-        "getRepositoryMicroagents",
-      );
-      getRepositoryMicroagentsSpy.mockRejectedValue(
-        new Error("Failed to fetch microagents"),
-      );
+      mockUseRepositoryMicroagents.mockReturnValue({
+        data: undefined,
+        isLoading: false,
+        isError: true,
+      });
 
       renderMicroagentManagement();
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Find and click on the first repository accordion
@@ -1192,10 +1185,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for the error to be handled
       await waitFor(() => {
-        expect(getRepositoryMicroagentsSpy).toHaveBeenCalledWith(
-          "user",
-          "repo2",
-        );
+        expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
       });
 
       // Check that the learn this repo component is displayed (since microagents failed)
@@ -1207,13 +1197,11 @@ describe("MicroagentManagement", () => {
 
     it("should call searchConversations with correct parameters", async () => {
       const user = userEvent.setup();
-      const searchConversationsSpy = vi.spyOn(OpenHands, "searchConversations");
-
       renderMicroagentManagement();
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Find and click on the first repository accordion
@@ -1222,11 +1210,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for searchConversations to be called
       await waitFor(() => {
-        expect(searchConversationsSpy).toHaveBeenCalledWith(
-          "user/repo2/.openhands",
-          "microagent_management",
-          1000,
-        );
+        expect(mockUseSearchConversations).toHaveBeenCalled();
       });
     });
 
@@ -1236,7 +1220,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Find and click on the first repository accordion
@@ -1245,8 +1229,8 @@ describe("MicroagentManagement", () => {
 
       // Wait for both queries to complete
       await waitFor(() => {
-        expect(OpenHands.getRepositoryMicroagents).toHaveBeenCalled();
-        expect(OpenHands.searchConversations).toHaveBeenCalled();
+        expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
+        expect(mockUseSearchConversations).toHaveBeenCalled();
       });
 
       // Check that conversations display correct information
@@ -1263,7 +1247,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Find and click on the first repository accordion
@@ -1272,15 +1256,8 @@ describe("MicroagentManagement", () => {
 
       // Wait for both queries to be called for first repo
       await waitFor(() => {
-        expect(OpenHands.getRepositoryMicroagents).toHaveBeenCalledWith(
-          "user",
-          "repo2",
-        );
-        expect(OpenHands.searchConversations).toHaveBeenCalledWith(
-          "user/repo2/.openhands",
-          "microagent_management",
-          1000,
-        );
+        expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
+        expect(mockUseSearchConversations).toHaveBeenCalled();
       });
 
       // Check that both microagents and conversations are displayed
@@ -1304,7 +1281,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded and processed
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Wait for repositories to be displayed in the accordion
@@ -1325,7 +1302,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded and processed
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Wait for repositories to be displayed in the accordion
@@ -1387,7 +1364,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded and processed
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Wait for repositories to be displayed in the accordion
@@ -1418,7 +1395,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded and processed
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Wait for repositories to be displayed in the accordion
@@ -1448,7 +1425,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded and processed
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Wait for repositories to be displayed in the accordion
@@ -1488,7 +1465,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded and processed
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Wait for repositories to be displayed in the accordion
@@ -1522,7 +1499,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded and processed
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Wait for repositories to be displayed in the accordion
@@ -1555,7 +1532,7 @@ describe("MicroagentManagement", () => {
 
       // Wait for repositories to be loaded and processed
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Wait for repositories to be displayed in the accordion
@@ -2409,19 +2386,22 @@ describe("MicroagentManagement", () => {
       const user = userEvent.setup();
 
       // Setup mocks before rendering
-      const getRepositoryMicroagentsSpy = vi.spyOn(
-        OpenHands,
-        "getRepositoryMicroagents",
-      );
-      const searchConversationsSpy = vi.spyOn(OpenHands, "searchConversations");
-      getRepositoryMicroagentsSpy.mockResolvedValue([]);
-      searchConversationsSpy.mockResolvedValue([]);
+      mockUseRepositoryMicroagents.mockReturnValue({
+        data: [],
+        isLoading: false,
+        isError: false,
+      });
+      mockUseSearchConversations.mockReturnValue({
+        data: [],
+        isLoading: false,
+        isError: false,
+      });
 
       renderMicroagentManagement();
 
       // Wait for repositories to be loaded
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       // Find and click on the first repository accordion to expand it
@@ -2430,8 +2410,8 @@ describe("MicroagentManagement", () => {
 
       // Wait for microagents and conversations to be fetched
       await waitFor(() => {
-        expect(getRepositoryMicroagentsSpy).toHaveBeenCalled();
-        expect(searchConversationsSpy).toHaveBeenCalled();
+        expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
+        expect(mockUseSearchConversations).toHaveBeenCalled();
       });
 
       // Verify the learn this repo trigger is displayed when no microagents exist
@@ -2451,19 +2431,22 @@ describe("MicroagentManagement", () => {
       const user = userEvent.setup();
 
       // Setup mocks
-      const getRepositoryMicroagentsSpy = vi.spyOn(
-        OpenHands,
-        "getRepositoryMicroagents",
-      );
-      const searchConversationsSpy = vi.spyOn(OpenHands, "searchConversations");
-      getRepositoryMicroagentsSpy.mockResolvedValue([]);
-      searchConversationsSpy.mockResolvedValue([]);
+      mockUseRepositoryMicroagents.mockReturnValue({
+        data: [],
+        isLoading: false,
+        isError: false,
+      });
+      mockUseSearchConversations.mockReturnValue({
+        data: [],
+        isLoading: false,
+        isError: false,
+      });
 
       renderMicroagentManagement();
 
       // Wait for repositories and expand accordion
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       const repoAccordion = screen.getByTestId("repository-name-tooltip");
@@ -2496,35 +2479,36 @@ describe("MicroagentManagement", () => {
       const user = userEvent.setup();
 
       // Setup mocks with existing microagents (should NOT show trigger)
-      const getRepositoryMicroagentsSpy = vi.spyOn(
-        OpenHands,
-        "getRepositoryMicroagents",
-      );
-      const searchConversationsSpy = vi.spyOn(OpenHands, "searchConversations");
-
-      // Mock with existing microagent
-      getRepositoryMicroagentsSpy.mockResolvedValue([
-        {
-          name: "test-microagent",
-          created_at: "2021-10-01",
-          git_provider: "github",
-          path: ".openhands/microagents/test",
-        },
-      ]);
-      searchConversationsSpy.mockResolvedValue([]);
+      mockUseRepositoryMicroagents.mockReturnValue({
+        data: [
+          {
+            name: "test-microagent",
+            created_at: "2021-10-01",
+            git_provider: "github",
+            path: ".openhands/microagents/test",
+          },
+        ],
+        isLoading: false,
+        isError: false,
+      });
+      mockUseSearchConversations.mockReturnValue({
+        data: [],
+        isLoading: false,
+        isError: false,
+      });
 
       renderMicroagentManagement();
 
       await waitFor(() => {
-        expect(mockUseUserRepositories).toHaveBeenCalled();
+        expect(mockUseGitRepositories).toHaveBeenCalled();
       });
 
       const repoAccordion = screen.getByTestId("repository-name-tooltip");
       await user.click(repoAccordion);
 
       await waitFor(() => {
-        expect(getRepositoryMicroagentsSpy).toHaveBeenCalled();
-        expect(searchConversationsSpy).toHaveBeenCalled();
+        expect(mockUseRepositoryMicroagents).toHaveBeenCalled();
+        expect(mockUseSearchConversations).toHaveBeenCalled();
       });
 
       // Should NOT show the learn this repo trigger when microagents exist

frontend/__tests__/routes/llm-settings.test.tsx

@@ -79,6 +79,35 @@ describe("Content", () => {
         expect(screen.getByTestId("set-indicator")).toBeInTheDocument();
       });
     });
+
+    it("should conditionally show security analyzer based on confirmation mode", async () => {
+      renderLlmSettingsScreen();
+      await screen.findByTestId("llm-settings-screen");
+
+      const confirmation = screen.getByTestId("enable-confirmation-mode-switch");
+
+      // Initially confirmation mode is false, so security analyzer should not be visible
+      expect(confirmation).not.toBeChecked();
+      expect(
+        screen.queryByTestId("security-analyzer-input"),
+      ).not.toBeInTheDocument();
+
+      // Enable confirmation mode
+      await userEvent.click(confirmation);
+      expect(confirmation).toBeChecked();
+
+      // Security analyzer should now be visible
+      screen.getByTestId("security-analyzer-input");
+
+      // Disable confirmation mode again
+      await userEvent.click(confirmation);
+      expect(confirmation).not.toBeChecked();
+
+      // Security analyzer should be hidden again
+      expect(
+        screen.queryByTestId("security-analyzer-input"),
+      ).not.toBeInTheDocument();
+    });
   });
 
   describe("Advanced form", () => {
@@ -107,7 +136,6 @@ describe("Content", () => {
       within(advancedForm).getByTestId("llm-api-key-input");
       within(advancedForm).getByTestId("llm-api-key-help-anchor-advanced");
       within(advancedForm).getByTestId("agent-input");
-      within(advancedForm).getByTestId("enable-confirmation-mode-switch");
       within(advancedForm).getByTestId("enable-memory-condenser-switch");
 
       await userEvent.click(advancedSwitch);
@@ -130,9 +158,6 @@ describe("Content", () => {
       const baseUrl = screen.getByTestId("base-url-input");
       const apiKey = screen.getByTestId("llm-api-key-input");
       const agent = screen.getByTestId("agent-input");
-      const confirmation = screen.getByTestId(
-        "enable-confirmation-mode-switch",
-      );
       const condensor = screen.getByTestId("enable-memory-condenser-switch");
 
       expect(model).toHaveValue("openhands/claude-sonnet-4-20250514");
@@ -140,15 +165,7 @@ describe("Content", () => {
       expect(apiKey).toHaveValue("");
       expect(apiKey).toHaveProperty("placeholder", "");
       expect(agent).toHaveValue("CodeActAgent");
-      expect(confirmation).not.toBeChecked();
       expect(condensor).toBeChecked();
-
-      // check that security analyzer is present
-      expect(
-        screen.queryByTestId("security-analyzer-input"),
-      ).not.toBeInTheDocument();
-      await userEvent.click(confirmation);
-      screen.getByTestId("security-analyzer-input");
     });
 
     it("should render the advanced form if existings settings are advanced", async () => {
@@ -177,7 +194,7 @@ describe("Content", () => {
         agent: "CoActAgent",
         confirmation_mode: true,
         enable_default_condenser: false,
-        security_analyzer: "mock-invariant",
+        security_analyzer: "none",
       });
 
       renderLlmSettingsScreen();
@@ -203,7 +220,7 @@ describe("Content", () => {
         expect(agent).toHaveValue("CoActAgent");
         expect(confirmation).toBeChecked();
         expect(condensor).not.toBeChecked();
-        expect(securityAnalyzer).toHaveValue("mock-invariant");
+        expect(securityAnalyzer).toHaveValue("SETTINGS$SECURITY_ANALYZER_NONE");
       });
     });
   });
@@ -293,7 +310,7 @@ describe("Form submission", () => {
     // select security analyzer
     const securityAnalyzer = screen.getByTestId("security-analyzer-input");
     await userEvent.click(securityAnalyzer);
-    const securityAnalyzerOption = screen.getByText("mock-invariant");
+    const securityAnalyzerOption = screen.getByText("SETTINGS$SECURITY_ANALYZER_NONE");
     await userEvent.click(securityAnalyzerOption);
 
     const submitButton = screen.getByTestId("submit-button");
@@ -306,7 +323,7 @@ describe("Form submission", () => {
         agent: "CoActAgent",
         confirmation_mode: true,
         enable_default_condenser: false,
-        security_analyzer: "mock-invariant",
+        security_analyzer: null,
       }),
     );
   });
@@ -375,9 +392,11 @@ describe("Form submission", () => {
     const baseUrl = await screen.findByTestId("base-url-input");
     const apiKey = await screen.findByTestId("llm-api-key-input");
     const agent = await screen.findByTestId("agent-input");
-    const confirmation = await screen.findByTestId("enable-confirmation-mode-switch");
     const condensor = await screen.findByTestId("enable-memory-condenser-switch");
 
+    // Confirmation mode switch is now in basic settings, always visible
+    const confirmation = await screen.findByTestId("enable-confirmation-mode-switch");
+
     // enter custom model
     await userEvent.type(model, "-mini");
     expect(model).toHaveValue("openai/gpt-4o-mini");
@@ -451,14 +470,17 @@ describe("Form submission", () => {
     // select security analyzer
     const securityAnalyzer = await screen.findByTestId("security-analyzer-input");
     await userEvent.click(securityAnalyzer);
-    const securityAnalyzerOption = screen.getByText("mock-invariant");
+    const securityAnalyzerOption = screen.getByText("SETTINGS$SECURITY_ANALYZER_NONE");
     await userEvent.click(securityAnalyzerOption);
-    expect(securityAnalyzer).toHaveValue("mock-invariant");
+    expect(securityAnalyzer).toHaveValue("SETTINGS$SECURITY_ANALYZER_NONE");
 
     expect(submitButton).not.toBeDisabled();
 
-    await userEvent.clear(securityAnalyzer);
-    expect(securityAnalyzer).toHaveValue("");
+    // revert back to original value
+    await userEvent.click(securityAnalyzer);
+    const originalSecurityAnalyzerOption = screen.getByText("SETTINGS$SECURITY_ANALYZER_LLM_DEFAULT");
+    await userEvent.click(originalSecurityAnalyzerOption);
+    expect(securityAnalyzer).toHaveValue("SETTINGS$SECURITY_ANALYZER_LLM_DEFAULT");
     expect(submitButton).toBeDisabled();
   });
 
@@ -552,7 +574,7 @@ describe("Form submission", () => {
       expect.objectContaining({
         llm_model: "openhands/claude-sonnet-4-20250514",
         llm_base_url: "",
-        confirmation_mode: false,
+        confirmation_mode: true, // Confirmation mode is now a basic setting, should be preserved
       }),
     );
   });

frontend/__tests__/routes/secrets-settings.test.tsx

@@ -107,9 +107,7 @@ describe("Content", () => {
       expect(screen.queryByTestId("add-secret-button")).not.toBeInTheDocument(),
     );
     const button = await screen.findByTestId("connect-git-button");
-    await userEvent.click(button);
-
-    screen.getByTestId("git-settings-screen");
+    expect(button).toHaveAttribute("href", "/settings/integrations");
   });
 
   it("should render an empty table when there are no existing secrets", async () => {

frontend/__tests__/utils/has-advanced-settings-set.test.ts

@@ -29,23 +29,5 @@ describe("hasAdvancedSettingsSet", () => {
         }),
       ).toBe(true);
     });
-
-    test("CONFIRMATION_MODE is true", () => {
-      expect(
-        hasAdvancedSettingsSet({
-          ...DEFAULT_SETTINGS,
-          CONFIRMATION_MODE: true,
-        }),
-      ).toBe(true);
-    });
-
-    test("SECURITY_ANALYZER is set", () => {
-      expect(
-        hasAdvancedSettingsSet({
-          ...DEFAULT_SETTINGS,
-          SECURITY_ANALYZER: "test",
-        }),
-      ).toBe(true);
-    });
   });
 });

frontend/package.json

@@ -11,17 +11,17 @@
     "@heroui/use-infinite-scroll": "^2.2.10",
     "@microlink/react-json-view": "^1.26.2",
     "@monaco-editor/react": "^4.7.0-rc.0",
-    "@react-router/node": "^7.8.0",
-    "@react-router/serve": "^7.8.0",
+    "@react-router/node": "^7.8.2",
+    "@react-router/serve": "^7.8.2",
     "@react-types/shared": "^3.31.0",
     "@reduxjs/toolkit": "^2.8.2",
-    "@stripe/react-stripe-js": "^3.9.0",
+    "@stripe/react-stripe-js": "^3.9.1",
     "@stripe/stripe-js": "^7.8.0",
     "@tailwindcss/postcss": "^4.1.12",
     "@tailwindcss/vite": "^4.1.12",
-    "@tanstack/react-query": "^5.85.3",
+    "@tanstack/react-query": "^5.85.5",
     "@uidotdev/usehooks": "^2.4.1",
-    "@vitejs/plugin-react": "^5.0.0",
+    "@vitejs/plugin-react": "^5.0.1",
     "@xterm/addon-fit": "^0.10.0",
     "@xterm/xterm": "^5.4.0",
     "axios": "^1.11.0",
@@ -29,32 +29,32 @@
     "date-fns": "^4.1.0",
     "eslint-config-airbnb-typescript": "^18.0.0",
     "framer-motion": "^12.23.12",
-    "i18next": "^25.3.6",
+    "i18next": "^25.4.2",
     "i18next-browser-languagedetector": "^8.2.0",
     "i18next-http-backend": "^3.0.2",
-    "isbot": "^5.1.29",
-    "jose": "^6.0.12",
-    "lucide-react": "^0.539.0",
+    "isbot": "^5.1.30",
+    "jose": "^6.0.13",
+    "lucide-react": "^0.541.0",
     "monaco-editor": "^0.52.2",
-    "posthog-js": "^1.260.1",
+    "posthog-js": "^1.260.2",
     "react": "^19.1.1",
     "react-dom": "^19.1.1",
     "react-highlight": "^0.15.0",
-    "react-hot-toast": "^2.5.1",
-    "react-i18next": "^15.6.1",
+    "react-hot-toast": "^2.6.0",
+    "react-i18next": "^15.7.2",
     "react-icons": "^5.5.0",
     "react-markdown": "^10.1.0",
     "react-redux": "^9.2.0",
-    "react-router": "^7.8.0",
+    "react-router": "^7.8.2",
     "react-select": "^5.10.2",
-    "react-syntax-highlighter": "^15.6.1",
+    "react-syntax-highlighter": "^15.6.5",
     "react-textarea-autosize": "^8.5.9",
     "remark-breaks": "^4.0.0",
     "remark-gfm": "^4.0.1",
     "sirv-cli": "^3.0.1",
     "socket.io-client": "^4.8.1",
     "tailwind-merge": "^3.3.1",
-    "vite": "^7.1.1",
+    "vite": "^7.1.3",
     "web-vitals": "^5.1.0",
     "ws": "^8.18.2"
   },
@@ -88,16 +88,16 @@
     "@babel/traverse": "^7.28.3",
     "@babel/types": "^7.28.2",
     "@mswjs/socket.io-binding": "^0.2.0",
-    "@playwright/test": "^1.54.2",
-    "@react-router/dev": "^7.8.0",
+    "@playwright/test": "^1.55.0",
+    "@react-router/dev": "^7.8.2",
     "@tailwindcss/typography": "^0.5.16",
     "@tanstack/eslint-plugin-query": "^5.83.1",
     "@testing-library/dom": "^10.4.1",
-    "@testing-library/jest-dom": "^6.7.0",
+    "@testing-library/jest-dom": "^6.8.0",
     "@testing-library/react": "^16.3.0",
     "@testing-library/user-event": "^14.6.1",
-    "@types/node": "^24.2.0",
-    "@types/react": "^19.1.9",
+    "@types/node": "^24.3.0",
+    "@types/react": "^19.1.11",
     "@types/react-dom": "^19.1.7",
     "@types/react-highlight": "^0.12.8",
     "@types/react-syntax-highlighter": "^15.5.13",
@@ -117,7 +117,7 @@
     "eslint-plugin-prettier": "^5.5.4",
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-hooks": "^4.6.2",
-    "eslint-plugin-unused-imports": "^4.1.4",
+    "eslint-plugin-unused-imports": "^4.2.0",
     "husky": "^9.1.7",
     "jsdom": "^26.1.0",
     "lint-staged": "^16.1.4",
@@ -126,7 +126,7 @@
     "stripe": "^18.4.0",
     "tailwindcss": "^4.1.8",
     "typescript": "^5.9.2",
-    "vite-plugin-svgr": "^4.2.0",
+    "vite-plugin-svgr": "^4.5.0",
     "vite-tsconfig-paths": "^5.1.4",
     "vitest": "^3.0.2"
   },

frontend/src/components/common/git-provider-dropdown.tsx

@@ -1,4 +1,5 @@
 import { useMemo } from "react";
+import { StylesConfig } from "react-select";
 import { Provider } from "../../types/settings";
 import { ReactSelectDropdown, SelectOption } from "./react-select-dropdown";
 
@@ -11,6 +12,8 @@ export interface GitProviderDropdownProps {
   disabled?: boolean;
   isLoading?: boolean;
   onChange?: (provider: Provider | null) => void;
+  classNamePrefix?: string;
+  styles?: StylesConfig<SelectOption, false>;
 }
 
 export function GitProviderDropdown({
@@ -22,6 +25,8 @@ export function GitProviderDropdown({
   disabled = false,
   isLoading = false,
   onChange,
+  classNamePrefix,
+  styles,
 }: GitProviderDropdownProps) {
   const options: SelectOption[] = useMemo(
     () =>
@@ -53,6 +58,8 @@ export function GitProviderDropdown({
       isSearchable={false}
       isLoading={isLoading}
       onChange={handleChange}
+      classNamePrefix={classNamePrefix}
+      styles={styles}
     />
   );
 }

frontend/src/components/common/react-select-dropdown.tsx

@@ -1,5 +1,5 @@
 import { useMemo } from "react";
-import Select from "react-select";
+import Select, { StylesConfig } from "react-select";
 import { cn } from "#/utils/utils";
 import { SelectOptionBase, getCustomStyles } from "./react-select-styles";
 
@@ -17,6 +17,8 @@ export interface ReactSelectDropdownProps {
   isSearchable?: boolean;
   isLoading?: boolean;
   onChange?: (option: SelectOption | null) => void;
+  classNamePrefix?: string;
+  styles?: StylesConfig<SelectOption, false>;
 }
 
 export function ReactSelectDropdown({
@@ -31,6 +33,8 @@ export function ReactSelectDropdown({
   isSearchable = true,
   isLoading = false,
   onChange,
+  classNamePrefix,
+  styles,
 }: ReactSelectDropdownProps) {
   const customStyles = useMemo(() => getCustomStyles<SelectOption>(), []);
 
@@ -46,8 +50,9 @@ export function ReactSelectDropdown({
         isSearchable={isSearchable}
         isLoading={isLoading}
         onChange={onChange}
-        styles={customStyles}
+        styles={styles || customStyles}
         className="w-full"
+        classNamePrefix={classNamePrefix}
       />
       {errorMessage && (
         <p className="text-red-500 text-sm mt-1">{errorMessage}</p>

frontend/src/components/common/react-select-styles.ts

@@ -90,3 +90,26 @@ export const getCustomStyles = <T extends SelectOptionBase>(): StylesConfig<
     color: "#B7BDC2", // tertiary-light
   }),
 });
+
+export const getGitProviderMicroagentManagementCustomStyles = <
+  T extends SelectOptionBase,
+>(): StylesConfig<T, false> => ({
+  ...getCustomStyles<T>(),
+  control: (provided, state) => ({
+    ...provided,
+    backgroundColor: state.isDisabled ? "#363636" : "#454545", // darker tertiary when disabled
+    border: "1px solid #717888",
+    borderRadius: "0.125rem",
+    minHeight: "2.5rem",
+    padding: "0 0.5rem",
+    boxShadow: "none",
+    opacity: state.isDisabled ? 0.6 : 1,
+    cursor: state.isDisabled ? "not-allowed" : "pointer",
+    "&:hover": {
+      borderColor: "#717888",
+    },
+    "& .git-provider-dropdown__value-container": {
+      padding: "2px 0",
+    },
+  }),
+});

frontend/src/components/features/chat/messages.tsx

@@ -24,6 +24,17 @@ import { AgentState } from "#/types/agent-state";
 import { getFirstPRUrl } from "#/utils/parse-pr-url";
 import MemoryIcon from "#/icons/memory_icon.svg?react";
 
+const isErrorEvent = (evt: unknown): evt is { error: true; message: string } =>
+  typeof evt === "object" &&
+  evt !== null &&
+  "error" in evt &&
+  evt.error === true;
+
+const isAgentStatusError = (evt: unknown): boolean =>
+  isOpenHandsEvent(evt) &&
+  isAgentStateChangeObservation(evt) &&
+  evt.extras.agent_state === AgentState.ERROR;
+
 interface MessagesProps {
   messages: (OpenHandsAction | OpenHandsObservation)[];
   isAwaitingUserConfirmation: boolean;
@@ -31,8 +42,11 @@ interface MessagesProps {
 
 export const Messages: React.FC<MessagesProps> = React.memo(
   ({ messages, isAwaitingUserConfirmation }) => {
-    const { createConversationAndSubscribe, isPending } =
-      useCreateConversationAndSubscribeMultiple();
+    const {
+      createConversationAndSubscribe,
+      isPending,
+      unsubscribeFromConversation,
+    } = useCreateConversationAndSubscribeMultiple();
     const { getOptimisticUserMessage } = useOptimisticUserMessage();
     const { conversationId } = useConversationId();
     const { data: conversation } = useUserConversation(conversationId);
@@ -93,20 +107,6 @@ export const Messages: React.FC<MessagesProps> = React.memo(
 
     const handleMicroagentEvent = React.useCallback(
       (socketEvent: unknown, microagentConversationId: string) => {
-        // Handle error events
-        const isErrorEvent = (
-          evt: unknown,
-        ): evt is { error: true; message: string } =>
-          typeof evt === "object" &&
-          evt !== null &&
-          "error" in evt &&
-          evt.error === true;
-
-        const isAgentStatusError = (evt: unknown): boolean =>
-          isOpenHandsEvent(evt) &&
-          isAgentStateChangeObservation(evt) &&
-          evt.extras.agent_state === AgentState.ERROR;
-
         if (isErrorEvent(socketEvent) || isAgentStatusError(socketEvent)) {
           setMicroagentStatuses((prev) =>
             prev.map((statusEntry) =>
@@ -119,7 +119,11 @@ export const Messages: React.FC<MessagesProps> = React.memo(
           isOpenHandsEvent(socketEvent) &&
           isAgentStateChangeObservation(socketEvent)
         ) {
-          if (socketEvent.extras.agent_state === AgentState.FINISHED) {
+          // Handle completion states
+          if (
+            socketEvent.extras.agent_state === AgentState.FINISHED ||
+            socketEvent.extras.agent_state === AgentState.AWAITING_USER_INPUT
+          ) {
             setMicroagentStatuses((prev) =>
               prev.map((statusEntry) =>
                 statusEntry.conversationId === microagentConversationId
@@ -127,6 +131,8 @@ export const Messages: React.FC<MessagesProps> = React.memo(
                   : statusEntry,
               ),
             );
+
+            unsubscribeFromConversation(microagentConversationId);
           }
         } else if (
           isOpenHandsEvent(socketEvent) &&
@@ -147,9 +153,27 @@ export const Messages: React.FC<MessagesProps> = React.memo(
               ),
             );
           }
+
+          unsubscribeFromConversation(microagentConversationId);
+        } else {
+          // For any other event, transition from WAITING to CREATING if still waiting
+          setMicroagentStatuses((prev) => {
+            const currentStatus = prev.find(
+              (entry) => entry.conversationId === microagentConversationId,
+            )?.status;
+
+            if (currentStatus === MicroagentStatus.WAITING) {
+              return prev.map((statusEntry) =>
+                statusEntry.conversationId === microagentConversationId
+                  ? { ...statusEntry, status: MicroagentStatus.CREATING }
+                  : statusEntry,
+              );
+            }
+            return prev; // No change needed
+          });
         }
       },
-      [setMicroagentStatuses],
+      [setMicroagentStatuses, unsubscribeFromConversation],
     );
 
     const handleLaunchMicroagent = (
@@ -178,13 +202,13 @@ export const Messages: React.FC<MessagesProps> = React.memo(
         },
         onSuccessCallback: (newConversationId: string) => {
           setShowLaunchMicroagentModal(false);
-          // Update status with conversation ID
+          // Update status with conversation ID - start with WAITING
           setMicroagentStatuses((prev) => [
             ...prev.filter((status) => status.eventId !== selectedEventId),
             {
               eventId: selectedEventId,
               conversationId: newConversationId,
-              status: MicroagentStatus.CREATING,
+              status: MicroagentStatus.WAITING,
             },
           ]);
         },

frontend/src/components/features/chat/microagent/microagent-status-indicator.tsx

@@ -19,6 +19,8 @@ export function MicroagentStatusIndicator({
 
   const getStatusText = () => {
     switch (status) {
+      case MicroagentStatus.WAITING:
+        return t("MICROAGENT$STATUS_WAITING");
       case MicroagentStatus.CREATING:
         return t("MICROAGENT$STATUS_CREATING");
       case MicroagentStatus.COMPLETED:
@@ -35,6 +37,8 @@ export function MicroagentStatusIndicator({
 
   const getStatusIcon = () => {
     switch (status) {
+      case MicroagentStatus.WAITING:
+        return <Spinner size="sm" />;
       case MicroagentStatus.CREATING:
         return <Spinner size="sm" />;
       case MicroagentStatus.COMPLETED:

frontend/src/components/features/chat/microagent/microagent-status-toast.tsx

@@ -10,6 +10,11 @@ interface ConversationCreatedToastProps {
   onClose: () => void;
 }
 
+interface ConversationStartingToastProps {
+  conversationId: string;
+  onClose: () => void;
+}
+
 function ConversationCreatedToast({
   conversationId,
   onClose,
@@ -37,6 +42,33 @@ function ConversationCreatedToast({
   );
 }
 
+function ConversationStartingToast({
+  conversationId,
+  onClose,
+}: ConversationStartingToastProps) {
+  const { t } = useTranslation();
+  return (
+    <div className="flex items-start gap-2">
+      <Spinner size="sm" />
+      <div>
+        {t("MICROAGENT$CONVERSATION_STARTING")}
+        <br />
+        <a
+          href={`/conversations/${conversationId}`}
+          target="_blank"
+          rel="noopener noreferrer"
+          className="underline"
+        >
+          {t("MICROAGENT$VIEW_CONVERSATION")}
+        </a>
+      </div>
+      <button type="button" onClick={onClose}>
+        <CloseIcon />
+      </button>
+    </div>
+  );
+}
+
 interface ConversationFinishedToastProps {
   conversationId: string;
   onClose: () => void;
@@ -78,10 +110,18 @@ function ConversationErroredToast({
   errorMessage,
   onClose,
 }: ConversationErroredToastProps) {
+  const { t } = useTranslation();
+
+  // Check if the error message is a translation key
+  const displayMessage =
+    errorMessage === "MICROAGENT$UNKNOWN_ERROR"
+      ? t(errorMessage)
+      : errorMessage;
+
   return (
     <div className="flex items-start gap-2">
       <SuccessIndicator status="error" />
-      <div>{errorMessage}</div>
+      <div>{displayMessage}</div>
       <button type="button" onClick={onClose}>
         <CloseIcon />
       </button>
@@ -136,3 +176,18 @@ export const renderConversationErroredToast = (
       duration: 5000,
     },
   );
+
+export const renderConversationStartingToast = (conversationId: string) =>
+  toast(
+    (toastInstance) => (
+      <ConversationStartingToast
+        conversationId={conversationId}
+        onClose={() => toast.dismiss(toastInstance.id)}
+      />
+    ),
+    {
+      ...TOAST_OPTIONS,
+      id: `starting-${conversationId}`,
+      duration: 10000, // Show for 10 seconds or until dismissed
+    },
+  );

frontend/src/components/features/controls/controls.tsx

@@ -7,11 +7,10 @@ import { ConversationCard } from "../conversation-panel/conversation-card";
 import { Provider } from "#/types/settings";
 
 interface ControlsProps {
-  setSecurityOpen: (isOpen: boolean) => void;
   showSecurityLock: boolean;
 }
 
-export function Controls({ setSecurityOpen, showSecurityLock }: ControlsProps) {
+export function Controls({ showSecurityLock }: ControlsProps) {
   const { data: conversation } = useActiveConversation();
   const [contextMenuOpen, setContextMenuOpen] = React.useState(false);
 
@@ -21,9 +20,7 @@ export function Controls({ setSecurityOpen, showSecurityLock }: ControlsProps) {
         <AgentControlBar />
         <AgentStatusBar />
 
-        {showSecurityLock && (
-          <SecurityLock onClick={() => setSecurityOpen(true)} />
-        )}
+        {showSecurityLock && <SecurityLock />}
       </div>
 
       <ConversationCard

frontend/src/components/features/controls/security-lock.tsx

@@ -1,17 +1,28 @@
 import { IoLockClosed } from "react-icons/io5";
+import { Tooltip } from "@heroui/react";
+import { useTranslation } from "react-i18next";
+import { Link } from "react-router";
+import { I18nKey } from "#/i18n/declaration";
 
-interface SecurityLockProps {
-  onClick: () => void;
-}
+export function SecurityLock() {
+  const { t } = useTranslation();
 
-export function SecurityLock({ onClick }: SecurityLockProps) {
   return (
-    <div
-      className="cursor-pointer hover:opacity-80 transition-all"
-      style={{ marginRight: "8px" }}
-      onClick={onClick}
+    <Tooltip
+      content={
+        <div className="max-w-xs p-2">
+          {t(I18nKey.SETTINGS$CONFIRMATION_MODE_LOCK_TOOLTIP)}
+        </div>
+      }
+      placement="top"
     >
-      <IoLockClosed size={20} />
-    </div>
+      <Link
+        to="/settings"
+        className="mr-2 cursor-pointer hover:opacity-80 transition-all"
+        aria-label={t(I18nKey.SETTINGS$TITLE)}
+      >
+        <IoLockClosed size={20} />
+      </Link>
+    </Tooltip>
   );
 }

frontend/src/components/features/conversation-panel/confirm-stop-modal.tsx

@@ -23,9 +23,9 @@ export function ConfirmStopModal({
     <ModalBackdrop>
       <ModalBody className="items-start border border-tertiary">
         <div className="flex flex-col gap-2">
-          <BaseModalTitle title={t(I18nKey.CONVERSATION$CONFIRM_STOP)} />
+          <BaseModalTitle title={t(I18nKey.CONVERSATION$CONFIRM_PAUSE)} />
           <BaseModalDescription
-            description={t(I18nKey.CONVERSATION$STOP_WARNING)}
+            description={t(I18nKey.CONVERSATION$PAUSE_WARNING)}
           />
         </div>
         <div

frontend/src/components/features/conversation-panel/conversation-card-context-menu.tsx

@@ -129,7 +129,7 @@ export function ConversationCardContextMenu({
 
       {onStop && (
         <ContextMenuListItem testId="stop-button" onClick={onStop}>
-          <ContextMenuIconText icon={Power} text={t(I18nKey.BUTTON$STOP)} />
+          <ContextMenuIconText icon={Power} text={t(I18nKey.BUTTON$PAUSE)} />
         </ContextMenuListItem>
       )}
 

frontend/src/components/features/conversation-panel/conversation-state-indicator.tsx

@@ -1,4 +1,6 @@
 import { ConversationStatus } from "#/types/conversation-status";
+import ArchivedIcon from "./state-indicators/archived.svg?react";
+import ErrorIcon from "./state-indicators/error.svg?react";
 import RunningIcon from "./state-indicators/running.svg?react";
 import StartingIcon from "./state-indicators/starting.svg?react";
 import StoppedIcon from "./state-indicators/stopped.svg?react";
@@ -9,6 +11,8 @@ const CONVERSATION_STATUS_INDICATORS: Record<ConversationStatus, SVGIcon> = {
   STOPPED: StoppedIcon,
   RUNNING: RunningIcon,
   STARTING: StartingIcon,
+  ARCHIVED: ArchivedIcon,
+  ERROR: ErrorIcon,
 };
 
 interface ConversationStateIndicatorProps {

frontend/src/components/features/conversation-panel/state-indicators/archived.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 0 24 24" width="24px" fill="#A7A9AC"><path d="M0 0h24v24H0V0z" fill="none"/><path d="M17 7h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1 0 1.43-.98 2.63-2.31 2.98l1.46 1.46C20.88 15.61 22 13.95 22 12c0-2.76-2.24-5-5-5zm-1 4h-2.19l2 2H16zM2 4.27l3.11 3.11C3.29 8.12 2 9.91 2 12c0 2.76 2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1 0-1.59 1.21-2.9 2.76-3.07L8.73 11H8v2h2.73L13 15.27V17h1.73l4.01 4L20 19.74 3.27 3 2 4.27z"/><path d="M0 24V0" fill="none"/></svg>

frontend/src/components/features/conversation-panel/state-indicators/error.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 0 24 24" width="24px" fill="#e7000b"><path d="M0 0h24v24H0z" fill="none"/><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-2h2v2zm0-4h-2V7h2v6z"/></svg>

frontend/src/components/features/microagent-management/microagent-management-accordion-title.tsx

@@ -17,7 +17,7 @@ export function MicroagentManagementAccordionTitle({
         <TooltipButton
           tooltip={repository.full_name}
           ariaLabel={repository.full_name}
-          className="text-white text-base font-normal bg-transparent p-0 min-w-0 h-auto cursor-pointer truncate max-w-[200px] translate-y-[-1px]"
+          className="text-white text-base font-normal bg-transparent p-0 min-w-0 h-auto cursor-pointer truncate max-w-[194px] translate-y-[-1px]"
           testId="repository-name-tooltip"
           placement="bottom"
         >

frontend/src/components/features/microagent-management/microagent-management-content.tsx

@@ -32,6 +32,7 @@ import {
 } from "#/utils/custom-toast-handlers";
 import { getFirstPRUrl } from "#/utils/parse-pr-url";
 import { I18nKey } from "#/i18n/declaration";
+import { useUserProviders } from "#/hooks/use-user-providers";
 
 // Handle error events
 const isErrorEvent = (evt: unknown): evt is { error: true; message: string } =>
@@ -65,16 +66,10 @@ const getConversationInstructions = (
   gitProvider: Provider,
 ) => `Create a microagent for the repository ${repositoryName} by following the steps below:
 
-- Step 1: Create a markdown file inside the .openhands/microagents folder with the name of the microagent (The microagent must be created in the .openhands/microagents folder and should be able to perform the described task when triggered).
-
-- This is the instructions about what the microagent should do: ${formData.query}
-
-${
+- Step 1: Create a markdown file inside the .openhands/microagents folder with the name of the microagent (The microagent must be created in the .openhands/microagents folder and should be able to perform the described task when triggered). This is the instructions about what the microagent should do: ${formData.query}. ${
   formData.triggers && formData.triggers.length > 0
-    ? `
-- This is the triggers of the microagent: ${formData.triggers.join(", ")}
-`
-    : "- Please be noted that the microagent doesn't have any triggers."
+    ? `This is the triggers of the microagent: ${formData.triggers.join(", ")}`
+    : "Please be noted that the microagent doesn't have any triggers."
 }
 
 - Step 2: Create a new branch for the repository ${repositoryName}, must avoid duplicated branches.
@@ -91,16 +86,10 @@ const getUpdateConversationInstructions = (
 ) => `Update the microagent for the repository ${repositoryName} by following the steps below:
 
 
-- Step 1: Update the microagent. This is the path of the microagent: ${formData.microagentPath} (The updated microagent must be in the .openhands/microagents folder and should be able to perform the described task when triggered).
-
-- This is the updated instructions about what the microagent should do: ${formData.query}
-
-${
+- Step 1: Update the microagent. This is the path of the microagent: ${formData.microagentPath} (The updated microagent must be in the .openhands/microagents folder and should be able to perform the described task when triggered). This is the updated instructions about what the microagent should do: ${formData.query}. ${
   formData.triggers && formData.triggers.length > 0
-    ? `
-- This is the triggers of the microagent: ${formData.triggers.join(", ")}
-`
-    : "- Please be noted that the microagent doesn't have any triggers."
+    ? `This is the triggers of the microagent: ${formData.triggers.join(", ")}`
+    : "Please be noted that the microagent doesn't have any triggers."
 }
 
 - Step 2: Create a new branch for the repository ${repositoryName}, must avoid duplicated branches.
@@ -119,6 +108,8 @@ export function MicroagentManagementContent() {
     learnThisRepoModalVisible,
   } = useSelector((state: RootState) => state.microagentManagement);
 
+  const { providers } = useUserProviders();
+
   const { t } = useTranslation();
 
   const dispatch = useDispatch();
@@ -182,11 +173,7 @@ export function MicroagentManagementContent() {
       // Check if agent has finished and we have a PR
       if (isOpenHandsEvent(socketEvent) && isFinishAction(socketEvent)) {
         const prUrl = getFirstPRUrl(socketEvent.args.final_thought || "");
-        if (prUrl) {
-          displaySuccessToast(
-            t(I18nKey.MICROAGENT_MANAGEMENT$PR_READY_FOR_REVIEW),
-          );
-        } else {
+        if (!prUrl) {
           // Agent finished but no PR found
           displaySuccessToast(t(I18nKey.MICROAGENT_MANAGEMENT$PR_NOT_CREATED));
         }
@@ -329,11 +316,18 @@ export function MicroagentManagementContent() {
     </>
   );
 
+  const providersAreSet = providers.length > 0;
+
   if (width < 1024) {
     return (
       <div className="w-full h-full flex flex-col gap-6">
         <div className="w-full rounded-lg border border-[#525252] bg-[#24272E] max-h-[494px] min-h-[494px]">
-          <MicroagentManagementSidebar isSmallerScreen />
+          {providersAreSet && (
+            <MicroagentManagementSidebar
+              isSmallerScreen
+              providers={providers}
+            />
+          )}
         </div>
         <div className="w-full rounded-lg border border-[#525252] bg-[#24272E] flex-1 min-h-[494px]">
           <MicroagentManagementMain />
@@ -345,7 +339,7 @@ export function MicroagentManagementContent() {
 
   return (
     <div className="w-full h-full flex rounded-lg border border-[#525252] bg-[#24272E] overflow-hidden">
-      <MicroagentManagementSidebar />
+      {providersAreSet && <MicroagentManagementSidebar providers={providers} />}
       <div className="flex-1">
         <MicroagentManagementMain />
       </div>

frontend/src/components/features/microagent-management/microagent-management-microagent-card.tsx

@@ -59,8 +59,10 @@ export function MicroagentManagementMicroagentCard({
     if (runtimeStatus === "STATUS$ERROR") {
       return t(I18nKey.MICROAGENT$STATUS_ERROR);
     }
-    if (conversationStatus === "RUNNING" && runtimeStatus === "STATUS$READY") {
-      return t(I18nKey.MICROAGENT$STATUS_OPENING_PR);
+    if (conversationStatus === "RUNNING") {
+      return runtimeStatus === "STATUS$READY"
+        ? t(I18nKey.MICROAGENT$STATUS_OPENING_PR)
+        : t(I18nKey.COMMON$STARTING);
     }
     return "";
   }, [conversationStatus, runtimeStatus, t, hasPr]);

frontend/src/components/features/microagent-management/microagent-management-repo-microagents.tsx

@@ -1,3 +1,4 @@
+import { useTranslation } from "react-i18next";
 import { useEffect } from "react";
 import { useDispatch, useSelector } from "react-redux";
 import { Spinner } from "@heroui/react";
@@ -8,6 +9,8 @@ import { useSearchConversations } from "#/hooks/query/use-search-conversations";
 import { GitRepository } from "#/types/git";
 import { RootState } from "#/store";
 import { setSelectedMicroagentItem } from "#/state/microagent-management-slice";
+import { cn } from "#/utils/utils";
+import { I18nKey } from "#/i18n/declaration";
 
 interface MicroagentManagementRepoMicroagentsProps {
   repository: GitRepository;
@@ -22,6 +25,8 @@ export function MicroagentManagementRepoMicroagents({
 
   const dispatch = useDispatch();
 
+  const { t } = useTranslation();
+
   const { full_name: repositoryName } = repository;
 
   // Extract owner and repo from repositoryName (format: "owner/repo")
@@ -103,34 +108,47 @@ export function MicroagentManagementRepoMicroagents({
   const numberOfMicroagents = microagents?.length || 0;
   const numberOfConversations = conversations?.length || 0;
   const totalItems = numberOfMicroagents + numberOfConversations;
+  const hasMicroagents = numberOfMicroagents > 0;
+  const hasConversations = numberOfConversations > 0;
 
   return (
     <div>
       {totalItems === 0 && (
         <MicroagentManagementLearnThisRepo repository={repository} />
       )}
-
       {/* Render microagents */}
-      {numberOfMicroagents > 0 &&
-        microagents?.map((microagent) => (
-          <div key={microagent.name} className="pb-4 last:pb-0">
-            <MicroagentManagementMicroagentCard
-              microagent={microagent}
-              repository={repository}
-            />
-          </div>
-        ))}
+      {hasMicroagents && (
+        <div className="flex flex-col">
+          <span className="text-md text-white font-medium leading-5 mb-4">
+            {t(I18nKey.MICROAGENT_MANAGEMENT$EXISTING_MICROAGENTS)}
+          </span>
+          {microagents?.map((microagent) => (
+            <div key={microagent.name} className="pb-4 last:pb-0">
+              <MicroagentManagementMicroagentCard
+                microagent={microagent}
+                repository={repository}
+              />
+            </div>
+          ))}
+        </div>
+      )}
 
       {/* Render conversations */}
-      {numberOfConversations > 0 &&
-        conversations?.map((conversation) => (
-          <div key={conversation.conversation_id} className="pb-4 last:pb-0">
-            <MicroagentManagementMicroagentCard
-              conversation={conversation}
-              repository={repository}
-            />
-          </div>
-        ))}
+      {hasConversations && (
+        <div className={cn("flex flex-col", hasMicroagents && "mt-4")}>
+          <span className="text-md text-white font-medium leading-5 mb-4">
+            {t(I18nKey.MICROAGENT_MANAGEMENT$OPEN_MICROAGENT_PULL_REQUESTS)}
+          </span>
+          {conversations?.map((conversation) => (
+            <div key={conversation.conversation_id} className="pb-4 last:pb-0">
+              <MicroagentManagementMicroagentCard
+                conversation={conversation}
+                repository={repository}
+              />
+            </div>
+          ))}
+        </div>
+      )}
     </div>
   );
 }

frontend/src/components/features/microagent-management/microagent-management-repositories.tsx

@@ -1,15 +1,12 @@
-import { useState, useMemo } from "react";
 import { useTranslation } from "react-i18next";
 import { Accordion, AccordionItem } from "@heroui/react";
 import { MicroagentManagementRepoMicroagents } from "./microagent-management-repo-microagents";
 import { GitRepository } from "#/types/git";
-import { cn } from "#/utils/utils";
 import { TabType } from "#/types/microagent-management";
 import { MicroagentManagementNoRepositories } from "./microagent-management-no-repositories";
 import { I18nKey } from "#/i18n/declaration";
 import { DOCUMENTATION_URL } from "#/utils/constants";
 import { MicroagentManagementAccordionTitle } from "./microagent-management-accordion-title";
-import { sanitizeQuery } from "#/utils/sanitize-query";
 
 type MicroagentManagementRepositoriesProps = {
   repositories: GitRepository[];
@@ -21,23 +18,9 @@ export function MicroagentManagementRepositories({
   tabType,
 }: MicroagentManagementRepositoriesProps) {
   const { t } = useTranslation();
-  const [searchQuery, setSearchQuery] = useState("");
 
   const numberOfRepoMicroagents = repositories.length;
 
-  // Filter repositories based on search query
-  const filteredRepositories = useMemo(() => {
-    if (!searchQuery.trim()) {
-      return repositories;
-    }
-
-    const sanitizedQuery = sanitizeQuery(searchQuery);
-    return repositories.filter((repository) => {
-      const sanitizedRepoName = sanitizeQuery(repository.full_name);
-      return sanitizedRepoName.includes(sanitizedQuery);
-    });
-  }, [repositories, searchQuery]);
-
   if (numberOfRepoMicroagents === 0) {
     if (tabType === "personal") {
       return (
@@ -73,25 +56,6 @@ export function MicroagentManagementRepositories({
 
   return (
     <div className="flex flex-col gap-4 w-full">
-      {/* Search Input */}
-      <div className="flex flex-col gap-2 w-full">
-        <label htmlFor="repository-search" className="sr-only">
-          {t(I18nKey.COMMON$SEARCH_REPOSITORIES)}
-        </label>
-        <input
-          id="repository-search"
-          name="repository-search"
-          type="text"
-          placeholder={`${t(I18nKey.COMMON$SEARCH_REPOSITORIES)}...`}
-          value={searchQuery}
-          onChange={(e) => setSearchQuery(e.target.value)}
-          className={cn(
-            "bg-tertiary border border-[#717888] bg-[#454545] w-full rounded-sm p-2 placeholder:italic placeholder:text-tertiary-alt",
-            "disabled:bg-[#2D2F36] disabled:border-[#2D2F36] disabled:cursor-not-allowed",
-          )}
-        />
-      </div>
-
       {/* Repositories Accordion */}
       <Accordion
         variant="splitted"
@@ -104,7 +68,7 @@ export function MicroagentManagementRepositories({
         }}
         selectionMode="multiple"
       >
-        {filteredRepositories.map((repository) => (
+        {repositories.map((repository) => (
           <AccordionItem
             key={repository.id}
             aria-label={repository.full_name}

frontend/src/components/features/microagent-management/microagent-management-sidebar.tsx

@@ -1,59 +1,109 @@
-import { useEffect } from "react";
+import { useEffect, useState, useMemo } from "react";
 import { useDispatch } from "react-redux";
 import { useTranslation } from "react-i18next";
 import { Spinner } from "@heroui/react";
 import { MicroagentManagementSidebarHeader } from "./microagent-management-sidebar-header";
 import { MicroagentManagementSidebarTabs } from "./microagent-management-sidebar-tabs";
-import { useUserRepositories } from "#/hooks/query/use-user-repositories";
-import { useUserProviders } from "#/hooks/use-user-providers";
+import { useGitRepositories } from "#/hooks/query/use-git-repositories";
+import { GitProviderDropdown } from "#/components/common/git-provider-dropdown";
 import {
   setPersonalRepositories,
   setOrganizationRepositories,
   setRepositories,
 } from "#/state/microagent-management-slice";
 import { GitRepository } from "#/types/git";
+import { Provider } from "#/types/settings";
 import { cn } from "#/utils/utils";
+import { sanitizeQuery } from "#/utils/sanitize-query";
+import { I18nKey } from "#/i18n/declaration";
+import { getGitProviderMicroagentManagementCustomStyles } from "#/components/common/react-select-styles";
 
 interface MicroagentManagementSidebarProps {
   isSmallerScreen?: boolean;
+  providers: Provider[];
 }
 
 export function MicroagentManagementSidebar({
   isSmallerScreen = false,
+  providers,
 }: MicroagentManagementSidebarProps) {
+  const [selectedProvider, setSelectedProvider] = useState<Provider | null>(
+    providers.length > 0 ? providers[0] : null,
+  );
+
+  const [searchQuery, setSearchQuery] = useState("");
+
   const dispatch = useDispatch();
+
   const { t } = useTranslation();
-  const { providers } = useUserProviders();
-  const selectedProvider = providers.length > 0 ? providers[0] : null;
-  const { data: repositories, isLoading } =
-    useUserRepositories(selectedProvider);
+
+  const { data: repositories, isLoading } = useGitRepositories({
+    provider: selectedProvider,
+    pageSize: 200,
+    enabled: !!selectedProvider,
+  });
+
+  // Auto-select provider if there's only one
+  useEffect(() => {
+    if (providers.length > 0 && !selectedProvider) {
+      setSelectedProvider(providers[0]);
+    }
+  }, [providers, selectedProvider]);
+
+  const handleProviderChange = (provider: Provider | null) => {
+    setSelectedProvider(provider);
+    setSearchQuery("");
+  };
+
+  // Filter repositories based on search query
+  const filteredRepositories = useMemo(() => {
+    if (!repositories?.pages) return null;
+
+    // Flatten all pages to get all repositories
+    const allRepositories = repositories.pages.flatMap((page) => page.data);
+
+    if (!searchQuery.trim()) {
+      return allRepositories;
+    }
+
+    const sanitizedQuery = sanitizeQuery(searchQuery);
+    return allRepositories.filter((repository: GitRepository) => {
+      const sanitizedRepoName = sanitizeQuery(repository.full_name);
+      return sanitizedRepoName.includes(sanitizedQuery);
+    });
+  }, [repositories, searchQuery, selectedProvider]);
 
   useEffect(() => {
-    if (repositories?.pages) {
-      const personalRepos: GitRepository[] = [];
-      const organizationRepos: GitRepository[] = [];
-      const otherRepos: GitRepository[] = [];
-
-      // Flatten all pages to get all repositories
-      const allRepositories = repositories.pages.flatMap((page) => page.data);
-
-      allRepositories.forEach((repo: GitRepository) => {
-        const hasOpenHandsSuffix = repo.full_name.endsWith("/.openhands");
-
-        if (repo.owner_type === "user" && hasOpenHandsSuffix) {
-          personalRepos.push(repo);
-        } else if (repo.owner_type === "organization" && hasOpenHandsSuffix) {
-          organizationRepos.push(repo);
-        } else {
-          otherRepos.push(repo);
-        }
-      });
-
-      dispatch(setPersonalRepositories(personalRepos));
-      dispatch(setOrganizationRepositories(organizationRepos));
-      dispatch(setRepositories(otherRepos));
+    if (!filteredRepositories?.length) {
+      dispatch(setPersonalRepositories([]));
+      dispatch(setOrganizationRepositories([]));
+      dispatch(setRepositories([]));
+      return;
     }
-  }, [repositories, dispatch]);
+
+    const personalRepos: GitRepository[] = [];
+    const organizationRepos: GitRepository[] = [];
+    const otherRepos: GitRepository[] = [];
+
+    filteredRepositories.forEach((repo: GitRepository) => {
+      const hasOpenHandsSuffix =
+        selectedProvider === "gitlab"
+          ? repo.full_name.endsWith("/openhands-config")
+          : repo.full_name.endsWith("/.openhands");
+
+      if (repo.owner_type === "user" && hasOpenHandsSuffix) {
+        personalRepos.push(repo);
+      } else if (repo.owner_type === "organization" && hasOpenHandsSuffix) {
+        organizationRepos.push(repo);
+      } else {
+        otherRepos.push(repo);
+      }
+    });
+
+    dispatch(setPersonalRepositories(personalRepos));
+    dispatch(setOrganizationRepositories(organizationRepos));
+    dispatch(setRepositories(otherRepos));
+  }, [filteredRepositories, selectedProvider, dispatch]);
 
   return (
     <div
@@ -63,6 +113,41 @@ export function MicroagentManagementSidebar({
       )}
     >
       <MicroagentManagementSidebarHeader />
+
+      {/* Provider Selection */}
+      {providers.length > 1 && (
+        <div className="mt-6">
+          <GitProviderDropdown
+            providers={providers}
+            value={selectedProvider}
+            placeholder="Select Provider"
+            onChange={handleProviderChange}
+            className="w-full"
+            classNamePrefix="git-provider-dropdown"
+            styles={getGitProviderMicroagentManagementCustomStyles()}
+          />
+        </div>
+      )}
+
+      {/* Search Input */}
+      <div className="flex flex-col gap-2 w-full mt-6">
+        <label htmlFor="repository-search" className="sr-only">
+          {t(I18nKey.COMMON$SEARCH_REPOSITORIES)}
+        </label>
+        <input
+          id="repository-search"
+          name="repository-search"
+          type="text"
+          placeholder={`${t(I18nKey.COMMON$SEARCH_REPOSITORIES)}...`}
+          value={searchQuery}
+          onChange={(e) => setSearchQuery(e.target.value)}
+          className={cn(
+            "bg-tertiary border border-[#717888] bg-[#454545] w-full rounded-sm p-2 placeholder:italic placeholder:text-tertiary-alt",
+            "disabled:bg-[#2D2F36] disabled:border-[#2D2F36] disabled:cursor-not-allowed h-10 box-shadow-none outline-none",
+          )}
+        />
+      </div>
+
       {isLoading ? (
         <div className="flex flex-col items-center justify-center gap-4 flex-1">
           <Spinner size="sm" />

frontend/src/components/shared/action-tooltip.tsx

@@ -1,8 +1,7 @@
 import { Tooltip } from "@heroui/react";
 import { useTranslation } from "react-i18next";
-import ConfirmIcon from "#/assets/confirm";
-import RejectIcon from "#/assets/reject";
 import { I18nKey } from "#/i18n/declaration";
+import { cn } from "#/utils/utils";
 
 interface ActionTooltipProps {
   type: "confirm" | "reject";
@@ -12,25 +11,35 @@ interface ActionTooltipProps {
 export function ActionTooltip({ type, onClick }: ActionTooltipProps) {
   const { t } = useTranslation();
 
-  const content =
-    type === "confirm"
-      ? t(I18nKey.CHAT_INTERFACE$USER_CONFIRMED)
-      : t(I18nKey.CHAT_INTERFACE$USER_REJECTED);
+  const isConfirm = type === "confirm";
+
+  const ariaLabel = isConfirm
+    ? t(I18nKey.ACTION$CONFIRM)
+    : t(I18nKey.ACTION$REJECT);
+
+  const content = isConfirm
+    ? t(I18nKey.CHAT_INTERFACE$USER_CONFIRMED)
+    : t(I18nKey.CHAT_INTERFACE$USER_REJECTED);
+
+  const buttonLabel = isConfirm
+    ? `${t(I18nKey.CHAT_INTERFACE$INPUT_CONTINUE_MESSAGE)} ⌘↩`
+    : `${t(I18nKey.BUTTON$CANCEL)} ⇧⌘⌫`;
 
   return (
     <Tooltip content={content} closeDelay={100}>
       <button
         data-testid={`action-${type}-button`}
         type="button"
-        aria-label={
+        aria-label={ariaLabel}
+        className={cn(
+          "rounded px-2 h-6.5 text-sm font-medium leading-5 cursor-pointer hover:opacity-80",
           type === "confirm"
-            ? t(I18nKey.ACTION$CONFIRM)
-            : t(I18nKey.ACTION$REJECT)
-        }
-        className="bg-tertiary rounded-full p-1 hover:bg-base-secondary"
+            ? "bg-tertiary text-white"
+            : "bg-white text-[#0D0F11]",
+        )}
         onClick={onClick}
       >
-        {type === "confirm" ? <ConfirmIcon /> : <RejectIcon />}
+        {buttonLabel}
       </button>
     </Tooltip>
   );

frontend/src/components/shared/buttons/confirmation-buttons.tsx

@@ -1,31 +1,120 @@
+import { useDispatch, useSelector } from "react-redux";
+import { useCallback, useEffect } from "react";
 import { useTranslation } from "react-i18next";
 import { I18nKey } from "#/i18n/declaration";
 import { AgentState } from "#/types/agent-state";
 import { generateAgentStateChangeEvent } from "#/services/agent-state-service";
 import { useWsClient } from "#/context/ws-client-provider";
 import { ActionTooltip } from "../action-tooltip";
+import { isOpenHandsAction } from "#/types/core/guards";
+import { ActionSecurityRisk } from "#/state/security-analyzer-slice";
+import { RiskAlert } from "#/components/shared/risk-alert";
+import WarningIcon from "#/icons/u-warning.svg?react";
+import { RootState } from "#/store";
+import { addSubmittedEventId } from "#/state/event-message-slice";
 
 export function ConfirmationButtons() {
-  const { t } = useTranslation();
-  const { send } = useWsClient();
+  const submittedEventIds = useSelector(
+    (state: RootState) => state.eventMessage.submittedEventIds,
+  );
 
-  const handleStateChange = (state: AgentState) => {
-    const event = generateAgentStateChangeEvent(state);
-    send(event);
-  };
+  const dispatch = useDispatch();
+
+  const { t } = useTranslation();
+
+  const { send, parsedEvents } = useWsClient();
+
+  // Find the most recent action awaiting confirmation
+  const awaitingAction = parsedEvents
+    .slice()
+    .reverse()
+    .find((ev) => {
+      if (!isOpenHandsAction(ev) || ev.source !== "agent") return false;
+      const args = ev.args as Record<string, unknown>;
+      return args?.confirmation_state === "awaiting_confirmation";
+    });
+
+  const handleStateChange = useCallback(
+    (state: AgentState) => {
+      if (!awaitingAction) {
+        return;
+      }
+
+      dispatch(addSubmittedEventId(awaitingAction.id));
+      send(generateAgentStateChangeEvent(state));
+    },
+    [send],
+  );
+
+  // Handle keyboard shortcuts
+  useEffect(() => {
+    if (!awaitingAction) {
+      return undefined;
+    }
+
+    const handleCancelShortcut = (event: KeyboardEvent) => {
+      if (event.shiftKey && event.metaKey && event.key === "Backspace") {
+        event.preventDefault();
+        handleStateChange(AgentState.USER_REJECTED);
+      }
+    };
+
+    const handleContinueShortcut = (event: KeyboardEvent) => {
+      if (event.metaKey && event.key === "Enter") {
+        event.preventDefault();
+        handleStateChange(AgentState.USER_CONFIRMED);
+      }
+    };
+
+    const handleKeyDown = (event: KeyboardEvent) => {
+      // Cancel: Shift+Cmd+Backspace (⇧⌘⌫)
+      handleCancelShortcut(event);
+      // Continue: Cmd+Enter (⌘↩)
+      handleContinueShortcut(event);
+    };
+
+    document.addEventListener("keydown", handleKeyDown);
+
+    return () => document.removeEventListener("keydown", handleKeyDown);
+  }, [awaitingAction, handleStateChange]);
+
+  if (!awaitingAction || submittedEventIds.includes(awaitingAction.id)) {
+    return null;
+  }
+
+  const { args } = awaitingAction as { args: Record<string, unknown> };
+
+  const risk = args?.security_risk;
+
+  const isHighRisk =
+    typeof risk === "string"
+      ? risk.toLowerCase() === "high"
+      : Number(risk) === ActionSecurityRisk.HIGH;
 
   return (
-    <div className="flex justify-between items-center pt-4">
-      <p>{t(I18nKey.CHAT_INTERFACE$USER_ASK_CONFIRMATION)}</p>
-      <div className="flex items-center gap-3">
-        <ActionTooltip
-          type="confirm"
-          onClick={() => handleStateChange(AgentState.USER_CONFIRMED)}
-        />
-        <ActionTooltip
-          type="reject"
-          onClick={() => handleStateChange(AgentState.USER_REJECTED)}
+    <div className="flex flex-col gap-2 pt-4">
+      {isHighRisk && (
+        <RiskAlert
+          content={t(I18nKey.CHAT_INTERFACE$HIGH_RISK_WARNING)}
+          icon={<WarningIcon width={16} height={16} color="#fff" />}
+          severity="high"
+          title={t(I18nKey.COMMON$HIGH_RISK)}
         />
+      )}
+      <div className="flex justify-between items-center">
+        <p className="text-sm font-normal text-white">
+          {t(I18nKey.CHAT_INTERFACE$USER_ASK_CONFIRMATION)}
+        </p>
+        <div className="flex items-center gap-3">
+          <ActionTooltip
+            type="reject"
+            onClick={() => handleStateChange(AgentState.USER_REJECTED)}
+          />
+          <ActionTooltip
+            type="confirm"
+            onClick={() => handleStateChange(AgentState.USER_CONFIRMED)}
+          />
+        </div>
       </div>
     </div>
   );

frontend/src/components/shared/modals/security/invariant/invariant.tsx

@@ -93,14 +93,14 @@ function SecurityInvariant() {
     (risk: ActionSecurityRisk) => {
       switch (risk) {
         case ActionSecurityRisk.LOW:
-          return t(I18nKey.SECURITY_ANALYZER$LOW_RISK);
+          return t(I18nKey.SECURITY$LOW_RISK);
         case ActionSecurityRisk.MEDIUM:
-          return t(I18nKey.SECURITY_ANALYZER$MEDIUM_RISK);
+          return t(I18nKey.SECURITY$MEDIUM_RISK);
         case ActionSecurityRisk.HIGH:
-          return t(I18nKey.SECURITY_ANALYZER$HIGH_RISK);
+          return t(I18nKey.SECURITY$HIGH_RISK);
         case ActionSecurityRisk.UNKNOWN:
         default:
-          return t(I18nKey.SECURITY_ANALYZER$UNKNOWN_RISK);
+          return t(I18nKey.SECURITY$UNKNOWN_RISK);
       }
     },
     [t],

frontend/src/components/shared/risk-alert.tsx

@@ -0,0 +1,36 @@
+import { ReactNode } from "react";
+import { cn } from "#/utils/utils";
+
+interface RiskAlertProps {
+  className?: string;
+  content: ReactNode;
+  icon?: ReactNode;
+  severity: "high" | "medium" | "low";
+  title: string;
+}
+
+export function RiskAlert({
+  className,
+  content,
+  icon,
+  severity,
+  title,
+}: RiskAlertProps) {
+  // Currently, we are only supporting the high risk alert. If we use want to support other risk levels, we can add them here and use cva to create different variants of this component.
+  if (severity === "high") {
+    return (
+      <div
+        className={cn(
+          "flex items-center gap-3.5 bg-[#4A0709] border border-[#FF0006] text-red-400 rounded-xl px-3.5 h-13 text-sm text-white",
+          className,
+        )}
+      >
+        {icon && <span className="">{icon}</span>}
+        <span className="font-bold">{title}</span>
+        <span className="font-normal">{content}</span>
+      </div>
+    );
+  }
+
+  return null;
+}

frontend/src/context/conversation-subscriptions-provider.tsx

@@ -33,6 +33,7 @@ interface ConversationSubscriptionsContextType {
     sessionApiKey: string | null;
     providersSet: ("github" | "gitlab" | "bitbucket" | "enterprise_sso")[];
     baseUrl: string;
+    socketPath?: string;
     onEvent?: (event: unknown, conversationId: string) => void;
   }) => void;
   unsubscribeFromConversation: (conversationId: string) => void;
@@ -95,10 +96,10 @@ export function ConversationSubscriptionsProvider({
     [],
   );
 
-  const unsubscribeFromConversation = useCallback(
-    (conversationId: string) => {
-      // Get a local reference to the socket data to avoid race conditions
-      const socketData = conversationSockets[conversationId];
+  const unsubscribeFromConversation = useCallback((conversationId: string) => {
+    // Use functional update to access current socket data and perform cleanup
+    setConversationSockets((prev) => {
+      const socketData = prev[conversationId];
 
       if (socketData) {
         const { socket } = socketData;
@@ -112,24 +113,23 @@ export function ConversationSubscriptionsProvider({
           socket.disconnect();
         }
 
-        // Update state to remove the socket
-        setConversationSockets((prev) => {
-          const newSockets = { ...prev };
-          delete newSockets[conversationId];
-          return newSockets;
-        });
-
-        // Remove from active IDs
-        setActiveConversationIds((prev) =>
-          prev.filter((id) => id !== conversationId),
-        );
-
         // Clean up event handler reference
         delete eventHandlersRef.current[conversationId];
+
+        // Remove the socket from state
+        const newSockets = { ...prev };
+        delete newSockets[conversationId];
+        return newSockets;
       }
-    },
-    [conversationSockets],
-  );
+
+      return prev; // No change if socket not found
+    });
+
+    // Remove from active IDs
+    setActiveConversationIds((prev) =>
+      prev.filter((id) => id !== conversationId),
+    );
+  }, []);
 
   const subscribeToConversation = useCallback(
     (options: {
@@ -137,10 +137,17 @@ export function ConversationSubscriptionsProvider({
       sessionApiKey: string | null;
       providersSet: ("github" | "gitlab" | "bitbucket" | "enterprise_sso")[];
       baseUrl: string;
+      socketPath?: string;
       onEvent?: (event: unknown, conversationId: string) => void;
     }) => {
-      const { conversationId, sessionApiKey, providersSet, baseUrl, onEvent } =
-        options;
+      const {
+        conversationId,
+        sessionApiKey,
+        providersSet,
+        baseUrl,
+        socketPath,
+        onEvent,
+      } = options;
 
       // If already subscribed, don't create a new subscription
       if (conversationSockets[conversationId]) {
@@ -173,9 +180,7 @@ export function ConversationSubscriptionsProvider({
         if (isErrorEvent(event) || isAgentStatusError(event)) {
           renderConversationErroredToast(
             conversationId,
-            isErrorEvent(event)
-              ? event.message
-              : "Unknown error, please try again",
+            isErrorEvent(event) ? event.message : "MICROAGENT$UNKNOWN_ERROR",
           );
         } else if (isStatusUpdate(event)) {
           if (event.type === "info" && event.id === "STATUS$STARTING_RUNTIME") {
@@ -199,6 +204,7 @@ export function ConversationSubscriptionsProvider({
         // Create socket connection
         const socket = io(baseUrl, {
           transports: ["websocket"],
+          path: socketPath ?? "/socket.io",
           query: {
             conversation_id: conversationId,
             session_api_key: sessionApiKey,

frontend/src/context/ws-client-provider.tsx

@@ -317,15 +317,24 @@ export function WsClientProvider({
       session_api_key: conversation.session_api_key, // Have to set here because socketio doesn't support custom headers. :(
     };
 
-    let baseUrl = null;
+    let baseUrl: string | null = null;
+    let socketPath: string;
     if (conversation.url && !conversation.url.startsWith("/")) {
-      baseUrl = new URL(conversation.url).host;
+      const u = new URL(conversation.url);
+      baseUrl = u.host;
+      const pathBeforeApi = u.pathname.split("/api/conversations")[0] || "/";
+      // Socket.IO server default path is /socket.io; prefix with pathBeforeApi for path mode
+      socketPath = `${pathBeforeApi.replace(/\/$/, "")}/socket.io`;
     } else {
-      baseUrl = import.meta.env.VITE_BACKEND_BASE_URL || window?.location.host;
+      baseUrl =
+        (import.meta.env.VITE_BACKEND_BASE_URL as string | undefined) ||
+        window?.location.host;
+      socketPath = "/socket.io";
     }
 
     sio = io(baseUrl, {
       transports: ["websocket"],
+      path: socketPath,
       query,
     });
 

frontend/src/hooks/mutation/use-save-settings.ts

@@ -19,6 +19,8 @@ const saveSettingsMutationFn = async (settings: Partial<PostSettings>) => {
         : settings.llm_api_key?.trim() || undefined,
     remote_runtime_resource_factor: settings.REMOTE_RUNTIME_RESOURCE_FACTOR,
     enable_default_condenser: settings.ENABLE_DEFAULT_CONDENSER,
+    condenser_max_size:
+      settings.CONDENSER_MAX_SIZE ?? DEFAULT_SETTINGS.CONDENSER_MAX_SIZE,
     enable_sound_notifications: settings.ENABLE_SOUND_NOTIFICATIONS,
     user_consents_to_analytics: settings.user_consents_to_analytics,
     provider_tokens_set: settings.PROVIDER_TOKENS_SET,

frontend/src/hooks/query/use-settings.ts

@@ -22,6 +22,8 @@ const getSettingsQueryFn = async (): Promise<Settings> => {
     REMOTE_RUNTIME_RESOURCE_FACTOR: apiSettings.remote_runtime_resource_factor,
     PROVIDER_TOKENS_SET: apiSettings.provider_tokens_set,
     ENABLE_DEFAULT_CONDENSER: apiSettings.enable_default_condenser,
+    CONDENSER_MAX_SIZE:
+      apiSettings.condenser_max_size ?? DEFAULT_SETTINGS.CONDENSER_MAX_SIZE,
     ENABLE_SOUND_NOTIFICATIONS: apiSettings.enable_sound_notifications,
     ENABLE_PROACTIVE_CONVERSATION_STARTERS:
       apiSettings.enable_proactive_conversation_starters,

frontend/src/hooks/use-create-conversation-and-subscribe-multiple.ts

@@ -1,14 +1,27 @@
 import React from "react";
+import { useQueries, type Query } from "@tanstack/react-query";
+import toast from "react-hot-toast";
+import { AxiosError } from "axios";
 import { useCreateConversation } from "./mutation/use-create-conversation";
 import { useUserProviders } from "./use-user-providers";
 import { useConversationSubscriptions } from "#/context/conversation-subscriptions-provider";
 import { Provider } from "#/types/settings";
-import { CreateMicroagent } from "#/api/open-hands.types";
+import { CreateMicroagent, Conversation } from "#/api/open-hands.types";
+import OpenHands from "#/api/open-hands";
+import { renderConversationStartingToast } from "#/components/features/chat/microagent/microagent-status-toast";
+
+interface ConversationData {
+  conversationId: string;
+  sessionApiKey: string | null;
+  baseUrl: string;
+  socketPath: string;
+  onEventCallback?: (event: unknown, conversationId: string) => void;
+}
 
 /**
  * Custom hook to create a conversation and subscribe to it, supporting multiple subscriptions.
- * This extends the functionality of useCreateConversationAndSubscribe to allow subscribing to
- * multiple conversations simultaneously.
+ * This version waits for conversation status to be "RUNNING" before establishing WebSocket connection.
+ * Shows immediate toast feedback and polls conversation status until ready.
  */
 export const useCreateConversationAndSubscribeMultiple = () => {
   const { mutate: createConversation, isPending } = useCreateConversation();
@@ -20,6 +33,88 @@ export const useCreateConversationAndSubscribeMultiple = () => {
     activeConversationIds,
   } = useConversationSubscriptions();
 
+  // Store conversation data immediately after creation
+  const [createdConversations, setCreatedConversations] = React.useState<
+    Record<string, ConversationData>
+  >({});
+
+  // Get conversation IDs that need polling
+  const conversationIdsToWatch = Object.keys(createdConversations);
+
+  // Poll each conversation until it's ready
+  const conversationQueries = useQueries({
+    queries: conversationIdsToWatch.map((conversationId) => ({
+      queryKey: ["conversation-ready-poll", conversationId],
+      queryFn: () => OpenHands.getConversation(conversationId),
+      enabled: !!conversationId,
+      refetchInterval: (query: Query<Conversation | null, AxiosError>) => {
+        const status = query.state.data?.status;
+        if (status === "STARTING") {
+          return 3000; // Poll every 3 seconds while STARTING
+        }
+        return false; // Stop polling once not STARTING
+      },
+      retry: false,
+    })),
+  });
+
+  // Extract stable values from queries for dependency array
+  const queryStatuses = conversationQueries.map((query) => query.data?.status);
+  const queryDataExists = conversationQueries.map((query) => !!query.data);
+
+  // Effect to handle subscription when conversations are ready
+  React.useEffect(() => {
+    conversationQueries.forEach((query, index) => {
+      const conversationId = conversationIdsToWatch[index];
+      const conversationData = createdConversations[conversationId];
+
+      if (!query.data || !conversationData) return;
+
+      const { status, url, session_api_key: sessionApiKey } = query.data;
+
+      let { baseUrl } = conversationData;
+      if (url && !url.startsWith("/")) {
+        baseUrl = new URL(url).host;
+      }
+
+      if (status === "RUNNING") {
+        // Conversation is ready - subscribe to WebSocket
+        subscribeToConversation({
+          conversationId,
+          sessionApiKey,
+          providersSet: providers,
+          baseUrl,
+          socketPath: conversationData.socketPath,
+          onEvent: conversationData.onEventCallback,
+        });
+
+        // Remove from created conversations (cleanup)
+        setCreatedConversations((prev) => {
+          const newCreated = { ...prev };
+          delete newCreated[conversationId];
+          return newCreated;
+        });
+      } else if (status === "STOPPED") {
+        // Dismiss the starting toast
+        toast.dismiss(`starting-${conversationId}`);
+
+        // Remove from created conversations (cleanup)
+        setCreatedConversations((prev) => {
+          const newCreated = { ...prev };
+          delete newCreated[conversationId];
+          return newCreated;
+        });
+      }
+    });
+  }, [
+    queryStatuses,
+    queryDataExists,
+    conversationIdsToWatch,
+    createdConversations,
+    subscribeToConversation,
+    providers,
+  ]);
+
   const createConversationAndSubscribe = React.useCallback(
     ({
       query,
@@ -49,33 +144,46 @@ export const useCreateConversationAndSubscribeMultiple = () => {
         },
         {
           onSuccess: (data) => {
+            // Show immediate toast to let user know something is happening
+            renderConversationStartingToast(data.conversation_id);
+
+            // Call the success callback immediately
+            if (onSuccessCallback) {
+              onSuccessCallback(data.conversation_id);
+            }
+
+            // Only handle immediate post-creation tasks here
             let baseUrl = "";
+            let socketPath: string;
             if (data?.url && !data.url.startsWith("/")) {
-              baseUrl = new URL(data.url).host;
+              const u = new URL(data.url);
+              baseUrl = u.host;
+              const pathBeforeApi =
+                u.pathname.split("/api/conversations")[0] || "/";
+              socketPath = `${pathBeforeApi.replace(/\/$/, "")}/socket.io`;
             } else {
               baseUrl =
                 (import.meta.env.VITE_BACKEND_BASE_URL as string | undefined) ||
                 window?.location.host;
+              socketPath = "/socket.io";
             }
 
-            // Subscribe to the conversation
-            subscribeToConversation({
-              conversationId: data.conversation_id,
-              sessionApiKey: data.session_api_key,
-              providersSet: providers,
-              baseUrl,
-              onEvent: onEventCallback,
-            });
-
-            // Call the success callback if provided
-            if (onSuccessCallback) {
-              onSuccessCallback(data.conversation_id);
-            }
+            // Store conversation data for polling and eventual subscription
+            setCreatedConversations((prev) => ({
+              ...prev,
+              [data.conversation_id]: {
+                conversationId: data.conversation_id,
+                sessionApiKey: data.session_api_key,
+                baseUrl,
+                socketPath,
+                onEventCallback,
+              },
+            }));
           },
         },
       );
     },
-    [createConversation, subscribeToConversation, providers],
+    [createConversation],
   );
 
   return {

frontend/src/i18n/declaration.ts

@@ -97,6 +97,8 @@ export enum I18nKey {
   SETTINGS$BASE_URL = "SETTINGS$BASE_URL",
   SETTINGS$AGENT = "SETTINGS$AGENT",
   SETTINGS$ENABLE_MEMORY_CONDENSATION = "SETTINGS$ENABLE_MEMORY_CONDENSATION",
+  SETTINGS$CONDENSER_MAX_SIZE = "SETTINGS$CONDENSER_MAX_SIZE",
+  SETTINGS$CONDENSER_MAX_SIZE_TOOLTIP = "SETTINGS$CONDENSER_MAX_SIZE_TOOLTIP",
   SETTINGS$LANGUAGE = "SETTINGS$LANGUAGE",
   ACTION$PUSH_TO_BRANCH = "ACTION$PUSH_TO_BRANCH",
   ACTION$PUSH_CREATE_PR = "ACTION$PUSH_CREATE_PR",
@@ -326,6 +328,7 @@ export enum I18nKey {
   USER$ACCOUNT_SETTINGS = "USER$ACCOUNT_SETTINGS",
   JUPYTER$OUTPUT_LABEL = "JUPYTER$OUTPUT_LABEL",
   BUTTON$STOP = "BUTTON$STOP",
+  BUTTON$PAUSE = "BUTTON$PAUSE",
   BUTTON$EDIT_TITLE = "BUTTON$EDIT_TITLE",
   BUTTON$DOWNLOAD_VIA_VSCODE = "BUTTON$DOWNLOAD_VIA_VSCODE",
   BUTTON$DISPLAY_COST = "BUTTON$DISPLAY_COST",
@@ -337,6 +340,8 @@ export enum I18nKey {
   LANDING$RECENT_CONVERSATION = "LANDING$RECENT_CONVERSATION",
   CONVERSATION$CONFIRM_DELETE = "CONVERSATION$CONFIRM_DELETE",
   CONVERSATION$CONFIRM_STOP = "CONVERSATION$CONFIRM_STOP",
+  CONVERSATION$CONFIRM_PAUSE = "CONVERSATION$CONFIRM_PAUSE",
+  CONVERSATION$PAUSE_WARNING = "CONVERSATION$PAUSE_WARNING",
   CONVERSATION$STOP_WARNING = "CONVERSATION$STOP_WARNING",
   CONVERSATION$METRICS_INFO = "CONVERSATION$METRICS_INFO",
   CONVERSATION$CREATED = "CONVERSATION$CREATED",
@@ -357,6 +362,7 @@ export enum I18nKey {
   CHAT_INTERFACE$INPUT_PLACEHOLDER = "CHAT_INTERFACE$INPUT_PLACEHOLDER",
   CHAT_INTERFACE$INPUT_CONTINUE_MESSAGE = "CHAT_INTERFACE$INPUT_CONTINUE_MESSAGE",
   CHAT_INTERFACE$USER_ASK_CONFIRMATION = "CHAT_INTERFACE$USER_ASK_CONFIRMATION",
+  CHAT_INTERFACE$HIGH_RISK_WARNING = "CHAT_INTERFACE$HIGH_RISK_WARNING",
   CHAT_INTERFACE$USER_CONFIRMED = "CHAT_INTERFACE$USER_CONFIRMED",
   CHAT_INTERFACE$USER_REJECTED = "CHAT_INTERFACE$USER_REJECTED",
   CHAT_INTERFACE$INPUT_SEND_MESSAGE_BUTTON_CONTENT = "CHAT_INTERFACE$INPUT_SEND_MESSAGE_BUTTON_CONTENT",
@@ -371,10 +377,6 @@ export enum I18nKey {
   CHAT_INTERFACE$MESSAGE_ARIA_LABEL = "CHAT_INTERFACE$MESSAGE_ARIA_LABEL",
   CHAT_INTERFACE$CHAT_CONVERSATION = "CHAT_INTERFACE$CHAT_CONVERSATION",
   CHAT_INTERFACE$UNKNOWN_SENDER = "CHAT_INTERFACE$UNKNOWN_SENDER",
-  SECURITY_ANALYZER$UNKNOWN_RISK = "SECURITY_ANALYZER$UNKNOWN_RISK",
-  SECURITY_ANALYZER$LOW_RISK = "SECURITY_ANALYZER$LOW_RISK",
-  SECURITY_ANALYZER$MEDIUM_RISK = "SECURITY_ANALYZER$MEDIUM_RISK",
-  SECURITY_ANALYZER$HIGH_RISK = "SECURITY_ANALYZER$HIGH_RISK",
   SETTINGS$MODEL_TOOLTIP = "SETTINGS$MODEL_TOOLTIP",
   SETTINGS$AGENT_TOOLTIP = "SETTINGS$AGENT_TOOLTIP",
   SETTINGS$LANGUAGE_TOOLTIP = "SETTINGS$LANGUAGE_TOOLTIP",
@@ -385,9 +387,12 @@ export enum I18nKey {
   SETTINGS$REFRESH_LLM_API_KEY = "SETTINGS$REFRESH_LLM_API_KEY",
   SETTINGS$CONFIRMATION_MODE = "SETTINGS$CONFIRMATION_MODE",
   SETTINGS$CONFIRMATION_MODE_TOOLTIP = "SETTINGS$CONFIRMATION_MODE_TOOLTIP",
+  SETTINGS$CONFIRMATION_MODE_LOCK_TOOLTIP = "SETTINGS$CONFIRMATION_MODE_LOCK_TOOLTIP",
   SETTINGS$AGENT_SELECT_ENABLED = "SETTINGS$AGENT_SELECT_ENABLED",
   SETTINGS$SECURITY_ANALYZER = "SETTINGS$SECURITY_ANALYZER",
   SETTINGS$SECURITY_ANALYZER_PLACEHOLDER = "SETTINGS$SECURITY_ANALYZER_PLACEHOLDER",
+  SETTINGS$SECURITY_ANALYZER_TOOLTIP = "SETTINGS$SECURITY_ANALYZER_TOOLTIP",
+  SETTINGS$SECURITY_ANALYZER_DESCRIPTION = "SETTINGS$SECURITY_ANALYZER_DESCRIPTION",
   SETTINGS$DONT_KNOW_API_KEY = "SETTINGS$DONT_KNOW_API_KEY",
   SETTINGS$CLICK_FOR_INSTRUCTIONS = "SETTINGS$CLICK_FOR_INSTRUCTIONS",
   SETTINGS$SAVED = "SETTINGS$SAVED",
@@ -781,8 +786,6 @@ export enum I18nKey {
   PROJECT_MANAGEMENT$SVC_ACC_EMAIL_VALIDATION_ERROR = "PROJECT_MANAGEMENT$SVC_ACC_EMAIL_VALIDATION_ERROR",
   PROJECT_MANAGEMENT$SVC_ACC_API_KEY_VALIDATION_ERROR = "PROJECT_MANAGEMENT$SVC_ACC_API_KEY_VALIDATION_ERROR",
   MICROAGENT_MANAGEMENT$ERROR_LOADING_MICROAGENT_CONTENT = "MICROAGENT_MANAGEMENT$ERROR_LOADING_MICROAGENT_CONTENT",
-  SETTINGS$MCP_ERROR_ENV_INVALID_FORMAT = "SETTINGS$MCP_ERROR_ENV_INVALID_FORMAT",
-  SETTINGS$MCP_ERROR_URL_DUPLICATE = "SETTINGS$MCP_ERROR_URL_DUPLICATE",
   SETTINGS$MCP_SERVER_TYPE_SSE = "SETTINGS$MCP_SERVER_TYPE_SSE",
   SETTINGS$MCP_SERVER_TYPE_STDIO = "SETTINGS$MCP_SERVER_TYPE_STDIO",
   SETTINGS$MCP_SERVER_TYPE_SHTTP = "SETTINGS$MCP_SERVER_TYPE_SHTTP",
@@ -794,6 +797,8 @@ export enum I18nKey {
   SETTINGS$MCP_ERROR_NAME_DUPLICATE = "SETTINGS$MCP_ERROR_NAME_DUPLICATE",
   SETTINGS$MCP_ERROR_COMMAND_REQUIRED = "SETTINGS$MCP_ERROR_COMMAND_REQUIRED",
   SETTINGS$MCP_ERROR_COMMAND_NO_SPACES = "SETTINGS$MCP_ERROR_COMMAND_NO_SPACES",
+  SETTINGS$MCP_ERROR_URL_DUPLICATE = "SETTINGS$MCP_ERROR_URL_DUPLICATE",
+  SETTINGS$MCP_ERROR_ENV_INVALID_FORMAT = "SETTINGS$MCP_ERROR_ENV_INVALID_FORMAT",
   SETTINGS$MCP_SERVER_TYPE = "SETTINGS$MCP_SERVER_TYPE",
   SETTINGS$MCP_API_KEY_PLACEHOLDER = "SETTINGS$MCP_API_KEY_PLACEHOLDER",
   SETTINGS$MCP_COMMAND_ARGUMENTS = "SETTINGS$MCP_COMMAND_ARGUMENTS",
@@ -814,4 +819,13 @@ export enum I18nKey {
   MICROAGENT_MANAGEMENT$PR_READY_FOR_REVIEW = "MICROAGENT_MANAGEMENT$PR_READY_FOR_REVIEW",
   MICROAGENT_MANAGEMENT$PR_NOT_CREATED = "MICROAGENT_MANAGEMENT$PR_NOT_CREATED",
   MICROAGENT_MANAGEMENT$ERROR_CREATING_MICROAGENT = "MICROAGENT_MANAGEMENT$ERROR_CREATING_MICROAGENT",
+  MICROAGENT$STATUS_WAITING = "MICROAGENT$STATUS_WAITING",
+  MICROAGENT$UNKNOWN_ERROR = "MICROAGENT$UNKNOWN_ERROR",
+  MICROAGENT$CONVERSATION_STARTING = "MICROAGENT$CONVERSATION_STARTING",
+  MICROAGENT_MANAGEMENT$EXISTING_MICROAGENTS = "MICROAGENT_MANAGEMENT$EXISTING_MICROAGENTS",
+  MICROAGENT_MANAGEMENT$OPEN_MICROAGENT_PULL_REQUESTS = "MICROAGENT_MANAGEMENT$OPEN_MICROAGENT_PULL_REQUESTS",
+  SETTINGS$SECURITY_ANALYZER_LLM_DEFAULT = "SETTINGS$SECURITY_ANALYZER_LLM_DEFAULT",
+  SETTINGS$SECURITY_ANALYZER_NONE = "SETTINGS$SECURITY_ANALYZER_NONE",
+  SETTINGS$SECURITY_ANALYZER_INVARIANT = "SETTINGS$SECURITY_ANALYZER_INVARIANT",
+  COMMON$HIGH_RISK = "COMMON$HIGH_RISK",
 }

frontend/src/i18n/translation.json

@@ -432,68 +432,68 @@
     "uk": "Повторний вхід до OpenHands..."
   },
   "SECURITY$LOW_RISK": {
-    "en": "Low Risk",
-    "ja": "低リスク",
-    "zh-CN": "低风险",
-    "zh-TW": "低風險",
-    "ko-KR": "낮은 위험",
-    "no": "Lav risiko",
-    "it": "Rischio basso",
-    "pt": "Baixo risco",
-    "es": "Riesgo bajo",
-    "ar": "مخاطر منخفضة",
-    "fr": "Risque faible",
-    "tr": "Düşük risk",
-    "de": "Geringes Risiko",
-    "uk": "Низький ризик"
+    "en": "Risk: Low",
+    "ja": "リスク: 低",
+    "zh-CN": "风险: 低",
+    "zh-TW": "風險: 低",
+    "ko-KR": "위험: 낮음",
+    "no": "Risiko: Lav",
+    "it": "Rischio: Basso",
+    "pt": "Risco: Baixo",
+    "es": "Riesgo: Bajo",
+    "ar": "المخاطر: منخفضة",
+    "fr": "Risque : Faible",
+    "tr": "Risk: Düşük",
+    "de": "Risiko: Gering",
+    "uk": "Ризик: Низький"
   },
   "SECURITY$MEDIUM_RISK": {
-    "en": "Medium Risk",
-    "ja": "中リスク",
-    "zh-CN": "中等风险",
-    "zh-TW": "中等風險",
-    "ko-KR": "중간 위험",
-    "no": "Middels risiko",
-    "it": "Rischio medio",
-    "pt": "Risco médio",
-    "es": "Riesgo medio",
-    "ar": "مخاطر متوسطة",
-    "fr": "Risque moyen",
-    "tr": "Orta risk",
-    "de": "Mittleres Risiko",
-    "uk": "Середній ризик"
+    "en": "Risk: Medium",
+    "ja": "リスク: 中",
+    "zh-CN": "风险: 中等",
+    "zh-TW": "風險: 中等",
+    "ko-KR": "위험: 중간",
+    "no": "Risiko: Middels",
+    "it": "Rischio: Medio",
+    "pt": "Risco: Médio",
+    "es": "Riesgo: Medio",
+    "ar": "المخاطر: متوسطة",
+    "fr": "Risque : Moyen",
+    "tr": "Risk: Orta",
+    "de": "Risiko: Mittel",
+    "uk": "Ризик: Середній"
   },
   "SECURITY$HIGH_RISK": {
-    "en": "High Risk",
-    "ja": "高リスク",
-    "zh-CN": "高风险",
-    "zh-TW": "高風險",
-    "ko-KR": "높은 위험",
-    "no": "Høy risiko",
-    "it": "Rischio alto",
-    "pt": "Alto risco",
-    "es": "Riesgo alto",
-    "ar": "مخاطر عالية",
-    "fr": "Risque élevé",
-    "tr": "Yüksek risk",
-    "de": "Hohes Risiko",
-    "uk": "Високий ризик"
+    "en": "Risk: High",
+    "ja": "リスク: 高",
+    "zh-CN": "风险: 高",
+    "zh-TW": "風險: 高",
+    "ko-KR": "위험: 높음",
+    "no": "Risiko: Høy",
+    "it": "Rischio: Alto",
+    "pt": "Risco: Alto",
+    "es": "Riesgo: Alto",
+    "ar": "المخاطر: عالية",
+    "fr": "Risque : Élevé",
+    "tr": "Risk: Yüksek",
+    "de": "Risiko: Hoch",
+    "uk": "Ризик: Високий"
   },
   "SECURITY$UNKNOWN_RISK": {
-    "en": "Unknown Risk",
-    "ja": "不明なリスク",
-    "zh-CN": "未知风险",
-    "zh-TW": "未知風險",
-    "ko-KR": "알 수 없는 위험",
-    "no": "Ukjent risiko",
-    "it": "Rischio sconosciuto",
-    "pt": "Risco desconhecido",
-    "es": "Riesgo desconocido",
-    "ar": "مخاطر غير معروفة",
-    "fr": "Risque inconnu",
-    "tr": "Bilinmeyen risk",
-    "de": "Unbekanntes Risiko",
-    "uk": "Невідомий ризик"
+    "en": "Risk: Unknown",
+    "ja": "リスク: 不明",
+    "zh-CN": "风险: 未知",
+    "zh-TW": "風險: 未知",
+    "ko-KR": "위험: 알 수 없음",
+    "no": "Risiko: Ukjent",
+    "it": "Rischio: Sconosciuto",
+    "pt": "Risco: Desconhecido",
+    "es": "Riesgo: Desconocido",
+    "ar": "المخاطر: غير معروفة",
+    "fr": "Risque : Inconnu",
+    "tr": "Risk: Bilinmeyen",
+    "de": "Risiko: Unbekannt",
+    "uk": "Ризик: Невідомий"
   },
   "FINISH$TASK_COMPLETED_SUCCESSFULLY": {
     "en": "I believe that the task was **completed successfully**.",
@@ -1551,6 +1551,38 @@
     "de": "Speicherkondensation aktivieren",
     "uk": "Увімкнути конденсацію пам'яті"
   },
+  "SETTINGS$CONDENSER_MAX_SIZE": {
+    "en": "Memory condenser max history size",
+    "ja": "メモリ凝縮の最大履歴サイズ",
+    "zh-CN": "内存凝缩最大历史大小",
+    "zh-TW": "記憶體凝縮最大歷史大小",
+    "ko-KR": "메모리 응축 최대 기록 크기",
+    "no": "Maks historikkstørrelse for minnekondenser",
+    "it": "Dimensione massima cronologia condensatore di memoria",
+    "pt": "Tamanho máximo do histórico do condensador de memória",
+    "es": "Tamaño máximo del historial del condensador de memoria",
+    "ar": "الحد الأقصى لحجم سجل مكثف الذاكرة",
+    "fr": "Taille maximale de l'historique du condenseur de mémoire",
+    "tr": "Bellek yoğunlaştırıcı maksimum geçmiş boyutu",
+    "de": "Maximale Verlaufgröße des Speicherkondensators",
+    "uk": "Максимальний розмір історії конденсатора пам'яті"
+  },
+  "SETTINGS$CONDENSER_MAX_SIZE_TOOLTIP": {
+    "en": "After this many events, the condenser will summarize history. Minimum 10.",
+    "ja": "このイベント数を超えると、凝縮器が履歴を要約します。最小 10。",
+    "zh-CN": "达到此事件数量后，凝缩器将汇总历史。最小 10。",
+    "zh-TW": "超過此事件數後，凝縮器會摘要歷史。最小 10。",
+    "ko-KR": "이 이벤트 수 이후 응축기가 기록을 요약합니다. 최소 10.",
+    "no": "Etter så mange hendelser vil kondenseren oppsummere historikken. Minimum 10.",
+    "it": "Dopo questo numero di eventi, il condensatore riassumerà la cronologia. Minimo 10.",
+    "pt": "Após esse número de eventos, o condensador irá resumir o histórico. Mínimo 10.",
+    "es": "Después de este número de eventos, el condensador resumirá el historial. Mínimo 10.",
+    "ar": "بعد هذا العدد من الأحداث، سيقوم المكثف بتلخيص السجل. الحد الأدنى 10.",
+    "fr": "Après ce nombre d'événements, le condenseur résumera l'historique. Minimum 10.",
+    "tr": "Bu kadar olaydan sonra yoğunlaştırıcı geçmişi özetler. En az 10.",
+    "de": "Nach so vielen Ereignissen fasst der Kondensator die Historie zusammen. Minimum 10.",
+    "uk": "Після цієї кількості подій конденсатор узагальнить історію. Мінімум 10."
+  },
   "SETTINGS$LANGUAGE": {
     "en": "Language",
     "ja": "言語",
@@ -2063,22 +2095,6 @@
     "de": "Git-Anbieter",
     "uk": "Git-провайдер"
   },
-  "ACCOUNT_SETTINGS$TITLE": {
-    "en": "Account Settings",
-    "ja": "アカウント設定",
-    "zh-CN": "账户设置",
-    "zh-TW": "帳戶設定",
-    "ko-KR": "계정 설정",
-    "no": "Kontoinnstillinger",
-    "it": "Impostazioni account",
-    "pt": "Configurações da conta",
-    "es": "Configuración de la cuenta",
-    "ar": "إعدادات الحساب",
-    "fr": "Paramètres du compte",
-    "tr": "Hesap ayarları",
-    "de": "Kontoeinstellungen",
-    "uk": "Налаштування облікового запису"
-  },
   "WORKSPACE$TERMINAL_TAB_LABEL": {
     "en": "Terminal",
     "zh-CN": "终端",
@@ -2432,20 +2448,20 @@
     "uk": "Git налаштування"
   },
   "SETTINGS$GIT_SETTINGS_DESCRIPTION": {
-    "en": "Configure Git integration settings",
-    "ja": "Git統合設定を構成する",
-    "zh-CN": "配置Git集成设置",
-    "zh-TW": "配置Git整合設定",
-    "ko-KR": "Git 통합 설정 구성",
-    "de": "Git-Integrationseinstellungen konfigurieren",
-    "no": "Konfigurer Git-integrasjonsinnstillinger",
-    "it": "Configura le impostazioni di integrazione Git",
-    "pt": "Configure as configurações de integração Git",
-    "es": "Configure los ajustes de integración Git",
-    "ar": "تكوين إعدادات تكامل Git",
-    "fr": "Configurer les paramètres d'intégration Git",
-    "tr": "Git entegrasyon ayarlarını yapılandırın",
-    "uk": "Налаштуйте параметри інтеграції Git"
+    "en": "Configure the username and email that OpenHands uses to commit changes.",
+    "ja": "OpenHandsがコミットに使用するユーザー名とメールを設定します。",
+    "zh-CN": "配置OpenHands用于提交更改的用户名和电子邮件。",
+    "zh-TW": "配置OpenHands用於提交更改的用戶名和電子郵件。",
+    "ko-KR": "OpenHands가 변경 사항을 커밋할 때 사용하는 사용자 이름과 이메일을 구성합니다.",
+    "de": "Konfigurieren Sie den Benutzernamen und die E-Mail, die OpenHands zum Committen von Änderungen verwendet.",
+    "no": "Konfigurer brukernavnet og e-posten som OpenHands bruker for å committe endringer.",
+    "it": "Configura il nome utente e l'email che OpenHands utilizza per committare le modifiche.",
+    "pt": "Configure o nome de usuário e o email que o OpenHands usa para fazer commits de alterações.",
+    "es": "Configure el nombre de usuario y el correo electrónico que OpenHands utiliza para confirmar cambios.",
+    "ar": "قم بتكوين اسم المستخدم والبريد الإلكتروني الذي يستخدمه OpenHands لارتكاب التغييرات.",
+    "fr": "Configurez le nom d'utilisateur et l'email qu'OpenHands utilise pour valider les modifications.",
+    "tr": "OpenHands'ın değişiklikleri commit etmek için kullandığı kullanıcı adını ve e-postayı yapılandırın.",
+    "uk": "Налаштуйте ім'я користувача та електронну пошту, які OpenHands використовує для фіксації змін."
   },
   "SETTINGS$SOUND_NOTIFICATIONS": {
     "en": "Sound Notifications",
@@ -2520,11 +2536,11 @@
     "de": "Lösbarkeitsanalyse aktivieren",
     "no": "Aktiver løsningsanalyse",
     "it": "Abilita analisi di risolvibilità",
-    "pt": "Ativar análise de resolubilidade",
-    "es": "Habilitar análisis de resolubilidad",
+    "pt": "Ativar análise de solucionabilidade",
+    "es": "Habilitar análisis de solvencia",
     "ar": "تمكين تحليل القابلية للحل",
-    "fr": "Activer l'analyse de résolvabilité",
-    "tr": "Çözülebilirlik analizini etkinleştir",
+    "fr": "Activer l'analyse de solvabilité",
+    "tr": "Çözünürlük Analizini Etkinleştir",
     "uk": "Увімкнути аналіз розв'язності"
   },
   "SETTINGS$SEARCH_API_KEY": {
@@ -5215,6 +5231,22 @@
     "tr": "Durdur",
     "uk": "Стоп"
   },
+  "BUTTON$PAUSE": {
+    "en": "Pause",
+    "ja": "一時停止",
+    "zh-CN": "暂停",
+    "zh-TW": "暫停",
+    "ko-KR": "일시정지",
+    "fr": "Mettre en pause",
+    "es": "Pausar",
+    "de": "Pausieren",
+    "it": "Pausa",
+    "pt": "Pausar",
+    "ar": "إيقاف مؤقت",
+    "no": "Pause",
+    "tr": "Duraklat",
+    "uk": "Призупинити"
+  },
   "BUTTON$EDIT_TITLE": {
     "en": "Edit Title",
     "ja": "タイトルを編集",
@@ -5391,8 +5423,40 @@
     "de": "Stopp bestätigen",
     "uk": "Підтвердити зупинку"
   },
+  "CONVERSATION$CONFIRM_PAUSE": {
+    "en": "Confirm Pause",
+    "ja": "一時停止の確認",
+    "zh-CN": "确认暂停",
+    "zh-TW": "確認暫停",
+    "ko-KR": "일시정지 확인",
+    "no": "Bekreft pause",
+    "it": "Conferma pausa",
+    "pt": "Confirmar pausa",
+    "es": "Confirmar pausa",
+    "ar": "تأكيد الإيقاف المؤقت",
+    "fr": "Confirmer la mise en pause",
+    "tr": "Duraklatmayı Onayla",
+    "de": "Pause bestätigen",
+    "uk": "Підтвердити призупинення"
+  },
+  "CONVERSATION$PAUSE_WARNING": {
+    "en": "Are you sure you want to pause this conversation?",
+    "ja": "この会話を一時停止してもよろしいですか？",
+    "zh-CN": "您确定要暂停此对话吗？",
+    "zh-TW": "您確定要暫停此對話嗎？",
+    "ko-KR": "이 대화를 일시정지하시겠습니까?",
+    "no": "Er du sikker på at du vil pause denne samtalen?",
+    "it": "Sei sicuro di voler mettere in pausa questa conversazione?",
+    "pt": "Tem certeza de que deseja pausar esta conversa?",
+    "es": "¿Está seguro de que desea pausar esta conversación?",
+    "ar": "هل أنت متأكد أنك تريد إيقاف هذه المحادثة مؤقتًا؟",
+    "fr": "Êtes-vous sûr de vouloir mettre cette conversation en pause ?",
+    "tr": "Bu konuşmayı duraklatmak istediğinizden emin misiniz?",
+    "de": "Sind Sie sicher, dass Sie dieses Gespräch pausieren möchten?",
+    "uk": "Ви впевнені, що хочете призупинити цю розмову?"
+  },
   "CONVERSATION$STOP_WARNING": {
-    "en": "Are you sure you want to stop this conversation?",
+    "en": "Are you sure you want to pause this conversation?",
     "ja": "この会話を停止してもよろしいですか？",
     "zh-CN": "您确定要停止此对话吗？",
     "zh-TW": "您確定要停止此對話嗎？",
@@ -5711,6 +5775,22 @@
     "ja": "このアクションを実行してもよろしいですか？",
     "uk": "Ви хочете продовжити цю дію?"
   },
+  "CHAT_INTERFACE$HIGH_RISK_WARNING": {
+    "en": "Review carefully before proceeding.",
+    "zh-CN": "在继续之前请仔细检查。",
+    "de": "Überprüfen Sie sorgfältig, bevor Sie fortfahren.",
+    "zh-TW": "在繼續之前請仔細檢查。",
+    "ko-KR": "계속하기 전에 신중히 검토하세요.",
+    "no": "Gå nøye gjennom før du fortsetter.",
+    "it": "Esamina attentamente prima di procedere.",
+    "pt": "Revise cuidadosamente antes de prosseguir.",
+    "es": "Revise cuidadosamente antes de continuar.",
+    "ar": "يرجى المراجعة بعناية قبل المتابعة.",
+    "fr": "Examinez attentivement avant de continuer.",
+    "tr": "Devam etmeden önce dikkatlice gözden geçirin.",
+    "ja": "続行する前に慎重に確認してください。",
+    "uk": "Уважно перевірте перед продовженням."
+  },
   "CHAT_INTERFACE$USER_CONFIRMED": {
     "en": "Confirm the requested action",
     "de": "Bestätigen Sie die angeforderte Aktion",
@@ -5935,70 +6015,6 @@
     "ja": "不明な送信者",
     "uk": "Невідомий"
   },
-  "SECURITY_ANALYZER$UNKNOWN_RISK": {
-    "en": "Unknown Risk",
-    "de": "Unbekanntes Risiko",
-    "zh-CN": "未知风险",
-    "ko-KR": "알 수 없는 위험",
-    "no": "Ukjent risiko",
-    "zh-TW": "未知風險",
-    "it": "Rischio sconosciuto",
-    "pt": "Risco desconhecido",
-    "es": "Riesgo desconocido",
-    "ar": "مخاطر غير معروفة",
-    "fr": "Risque inconnu",
-    "tr": "Bilinmeyen risk",
-    "ja": "不明なリスク",
-    "uk": "Невідомий ризик"
-  },
-  "SECURITY_ANALYZER$LOW_RISK": {
-    "en": "Low Risk",
-    "de": "Niedriges Risiko",
-    "zh-CN": "低风险",
-    "ko-KR": "낮은 위험",
-    "no": "Lav risiko",
-    "zh-TW": "低風險",
-    "it": "Rischio basso",
-    "pt": "Baixo risco",
-    "es": "Riesgo bajo",
-    "ar": "مخاطر منخفضة",
-    "fr": "Risque faible",
-    "tr": "Düşük risk",
-    "ja": "低リスク",
-    "uk": "Низький ризик"
-  },
-  "SECURITY_ANALYZER$MEDIUM_RISK": {
-    "en": "Medium Risk",
-    "de": "Mittleres Risiko",
-    "zh-CN": "中等风险",
-    "ko-KR": "중간 위험",
-    "no": "Middels risiko",
-    "zh-TW": "中等風險",
-    "it": "Rischio medio",
-    "pt": "Risco médio",
-    "es": "Riesgo medio",
-    "ar": "مخاطر متوسطة",
-    "fr": "Risque moyen",
-    "tr": "Orta risk",
-    "ja": "中リスク",
-    "uk": "Середній ризик"
-  },
-  "SECURITY_ANALYZER$HIGH_RISK": {
-    "en": "High Risk",
-    "de": "Hohes Risiko",
-    "zh-CN": "高风险",
-    "ko-KR": "높은 위험",
-    "no": "Høy risiko",
-    "zh-TW": "高風險",
-    "it": "Rischio elevato",
-    "pt": "Alto risco",
-    "es": "Riesgo alto",
-    "ar": "مخاطر عالية",
-    "fr": "Risque élevé",
-    "tr": "Yüksek risk",
-    "ja": "高リスク",
-    "uk": "Високий ризик"
-  },
   "SETTINGS$MODEL_TOOLTIP": {
     "en": "Select the language model to use.",
     "zh-CN": "选择要使用的语言模型",
@@ -6159,6 +6175,22 @@
     "ja": "エージェントのアクションを実行前に確認",
     "uk": "Очікує підтвердження користувача перед виконанням коду."
   },
+  "SETTINGS$CONFIRMATION_MODE_LOCK_TOOLTIP": {
+    "en": "The agent is in confirmation mode. It will prompt the user to confirm certain actions when security analyzer policy detected a high-risk action. Click this icon to go to settings tab for more information.",
+    "de": "Der Agent befindet sich im Bestätigungsmodus. Er wird den Benutzer auffordern, bestimmte Aktionen zu bestätigen, wenn die Sicherheitsanalysator-Richtlinie eine risikoreiche Aktion erkannt hat. Weitere Informationen finden Sie auf der Registerkarte Einstellungen.",
+    "zh-CN": "代理处于确认模式。当安全分析器策略检测到高风险操作时，它会提示用户确认某些操作。查看设置选项卡了解更多信息。",
+    "zh-TW": "代理處於確認模式。當安全分析器策略檢測到高風險操作時，它會提示使用者確認某些操作。查看設定選項卡了解更多資訊。",
+    "ko-KR": "에이전트가 확인 모드에 있습니다. 보안 분석기 정책이 고위험 작업을 감지하면 사용자에게 특정 작업을 확인하도록 요청합니다. 자세한 내용은 설정 탭을 확인하세요.",
+    "no": "Agenten er i bekreftelsesmodus. Den vil be brukeren om å bekrefte visse handlinger når sikkerhetsanalysatorpolitikken oppdager en høyrisiko-handling. Sjekk innstillingsfanen for mer informasjon.",
+    "it": "L'agente è in modalità di conferma. Chiederà all'utente di confermare certe azioni quando la politica dell'analizzatore di sicurezza rileva un'azione ad alto rischio. Controlla la scheda impostazioni per maggiori informazioni.",
+    "pt": "O agente está no modo de confirmação. Ele solicitará ao usuário que confirme certas ações quando a política do analisador de segurança detectar uma ação de alto risco. Verifique a aba de configurações para mais informações.",
+    "es": "El agente está en modo de confirmación. Solicitará al usuario que confirme ciertas acciones cuando la política del analizador de seguridad detecte una acción de alto riesgo. Consulte la pestaña de configuración para obtener más información.",
+    "ar": "الوكيل في وضع التأكيد. سيطلب من المستخدم تأكيد إجراءات معينة عندما تكتشف سياسة محلل الأمان إجراءً عالي المخاطر. تحقق من علامة تبويب الإعدادات للحصول على مزيد من المعلومات.",
+    "fr": "L'agent est en mode de confirmation. Il demandera à l'utilisateur de confirmer certaines actions lorsque la politique de l'analyseur de sécurité détecte une action à haut risque. Consultez l'onglet paramètres pour plus d'informations.",
+    "tr": "Ajan onay modunda. Güvenlik analizörü politikası yüksek riskli bir eylem tespit ettiğinde kullanıcıdan belirli eylemleri onaylamasını isteyecek. Daha fazla bilgi için ayarlar sekmesini kontrol edin.",
+    "ja": "エージェントは確認モードです。セキュリティアナライザーポリシーが高リスクアクションを検出した場合、特定のアクションの確認をユーザーに求めます。詳細については設定タブを確認してください。",
+    "uk": "Агент знаходиться в режимі підтвердження. Він попросить користувача підтвердити певні дії, коли політика аналізатора безпеки виявить дію високого ризику. Перевірте вкладку налаштувань для отримання додаткової інформації."
+  },
   "SETTINGS$AGENT_SELECT_ENABLED": {
     "en": "Enable Agent Selection - Advanced Users",
     "zh-CN": "启用智能体选择 - 高级用户",
@@ -6207,6 +6239,38 @@
     "ja": "セキュリティアナライザーを選択…",
     "uk": "Виберіть аналізатор безпеки…"
   },
+  "SETTINGS$SECURITY_ANALYZER_TOOLTIP": {
+    "en": "When enabled, the agent will pause and ask for confirmation when it tries to execute high-risk actions",
+    "de": "Wenn aktiviert, pausiert der Agent und fragt nach Bestätigung, wenn er versucht, risikoreiche Aktionen auszuführen",
+    "zh-CN": "启用后，代理在尝试执行高风险操作时会暂停并要求确认",
+    "zh-TW": "啟用後，代理在嘗試執行高風險操作時會暫停並要求確認",
+    "ko-KR": "활성화되면 에이전트가 고위험 작업을 실행하려고 할 때 일시 중지하고 확인을 요청합니다",
+    "no": "Når aktivert, vil agenten pause og be om bekreftelse når den prøver å utføre høyrisiko-handlinger",
+    "it": "Quando abilitato, l'agente si fermerà e chiederà conferma quando tenta di eseguire azioni ad alto rischio",
+    "pt": "Quando ativado, o agente pausará e pedirá confirmação quando tentar executar ações de alto risco",
+    "es": "Cuando está habilitado, el agente se pausará y pedirá confirmación cuando trate de ejecutar acciones de alto riesgo",
+    "ar": "عند التمكين، سيتوقف الوكيل ويطلب التأكيد عندما يحاول تنفيذ إجراءات عالية المخاطر",
+    "fr": "Lorsqu'il est activé, l'agent se mettra en pause et demandera confirmation lorsqu'il tentera d'exécuter des actions à haut risque",
+    "tr": "Etkinleştirildiğinde, ajan yüksek riskli eylemleri gerçekleştirmeye çalıştığında duraklar ve onay ister",
+    "ja": "有効にすると、エージェントは高リスクなアクションを実行しようとする際に一時停止し、確認を求めます",
+    "uk": "Коли увімкнено, агент зупиниться і попросить підтвердження, коли спробує виконати дії високого ризику"
+  },
+  "SETTINGS$SECURITY_ANALYZER_DESCRIPTION": {
+    "en": "The security analyzer will be used in conjunction with confirmation mode. By default, it utilizes LLM-predicted action risk to determine whether to prompt the user for confirmation. If the risk is HIGH, it will prompt the user for confirmation by default.",
+    "de": "Der Sicherheitsanalysator wird in Verbindung mit dem Bestätigungsmodus verwendet. Standardmäßig nutzt er LLM-vorhergesagtes Aktionsrisiko, um zu bestimmen, ob der Benutzer zur Bestätigung aufgefordert werden soll. Wenn das Risiko HOCH ist, wird er standardmäßig zur Bestätigung auffordern.",
+    "zh-CN": "安全分析器将与确认模式结合使用。默认情况下，它利用LLM预测的操作风险来确定是否提示用户确认。如果风险为高，它将默认提示用户确认。",
+    "zh-TW": "安全分析器將與確認模式結合使用。預設情況下，它利用LLM預測的操作風險來確定是否提示用戶確認。如果風險為高，它將預設提示用戶確認。",
+    "ko-KR": "보안 분석기는 확인 모드와 함께 사용됩니다. 기본적으로 LLM이 예측한 작업 위험을 활용하여 사용자에게 확인을 요청할지 결정합니다. 위험이 높으면 기본적으로 사용자에게 확인을 요청합니다.",
+    "no": "Sikkerhetsanalysatoren vil bli brukt i forbindelse med bekreftelsesmodus. Som standard bruker den LLM-forutsagt handlingsrisiko for å bestemme om brukeren skal bli bedt om bekreftelse. Hvis risikoen er HØY, vil den be om bekreftelse som standard.",
+    "it": "L'analizzatore di sicurezza verrà utilizzato insieme alla modalità di conferma. Per impostazione predefinita, utilizza il rischio di azione previsto dall'LLM per determinare se richiedere conferma all'utente. Se il rischio è ALTO, richiederà conferma per impostazione predefinita.",
+    "pt": "O analisador de segurança será usado em conjunto com o modo de confirmação. Por padrão, utiliza o risco de ação previsto pelo LLM para determinar se deve solicitar confirmação ao usuário. Se o risco for ALTO, solicitará confirmação por padrão.",
+    "es": "El analizador de seguridad se utilizará junto con el modo de confirmación. Por defecto, utiliza el riesgo de acción predicho por LLM para determinar si solicitar confirmación al usuario. Si el riesgo es ALTO, solicitará confirmación por defecto.",
+    "ar": "سيتم استخدام محلل الأمان بالتزامن مع وضع التأكيد. افتراضياً، يستخدم مخاطر الإجراء المتوقعة من LLM لتحديد ما إذا كان يجب مطالبة المستخدم بالتأكيد. إذا كان الخطر عالياً، فسيطالب بالتأكيد افتراضياً.",
+    "fr": "L'analyseur de sécurité sera utilisé en conjonction avec le mode de confirmation. Par défaut, il utilise le risque d'action prédit par LLM pour déterminer s'il faut demander confirmation à l'utilisateur. Si le risque est ÉLEVÉ, il demandera confirmation par défaut.",
+    "tr": "Güvenlik analizörü onay modu ile birlikte kullanılacaktır. Varsayılan olarak, kullanıcıdan onay istenip istenmeyeceğini belirlemek için LLM tarafından tahmin edilen eylem riskini kullanır. Risk YÜKSEK ise, varsayılan olarak kullanıcıdan onay isteyecektir.",
+    "ja": "セキュリティアナライザーは確認モードと組み合わせて使用されます。デフォルトでは、LLMが予測したアクションリスクを利用して、ユーザーに確認を求めるかどうかを決定します。リスクが高い場合、デフォルトでユーザーに確認を求めます。",
+    "uk": "Аналізатор безпеки буде використовуватися разом з режимом підтвердження. За замовчуванням він використовує передбачений LLM ризик дії для визначення, чи потрібно запитувати підтвердження у користувача. Якщо ризик ВИСОКИЙ, він запитуватиме підтвердження за замовчуванням."
+  },
   "SETTINGS$DONT_KNOW_API_KEY": {
     "en": "Don't know your API key?",
     "ja": "APIキーがわかりませんか？",
@@ -7583,22 +7647,6 @@
     "tr": "Ajan görevine devam et",
     "uk": "Відновити завдання агента"
   },
-  "ACTION_BUTTON$PAUSE": {
-    "en": "Pause the current task",
-    "zh-CN": "暂停",
-    "zh-TW": "暫停",
-    "ko-KR": "일시정지",
-    "ja": "一時停止",
-    "no": "Sett gjeldende oppgave på pause",
-    "ar": "إيقاف المهمة الحالية مؤقتاً",
-    "de": "Aktuelle Aufgabe pausieren",
-    "fr": "Mettre en pause la tâche actuelle",
-    "it": "Metti in pausa il compito corrente",
-    "pt": "Pausar a tarefa atual",
-    "es": "Pausar la tarea actual",
-    "tr": "Mevcut görevi duraklat",
-    "uk": "Призупинити поточне завдання"
-  },
   "BROWSER$SCREENSHOT_ALT": {
     "en": "Browser Screenshot",
     "zh-CN": "截图",
@@ -8207,22 +8255,6 @@
     "tr": "Kullanıcı avatarı yer tutucusu",
     "uk": "заповнювач аватара користувача"
   },
-  "ACCOUNT_SETTINGS$SETTINGS": {
-    "en": "Account Settings",
-    "ja": "アカウント設定",
-    "zh-CN": "账户设置",
-    "zh-TW": "帳戶設定",
-    "ko-KR": "계정 설정",
-    "no": "Kontoinnstillinger",
-    "it": "Impostazioni account",
-    "pt": "Configurações da conta",
-    "es": "Configuración de la cuenta",
-    "ar": "إعدادات الحساب",
-    "fr": "Paramètres du compte",
-    "tr": "Hesap ayarları",
-    "de": "Kontoeinstellungen",
-    "uk": "Налаштування облікового запису"
-  },
   "ACCOUNT_SETTINGS$LOGOUT": {
     "en": "Logout",
     "ja": "ログアウト",
@@ -9167,38 +9199,6 @@
     "tr": "Bekleme listesine katıl",
     "uk": "Приєднатися до списку очікування"
   },
-  "ACCOUNT_SETTINGS$ADDITIONAL_SETTINGS": {
-    "en": "Additional Settings",
-    "ja": "追加設定",
-    "zh-CN": "附加设置",
-    "zh-TW": "附加設定",
-    "ko-KR": "추가 설정",
-    "de": "Zusätzliche Einstellungen",
-    "no": "Ytterligere innstillinger",
-    "it": "Impostazioni aggiuntive",
-    "pt": "Configurações adicionais",
-    "es": "Configuraciones adicionales",
-    "ar": "إعدادات إضافية",
-    "fr": "Paramètres supplémentaires",
-    "tr": "Ek Ayarlar",
-    "uk": "Додаткові налаштування"
-  },
-  "ACCOUNT_SETTINGS$DISCONNECT_FROM_GITHUB": {
-    "en": "Disconnect from GitHub",
-    "ja": "GitHubから切断",
-    "zh-CN": "断开与GitHub的连接",
-    "zh-TW": "中斷與GitHub的連接",
-    "ko-KR": "GitHub 연결 해제",
-    "de": "Von GitHub trennen",
-    "no": "Koble fra GitHub",
-    "it": "Disconnetti da GitHub",
-    "pt": "Desconectar do GitHub",
-    "es": "Desconectar de GitHub",
-    "ar": "قطع الاتصال من GitHub",
-    "fr": "Se déconnecter de GitHub",
-    "tr": "GitHub'dan bağlantıyı kes",
-    "uk": "Відключитися від GitHub"
-  },
   "CONVERSATION$DELETE_WARNING": {
     "en": "Are you sure you want to delete this conversation? This action cannot be undone.",
     "ja": "この会話を削除してもよろしいですか？この操作は元に戻せません。",
@@ -11536,20 +11536,20 @@
     "uk": "Визначте тригери для мікроагента"
   },
   "MICROAGENT_MANAGEMENT$HELP_TEXT_DESCRIBING_VALID_TRIGGERS": {
-    "en": "Help text describing valid triggers.",
-    "ja": "有効なトリガーについて説明するヘルプテキスト。",
-    "zh-CN": "描述有效触发器的帮助文本。",
-    "zh-TW": "描述有效觸發條件的說明文字。",
-    "ko-KR": "유효한 트리거를 설명하는 도움말 텍스트입니다.",
-    "no": "Hjelpetekst som beskriver gyldige utløsere.",
-    "it": "Testo di aiuto che descrive i trigger validi.",
-    "pt": "Texto de ajuda descrevendo gatilhos válidos.",
-    "es": "Texto de ayuda que describe desencadenantes válidos.",
-    "ar": "نص المساعدة الذي يصف المشغلات الصالحة.",
-    "fr": "Texte d'aide décrivant les déclencheurs valides.",
-    "tr": "Geçerli tetikleyicileri açıklayan yardım metni.",
-    "de": "Hilfetext, der gültige Auslöser beschreibt.",
-    "uk": "Текст довідки, що описує дійсні тригери."
+    "en": "Enter a keyword that OpenHands will use to trigger this microagent (Optional).",
+    "ja": "OpenHandsがこのマイクロエージェントを起動するために使用するキーワードを入力してください（任意）。",
+    "zh-CN": "输入OpenHands将用于触发此微代理的关键字（可选）。",
+    "zh-TW": "輸入OpenHands將用於觸發此微代理的關鍵字（可選）。",
+    "ko-KR": "OpenHands가 이 마이크로에이전트를 트리거하는 데 사용할 키워드를 입력하세요(선택 사항).",
+    "no": "Skriv inn et nøkkelord som OpenHands vil bruke for å utløse denne mikroagenten (valgfritt).",
+    "it": "Inserisci una parola chiave che OpenHands userà per attivare questo microagent (opzionale).",
+    "pt": "Digite uma palavra-chave que o OpenHands usará para acionar este microagente (Opcional).",
+    "es": "Introduce una palabra clave que OpenHands usará para activar este microagente (Opcional).",
+    "ar": "أدخل كلمة مفتاحية سيستخدمها OpenHands لتشغيل هذا الوكيل الصغير (اختياري).",
+    "fr": "Entrez un mot-clé qu'OpenHands utilisera pour déclencher ce microagent (facultatif).",
+    "tr": "OpenHands'ın bu mikro ajanı tetiklemek için kullanacağı bir anahtar kelime girin (İsteğe bağlı).",
+    "de": "Geben Sie ein Schlüsselwort ein, das OpenHands verwendet, um diesen Microagenten auszulösen (optional).",
+    "uk": "Введіть ключове слово, яке OpenHands використовуватиме для запуску цього мікроагента (необов'язково)."
   },
   "COMMON$FOR_EXAMPLE": {
     "en": "For example",
@@ -12495,38 +12495,6 @@
     "de": "Fehler beim Laden des Microagent-Inhalts.",
     "uk": "Помилка під час завантаження вмісту мікроагента."
   },
-  "SETTINGS$MCP_ERROR_ENV_INVALID_FORMAT": {
-    "en": "Environment variables must follow KEY=value format",
-    "ja": "Environment variables must follow KEY=value format",
-    "zh-CN": "Environment variables must follow KEY=value format",
-    "zh-TW": "Environment variables must follow KEY=value format",
-    "ko-KR": "Environment variables must follow KEY=value format",
-    "no": "Environment variables must follow KEY=value format",
-    "it": "Environment variables must follow KEY=value format",
-    "pt": "Environment variables must follow KEY=value format",
-    "es": "Environment variables must follow KEY=value format",
-    "ar": "Environment variables must follow KEY=value format",
-    "fr": "Environment variables must follow KEY=value format",
-    "tr": "Environment variables must follow KEY=value format",
-    "de": "Environment variables must follow KEY=value format",
-    "uk": "Environment variables must follow KEY=value format"
-  },
-  "SETTINGS$MCP_ERROR_URL_DUPLICATE": {
-    "en": "A server with this URL already exists for the selected type",
-    "ja": "A server with this URL already exists for the selected type",
-    "zh-CN": "A server with this URL already exists for the selected type",
-    "zh-TW": "A server with this URL already exists for the selected type",
-    "ko-KR": "A server with this URL already exists for the selected type",
-    "no": "A server with this URL already exists for the selected type",
-    "it": "A server with this URL already exists for the selected type",
-    "pt": "A server with this URL already exists for the selected type",
-    "es": "A server with this URL already exists for the selected type",
-    "ar": "A server with this URL already exists for the selected type",
-    "fr": "A server with this URL already exists for the selected type",
-    "tr": "A server with this URL already exists for the selected type",
-    "de": "A server with this URL already exists for the selected type",
-    "uk": "A server with this URL already exists for the selected type"
-  },
   "SETTINGS$MCP_SERVER_TYPE_SSE": {
     "en": "SSE",
     "ja": "SSE",
@@ -12703,6 +12671,38 @@
     "de": "Befehl darf keine Leerzeichen enthalten",
     "uk": "Команда не може містити пробіли"
   },
+  "SETTINGS$MCP_ERROR_URL_DUPLICATE": {
+    "en": "A server with this URL already exists for the selected type",
+    "ja": "A server with this URL already exists for the selected type",
+    "zh-CN": "A server with this URL already exists for the selected type",
+    "zh-TW": "A server with this URL already exists for the selected type",
+    "ko-KR": "A server with this URL already exists for the selected type",
+    "no": "A server with this URL already exists for the selected type",
+    "it": "A server with this URL already exists for the selected type",
+    "pt": "A server with this URL already exists for the selected type",
+    "es": "A server with this URL already exists for the selected type",
+    "ar": "A server with this URL already exists for the selected type",
+    "fr": "A server with this URL already exists for the selected type",
+    "tr": "A server with this URL already exists for the selected type",
+    "de": "A server with this URL already exists for the selected type",
+    "uk": "A server with this URL already exists for the selected type"
+  },
+  "SETTINGS$MCP_ERROR_ENV_INVALID_FORMAT": {
+    "en": "Environment variables must follow KEY=value format",
+    "ja": "Environment variables must follow KEY=value format",
+    "zh-CN": "Environment variables must follow KEY=value format",
+    "zh-TW": "Environment variables must follow KEY=value format",
+    "ko-KR": "Environment variables must follow KEY=value format",
+    "no": "Environment variables must follow KEY=value format",
+    "it": "Environment variables must follow KEY=value format",
+    "pt": "Environment variables must follow KEY=value format",
+    "es": "Environment variables must follow KEY=value format",
+    "ar": "Environment variables must follow KEY=value format",
+    "fr": "Environment variables must follow KEY=value format",
+    "tr": "Environment variables must follow KEY=value format",
+    "de": "Environment variables must follow KEY=value format",
+    "uk": "Environment variables must follow KEY=value format"
+  },
   "SETTINGS$MCP_SERVER_TYPE": {
     "en": "Server Type",
     "ja": "サーバータイプ",
@@ -13022,5 +13022,149 @@
     "tr": "Bir şeyler ters gitti. Mikro ajanı tekrar başlatmayı deneyin.",
     "de": "Etwas ist schiefgelaufen. Versuchen Sie, den Microagenten erneut zu starten.",
     "uk": "Щось пішло не так. Спробуйте ініціювати мікроагента ще раз."
+  },
+  "MICROAGENT$STATUS_WAITING": {
+    "en": "Waiting for runtime to start...",
+    "ja": "ランタイムの開始を待機中...",
+    "zh-CN": "等待运行时启动...",
+    "zh-TW": "等待運行時啟動...",
+    "ko-KR": "런타임 시작을 기다리는 중...",
+    "no": "Venter på at runtime skal starte...",
+    "it": "In attesa dell'avvio del runtime...",
+    "pt": "Aguardando o runtime iniciar...",
+    "es": "Esperando que inicie el runtime...",
+    "ar": "في انتظار بدء وقت التشغيل...",
+    "fr": "En attente du démarrage du runtime...",
+    "tr": "Çalışma zamanının başlaması bekleniyor...",
+    "de": "Warten auf den Start der Laufzeit...",
+    "uk": "Очікування запуску середовища виконання..."
+  },
+  "MICROAGENT$UNKNOWN_ERROR": {
+    "en": "Unknown error, please try again",
+    "ja": "不明なエラーです。もう一度お試しください",
+    "zh-CN": "未知错误，请重试",
+    "zh-TW": "未知錯誤，請重試",
+    "ko-KR": "알 수 없는 오류입니다. 다시 시도해 주세요",
+    "no": "Ukjent feil, vennligst prøv igjen",
+    "it": "Errore sconosciuto, riprova",
+    "pt": "Erro desconhecido, tente novamente",
+    "es": "Error desconocido, inténtalo de nuevo",
+    "ar": "خطأ غير معروف، يرجى المحاولة مرة أخرى",
+    "fr": "Erreur inconnue, veuillez réessayer",
+    "tr": "Bilinmeyen hata, lütfen tekrar deneyin",
+    "de": "Unbekannter Fehler, bitte versuchen Sie es erneut",
+    "uk": "Невідома помилка, спробуйте ще раз"
+  },
+  "MICROAGENT$CONVERSATION_STARTING": {
+    "en": "Starting conversation...",
+    "ja": "会話を開始しています...",
+    "zh-CN": "正在开始对话...",
+    "zh-TW": "正在開始對話...",
+    "ko-KR": "대화를 시작하는 중...",
+    "no": "Starter samtale...",
+    "it": "Avvio conversazione...",
+    "pt": "Iniciando conversa...",
+    "es": "Iniciando conversación...",
+    "ar": "بدء المحادثة...",
+    "fr": "Démarrage de la conversation...",
+    "tr": "Konuşma başlatılıyor...",
+    "de": "Gespräch wird gestartet...",
+    "uk": "Розпочинається розмова..."
+  },
+  "MICROAGENT_MANAGEMENT$EXISTING_MICROAGENTS": {
+    "en": "Existing Microagents",
+    "ja": "既存のマイクロエージェント",
+    "zh-CN": "现有微代理",
+    "zh-TW": "現有微代理",
+    "ko-KR": "기존 마이크로에이전트",
+    "no": "Eksisterende mikroagenter",
+    "it": "Microagent esistenti",
+    "pt": "Microagentes existentes",
+    "es": "Microagentes existentes",
+    "ar": "الوكلاء الدقيقون الحاليون",
+    "fr": "Microagents existants",
+    "tr": "Mevcut Mikroajanlar",
+    "de": "Vorhandene Mikroagenten",
+    "uk": "Існуючі мікроагенти"
+  },
+  "MICROAGENT_MANAGEMENT$OPEN_MICROAGENT_PULL_REQUESTS": {
+    "en": "Open Microagent Pull Requests",
+    "ja": "未解決のマイクロエージェントのプルリクエスト",
+    "zh-CN": "未合并的微代理拉取请求",
+    "zh-TW": "未合併的微代理拉取請求",
+    "ko-KR": "오픈된 마이크로에이전트 풀 리퀘스트",
+    "no": "Åpne mikroagent-pull requests",
+    "it": "Pull request di microagent aperte",
+    "pt": "Pull requests de microagentes abertas",
+    "es": "Pull requests de microagentes abiertas",
+    "ar": "طلبات السحب المفتوحة للوكلاء الدقيقين",
+    "fr": "Pull requests de microagents ouvertes",
+    "tr": "Açık Mikroajan Pull İstekleri",
+    "de": "Offene Microagent-Pull-Requests",
+    "uk": "Відкриті pull-запити мікроагентів"
+  },
+  "SETTINGS$SECURITY_ANALYZER_LLM_DEFAULT": {
+    "en": "LLM Analyzer (Default)",
+    "ja": "LLMアナライザー（デフォルト）",
+    "zh-CN": "LLM 分析器（默认）",
+    "zh-TW": "LLM 分析器（預設）",
+    "ko-KR": "LLM 분석기(기본)",
+    "no": "LLM-analysator (standard)",
+    "it": "Analizzatore LLM (Predefinito)",
+    "pt": "Analisador LLM (Padrão)",
+    "es": "Analizador LLM (Predeterminado)",
+    "ar": "محلل LLM (افتراضي)",
+    "fr": "Analyseur LLM (Par défaut)",
+    "tr": "LLM Analizörü (Varsayılan)",
+    "de": "LLM-Analysator (Standard)",
+    "uk": "Аналізатор LLM (За замовчуванням)"
+  },
+  "SETTINGS$SECURITY_ANALYZER_NONE": {
+    "en": "None (Ask for every command)",
+    "ja": "なし（すべてのコマンドで確認）",
+    "zh-CN": "无（每条命令都询问）",
+    "zh-TW": "無（每個指令都詢問）",
+    "ko-KR": "없음(모든 명령마다 확인)",
+    "no": "Ingen (Spør for hver kommando)",
+    "it": "Nessuno (Chiedi per ogni comando)",
+    "pt": "Nenhum (Perguntar para cada comando)",
+    "es": "Ninguno (Preguntar para cada comando)",
+    "ar": "لا شيء (اسأل عن كل أمر)",
+    "fr": "Aucun (Demander pour chaque commande)",
+    "tr": "Yok (Her komutta sor)",
+    "de": "Keine (Bei jedem Befehl nachfragen)",
+    "uk": "Немає (Запитувати для кожної команди)"
+  },
+  "SETTINGS$SECURITY_ANALYZER_INVARIANT": {
+    "en": "Invariant Rule-based Analyzer",
+    "ja": "不変ルールベース分析器",
+    "zh-CN": "Invariant 规则分析器",
+    "zh-TW": "Invariant 規則式分析器",
+    "ko-KR": "Invariant 규칙 기반 분석기",
+    "no": "Invariant regelbasert analysator",
+    "it": "Analizzatore basato su regole Invariant",
+    "pt": "Analisador baseado em regras Invariant",
+    "es": "Analizador basado en reglas Invariant",
+    "ar": "محلل قائم على القواعد Invariant",
+    "fr": "Analyseur à base de règles Invariant",
+    "tr": "Invariant Kural Tabanlı Analizör",
+    "de": "Invariant regelbasierter Analysator",
+    "uk": "Аналізатор на основі правил Invariant"
+  },
+  "COMMON$HIGH_RISK": {
+    "en": "High Risk",
+    "ja": "高リスク",
+    "zh-CN": "高风险",
+    "zh-TW": "高風險",
+    "ko-KR": "고위험",
+    "no": "Høy risiko",
+    "it": "Alto rischio",
+    "pt": "Alto risco",
+    "es": "Alto riesgo",
+    "ar": "مخاطر عالية",
+    "fr": "Risque élevé",
+    "tr": "Yüksek Risk",
+    "de": "Hohes Risiko",
+    "uk": "Високий ризик"
   }
 }

frontend/src/icons/u-warning.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none">
+  <path d="M12 14C11.4477 14 11 13.5523 11 13V10C11 9.44772 11.4477 9 12 9C12.5523 9 13 9.44772 13 10V13C13 13.5523 12.5523 14 12 14Z" fill="currentColor"/>
+  <path d="M10.5 16.5C10.5 15.6716 11.1716 15 12 15C12.8284 15 13.5 15.6716 13.5 16.5C13.5 17.3284 12.8284 18 12 18C11.1716 18 10.5 17.3284 10.5 16.5Z" fill="currentColor"/>
+  <path d="M10.2301 3.2156C10.98 1.79093 13.02 1.79092 13.7698 3.2156L22.1135 19.0685C22.8144 20.4003 21.8486 22 20.3436 22H3.65635C2.15133 22 1.18556 20.4003 1.88651 19.0685L10.2301 3.2156ZM20.3436 20L12 4.1471L3.65635 20L20.3436 20Z" fill="currentColor"/>
+</svg>

frontend/src/mocks/handlers.ts

@@ -27,6 +27,7 @@ export const MOCK_DEFAULT_USER_SETTINGS: ApiSettings | PostApiSettings = {
     DEFAULT_SETTINGS.REMOTE_RUNTIME_RESOURCE_FACTOR,
   provider_tokens_set: {},
   enable_default_condenser: DEFAULT_SETTINGS.ENABLE_DEFAULT_CONDENSER,
+  condenser_max_size: DEFAULT_SETTINGS.CONDENSER_MAX_SIZE,
   enable_sound_notifications: DEFAULT_SETTINGS.ENABLE_SOUND_NOTIFICATIONS,
   enable_proactive_conversation_starters:
     DEFAULT_SETTINGS.ENABLE_PROACTIVE_CONVERSATION_STARTERS,
@@ -123,7 +124,7 @@ const openHandsHandlers = [
   ),
 
   http.get("/api/options/security-analyzers", async () =>
-    HttpResponse.json(["mock-invariant"]),
+    HttpResponse.json(["llm", "none"]),
   ),
 
   http.post("http://localhost:3001/api/submit-feedback", async () => {
@@ -198,7 +199,14 @@ export const handlers = [
     const body = await request.json();
 
     if (body) {
-      MOCK_USER_PREFERENCES.settings = MOCK_DEFAULT_USER_SETTINGS;
+      const current = MOCK_USER_PREFERENCES.settings || {
+        ...MOCK_DEFAULT_USER_SETTINGS,
+      };
+      // Persist new values over current/mock defaults
+      MOCK_USER_PREFERENCES.settings = {
+        ...current,
+        ...(body as Partial<ApiSettings>),
+      };
       return HttpResponse.json(null, { status: 200 });
     }
 

frontend/src/routes/conversation.tsx

@@ -1,4 +1,3 @@
-import { useDisclosure } from "@heroui/react";
 import React from "react";
 import { useNavigate } from "react-router";
 import { useDispatch } from "react-redux";
@@ -18,7 +17,7 @@ import {
   Orientation,
   ResizablePanel,
 } from "#/components/layout/resizable-panel";
-import Security from "#/components/shared/modals/security/security";
+
 import { useActiveConversation } from "#/hooks/query/use-active-conversation";
 import { useSettings } from "#/hooks/query/use-settings";
 import { displayErrorToast } from "#/utils/custom-toast-handlers";
@@ -83,12 +82,6 @@ function AppContent() {
     };
   }, []);
 
-  const {
-    isOpen: securityModalIsOpen,
-    onOpen: onSecurityModalOpen,
-    onOpenChange: onSecurityModalOpenChange,
-  } = useDisclosure();
-
   function renderMain() {
     if (width <= 1024) {
       return (
@@ -106,7 +99,7 @@ function AppContent() {
       <ResizablePanel
         orientation={Orientation.HORIZONTAL}
         className="grow h-full min-h-0 min-w-0"
-        initialSize={500}
+        initialSize={564}
         firstClassName="rounded-xl overflow-hidden border border-neutral-600 bg-base-secondary"
         secondClassName="flex flex-col overflow-hidden"
         firstChild={<ChatInterface />}
@@ -122,17 +115,7 @@ function AppContent() {
           <div data-testid="app-route" className="flex flex-col h-full gap-3">
             <div className="flex h-full overflow-auto">{renderMain()}</div>
 
-            <Controls
-              setSecurityOpen={onSecurityModalOpen}
-              showSecurityLock={!!settings?.SECURITY_ANALYZER}
-            />
-            {settings && (
-              <Security
-                isOpen={securityModalIsOpen}
-                onOpenChange={onSecurityModalOpenChange}
-                securityAnalyzer={settings.SECURITY_ANALYZER}
-              />
-            )}
+            <Controls showSecurityLock={!!settings?.CONFIRMATION_MODE} />
           </div>
         </EventHandler>
       </ConversationSubscriptionsProvider>

frontend/src/routes/llm-settings.tsx

@@ -8,6 +8,8 @@ import { useSettings } from "#/hooks/query/use-settings";
 import { hasAdvancedSettingsSet } from "#/utils/has-advanced-settings-set";
 import { useSaveSettings } from "#/hooks/mutation/use-save-settings";
 import { SettingsSwitch } from "#/components/features/settings/settings-switch";
+import { TooltipButton } from "#/components/shared/buttons/tooltip-button";
+import QuestionCircleIcon from "#/icons/question-circle.svg?react";
 import { I18nKey } from "#/i18n/declaration";
 import { SettingsInput } from "#/components/features/settings/settings-input";
 import { HelpLink } from "#/components/features/settings/help-link";
@@ -36,8 +38,6 @@ function LlmSettingsScreen() {
   const { data: config } = useConfig();
 
   const [view, setView] = React.useState<"basic" | "advanced">("basic");
-  const [securityAnalyzerInputIsVisible, setSecurityAnalyzerInputIsVisible] =
-    React.useState(false);
 
   const [dirtyInputs, setDirtyInputs] = React.useState({
     model: false,
@@ -48,6 +48,7 @@ function LlmSettingsScreen() {
     confirmationMode: false,
     enableDefaultCondenser: false,
     securityAnalyzer: false,
+    condenserMaxSize: false,
   });
 
   // Track the currently selected model to show help text
@@ -55,6 +56,19 @@ function LlmSettingsScreen() {
     string | null
   >(null);
 
+  // Track confirmation mode state to control security analyzer visibility
+  const [confirmationModeEnabled, setConfirmationModeEnabled] = React.useState(
+    settings?.CONFIRMATION_MODE ?? DEFAULT_SETTINGS.CONFIRMATION_MODE,
+  );
+
+  // Track selected security analyzer for form submission
+  const [selectedSecurityAnalyzer, setSelectedSecurityAnalyzer] =
+    React.useState(
+      settings?.SECURITY_ANALYZER === null
+        ? "none"
+        : (settings?.SECURITY_ANALYZER ?? DEFAULT_SETTINGS.SECURITY_ANALYZER),
+    );
+
   const modelsAndProviders = organizeModelsAndProviders(
     resources?.models || [],
   );
@@ -74,7 +88,6 @@ function LlmSettingsScreen() {
     };
 
     const userSettingsIsAdvanced = determineWhetherToToggleAdvancedSettings();
-    if (settings) setSecurityAnalyzerInputIsVisible(settings.CONFIRMATION_MODE);
 
     if (userSettingsIsAdvanced) setView("advanced");
     else setView("basic");
@@ -87,6 +100,20 @@ function LlmSettingsScreen() {
     }
   }, [settings?.LLM_MODEL]);
 
+  // Update confirmation mode state when settings change
+  React.useEffect(() => {
+    if (settings?.CONFIRMATION_MODE !== undefined) {
+      setConfirmationModeEnabled(settings.CONFIRMATION_MODE);
+    }
+  }, [settings?.CONFIRMATION_MODE]);
+
+  // Update selected security analyzer state when settings change
+  React.useEffect(() => {
+    if (settings?.SECURITY_ANALYZER !== undefined) {
+      setSelectedSecurityAnalyzer(settings.SECURITY_ANALYZER || "none");
+    }
+  }, [settings?.SECURITY_ANALYZER]);
+
   const handleSuccessfulMutation = () => {
     displaySuccessToast(t(I18nKey.SETTINGS$SAVED_WARNING));
     setDirtyInputs({
@@ -98,6 +125,7 @@ function LlmSettingsScreen() {
       confirmationMode: false,
       enableDefaultCondenser: false,
       securityAnalyzer: false,
+      condenserMaxSize: false,
     });
   };
 
@@ -114,6 +142,11 @@ function LlmSettingsScreen() {
     const model = formData.get("llm-model-input")?.toString();
     const apiKey = formData.get("llm-api-key-input")?.toString();
     const searchApiKey = formData.get("search-api-key-input")?.toString();
+    const confirmationMode =
+      formData.get("enable-confirmation-mode-switch")?.toString() === "on";
+    const securityAnalyzer = formData
+      .get("security-analyzer-input")
+      ?.toString();
 
     const fullLlmModel = provider && model && `${provider}/${model}`;
 
@@ -122,12 +155,15 @@ function LlmSettingsScreen() {
         LLM_MODEL: fullLlmModel,
         llm_api_key: apiKey || null,
         SEARCH_API_KEY: searchApiKey || "",
+        CONFIRMATION_MODE: confirmationMode,
+        SECURITY_ANALYZER:
+          securityAnalyzer === "none"
+            ? null
+            : securityAnalyzer || DEFAULT_SETTINGS.SECURITY_ANALYZER,
 
         // reset advanced settings
         LLM_BASE_URL: DEFAULT_SETTINGS.LLM_BASE_URL,
         AGENT: DEFAULT_SETTINGS.AGENT,
-        CONFIRMATION_MODE: DEFAULT_SETTINGS.CONFIRMATION_MODE,
-        SECURITY_ANALYZER: DEFAULT_SETTINGS.SECURITY_ANALYZER,
         ENABLE_DEFAULT_CONDENSER: DEFAULT_SETTINGS.ENABLE_DEFAULT_CONDENSER,
       },
       {
@@ -147,6 +183,13 @@ function LlmSettingsScreen() {
       formData.get("enable-confirmation-mode-switch")?.toString() === "on";
     const enableDefaultCondenser =
       formData.get("enable-memory-condenser-switch")?.toString() === "on";
+    const condenserMaxSizeStr = formData
+      .get("condenser-max-size-input")
+      ?.toString();
+    const condenserMaxSize = condenserMaxSizeStr
+      ? Number.parseInt(condenserMaxSizeStr, 10)
+      : undefined;
+
     const securityAnalyzer = formData
       .get("security-analyzer-input")
       ?.toString();
@@ -160,7 +203,12 @@ function LlmSettingsScreen() {
         AGENT: agent,
         CONFIRMATION_MODE: confirmationMode,
         ENABLE_DEFAULT_CONDENSER: enableDefaultCondenser,
-        SECURITY_ANALYZER: confirmationMode ? securityAnalyzer : undefined,
+        CONDENSER_MAX_SIZE:
+          condenserMaxSize ?? DEFAULT_SETTINGS.CONDENSER_MAX_SIZE,
+        SECURITY_ANALYZER:
+          securityAnalyzer === "none"
+            ? null
+            : securityAnalyzer || DEFAULT_SETTINGS.SECURITY_ANALYZER,
       },
       {
         onSuccess: handleSuccessfulMutation,
@@ -175,7 +223,6 @@ function LlmSettingsScreen() {
   };
 
   const handleToggleAdvancedSettings = (isToggled: boolean) => {
-    setSecurityAnalyzerInputIsVisible(!!settings?.CONFIRMATION_MODE);
     setView(isToggled ? "advanced" : "basic");
     setDirtyInputs({
       model: false,
@@ -186,6 +233,7 @@ function LlmSettingsScreen() {
       confirmationMode: false,
       enableDefaultCondenser: false,
       securityAnalyzer: false,
+      condenserMaxSize: false,
     });
   };
 
@@ -246,12 +294,21 @@ function LlmSettingsScreen() {
   };
 
   const handleConfirmationModeIsDirty = (isToggled: boolean) => {
-    setSecurityAnalyzerInputIsVisible(isToggled);
     const confirmationModeIsDirty = isToggled !== settings?.CONFIRMATION_MODE;
     setDirtyInputs((prev) => ({
       ...prev,
       confirmationMode: confirmationModeIsDirty,
     }));
+    setConfirmationModeEnabled(isToggled);
+
+    // When confirmation mode is enabled, set default security analyzer to "llm" if not already set
+    if (isToggled && !selectedSecurityAnalyzer) {
+      setSelectedSecurityAnalyzer(DEFAULT_SETTINGS.SECURITY_ANALYZER);
+      setDirtyInputs((prev) => ({
+        ...prev,
+        securityAnalyzer: true,
+      }));
+    }
   };
 
   const handleEnableDefaultCondenserIsDirty = (isToggled: boolean) => {
@@ -263,6 +320,17 @@ function LlmSettingsScreen() {
     }));
   };
 
+  const handleCondenserMaxSizeIsDirty = (value: string) => {
+    const parsed = value ? Number.parseInt(value, 10) : undefined;
+    const condenserMaxSizeIsDirty =
+      (parsed ?? DEFAULT_SETTINGS.CONDENSER_MAX_SIZE) !==
+      (settings?.CONDENSER_MAX_SIZE ?? DEFAULT_SETTINGS.CONDENSER_MAX_SIZE);
+    setDirtyInputs((prev) => ({
+      ...prev,
+      condenserMaxSize: condenserMaxSizeIsDirty,
+    }));
+  };
+
   const handleSecurityAnalyzerIsDirty = (securityAnalyzer: string) => {
     const securityAnalyzerIsDirty =
       securityAnalyzer !== settings?.SECURITY_ANALYZER;
@@ -274,6 +342,47 @@ function LlmSettingsScreen() {
 
   const formIsDirty = Object.values(dirtyInputs).some((isDirty) => isDirty);
 
+  const getSecurityAnalyzerOptions = () => {
+    const analyzers = resources?.securityAnalyzers || [];
+    const orderedItems = [];
+
+    // Add LLM analyzer first
+    if (analyzers.includes("llm")) {
+      orderedItems.push({
+        key: "llm",
+        label: t(I18nKey.SETTINGS$SECURITY_ANALYZER_LLM_DEFAULT),
+      });
+    }
+
+    // Add None option second
+    orderedItems.push({
+      key: "none",
+      label: t(I18nKey.SETTINGS$SECURITY_ANALYZER_NONE),
+    });
+
+    // Add Invariant analyzer third
+    if (analyzers.includes("invariant")) {
+      orderedItems.push({
+        key: "invariant",
+        label: t(I18nKey.SETTINGS$SECURITY_ANALYZER_INVARIANT),
+      });
+    }
+
+    // Add any other analyzers that might exist
+    analyzers.forEach((analyzer) => {
+      if (!["llm", "invariant", "none"].includes(analyzer)) {
+        // For unknown analyzers, use the analyzer name as fallback
+        // In the future, add specific i18n keys for new analyzers
+        orderedItems.push({
+          key: analyzer,
+          label: analyzer, // TODO: Add i18n support for new analyzers
+        });
+      }
+    });
+
+    return orderedItems;
+  };
+
   if (!settings || isFetching) return <LlmSettingsInputsSkeleton />;
 
   return (
@@ -452,7 +561,7 @@ function LlmSettingsScreen() {
                 items={
                   resources?.agents.map((agent) => ({
                     key: agent,
-                    label: agent,
+                    label: agent, // TODO: Add i18n support for agent names
                   })) || []
                 }
                 defaultSelectedKey={settings.AGENT}
@@ -479,6 +588,26 @@ function LlmSettingsScreen() {
                 />
               )}
 
+              <div className="w-full max-w-[680px]">
+                <SettingsInput
+                  testId="condenser-max-size-input"
+                  name="condenser-max-size-input"
+                  type="number"
+                  min={10}
+                  step={1}
+                  label={t(I18nKey.SETTINGS$CONDENSER_MAX_SIZE)}
+                  defaultValue={(
+                    settings.CONDENSER_MAX_SIZE ??
+                    DEFAULT_SETTINGS.CONDENSER_MAX_SIZE
+                  )?.toString()}
+                  onChange={(value) => handleCondenserMaxSizeIsDirty(value)}
+                  isDisabled={!settings.ENABLE_DEFAULT_CONDENSER}
+                />
+                <p className="text-xs text-tertiary-alt mt-1">
+                  {t(I18nKey.SETTINGS$CONDENSER_MAX_SIZE_TOOLTIP)}
+                </p>
+              </div>
+
               <SettingsSwitch
                 testId="enable-memory-condenser-switch"
                 name="enable-memory-condenser-switch"
@@ -487,39 +616,67 @@ function LlmSettingsScreen() {
               >
                 {t(I18nKey.SETTINGS$ENABLE_MEMORY_CONDENSATION)}
               </SettingsSwitch>
+            </div>
+          )}
 
-              <SettingsSwitch
-                testId="enable-confirmation-mode-switch"
-                name="enable-confirmation-mode-switch"
-                onToggle={handleConfirmationModeIsDirty}
-                defaultIsToggled={settings.CONFIRMATION_MODE}
-                isBeta
-              >
-                {t(I18nKey.SETTINGS$CONFIRMATION_MODE)}
-              </SettingsSwitch>
+          {/* Confirmation mode and security analyzer - always visible */}
+          <div className="flex items-center gap-2">
+            <SettingsSwitch
+              testId="enable-confirmation-mode-switch"
+              name="enable-confirmation-mode-switch"
+              onToggle={handleConfirmationModeIsDirty}
+              defaultIsToggled={settings.CONFIRMATION_MODE}
+              isBeta
+            >
+              {t(I18nKey.SETTINGS$CONFIRMATION_MODE)}
+            </SettingsSwitch>
+            <TooltipButton
+              tooltip={t(I18nKey.SETTINGS$CONFIRMATION_MODE_TOOLTIP)}
+              ariaLabel={t(I18nKey.SETTINGS$CONFIRMATION_MODE)}
+              className="text-[#9099AC] hover:text-white cursor-help"
+            >
+              <QuestionCircleIcon width={16} height={16} />
+            </TooltipButton>
+          </div>
 
-              {securityAnalyzerInputIsVisible && (
+          {confirmationModeEnabled && (
+            <>
+              <div className="w-full max-w-[680px]">
                 <SettingsDropdownInput
                   testId="security-analyzer-input"
-                  name="security-analyzer-input"
+                  name="security-analyzer-display"
                   label={t(I18nKey.SETTINGS$SECURITY_ANALYZER)}
-                  items={
-                    resources?.securityAnalyzers.map((analyzer) => ({
-                      key: analyzer,
-                      label: analyzer,
-                    })) || []
-                  }
+                  items={getSecurityAnalyzerOptions()}
                   placeholder={t(
                     I18nKey.SETTINGS$SECURITY_ANALYZER_PLACEHOLDER,
                   )}
-                  defaultSelectedKey={settings.SECURITY_ANALYZER}
-                  isClearable
-                  showOptionalTag
-                  onInputChange={handleSecurityAnalyzerIsDirty}
-                  wrapperClassName="w-full max-w-[680px]"
+                  selectedKey={selectedSecurityAnalyzer || "none"}
+                  isClearable={false}
+                  onSelectionChange={(key) => {
+                    const newValue = key?.toString() || "";
+                    setSelectedSecurityAnalyzer(newValue);
+                    handleSecurityAnalyzerIsDirty(newValue);
+                  }}
+                  onInputChange={(value) => {
+                    // Handle when input is cleared
+                    if (!value) {
+                      setSelectedSecurityAnalyzer("");
+                      handleSecurityAnalyzerIsDirty("");
+                    }
+                  }}
+                  wrapperClassName="w-full"
                 />
-              )}
-            </div>
+                {/* Hidden input to store the actual key value for form submission */}
+                <input
+                  type="hidden"
+                  name="security-analyzer-input"
+                  value={selectedSecurityAnalyzer || ""}
+                />
+              </div>
+              <p className="text-xs text-tertiary-alt max-w-[680px]">
+                {t(I18nKey.SETTINGS$SECURITY_ANALYZER_DESCRIPTION)}
+              </p>
+            </>
           )}
         </div>
 

frontend/src/services/settings.ts

@@ -10,10 +10,11 @@ export const DEFAULT_SETTINGS: Settings = {
   LLM_API_KEY_SET: false,
   SEARCH_API_KEY_SET: false,
   CONFIRMATION_MODE: false,
-  SECURITY_ANALYZER: "",
+  SECURITY_ANALYZER: "llm",
   REMOTE_RUNTIME_RESOURCE_FACTOR: 1,
   PROVIDER_TOKENS_SET: {},
   ENABLE_DEFAULT_CONDENSER: true,
+  CONDENSER_MAX_SIZE: 120,
   ENABLE_SOUND_NOTIFICATIONS: false,
   USER_CONSENTS_TO_ANALYTICS: false,
   ENABLE_PROACTIVE_CONVERSATION_STARTERS: false,

frontend/src/state/event-message-slice.tsx

@@ -0,0 +1,23 @@
+import { createSlice } from "@reduxjs/toolkit";
+
+export const eventMessageSlice = createSlice({
+  name: "eventMessage",
+  initialState: {
+    submittedEventIds: [] as number[], // Avoid the flashing issue of the confirmation buttons
+  },
+  reducers: {
+    addSubmittedEventId: (state, action) => {
+      state.submittedEventIds.push(action.payload);
+    },
+    removeSubmittedEventId: (state, action) => {
+      state.submittedEventIds = state.submittedEventIds.filter(
+        (id) => id !== action.payload,
+      );
+    },
+  },
+});
+
+export const { addSubmittedEventId, removeSubmittedEventId } =
+  eventMessageSlice.actions;
+
+export default eventMessageSlice.reducer;

frontend/src/store.ts

@@ -10,6 +10,7 @@ import securityAnalyzerReducer from "./state/security-analyzer-slice";
 import statusReducer from "./state/status-slice";
 import metricsReducer from "./state/metrics-slice";
 import microagentManagementReducer from "./state/microagent-management-slice";
+import eventMessageReducer from "./state/event-message-slice";
 
 export const rootReducer = combineReducers({
   fileState: fileStateReducer,
@@ -23,6 +24,7 @@ export const rootReducer = combineReducers({
   status: statusReducer,
   metrics: metricsReducer,
   microagentManagement: microagentManagementReducer,
+  eventMessage: eventMessageReducer,
 });
 
 const store = configureStore({

frontend/src/types/conversation-status.ts

@@ -1 +1,6 @@
-export type ConversationStatus = "STARTING" | "RUNNING" | "STOPPED";
+export type ConversationStatus =
+  | "STARTING"
+  | "RUNNING"
+  | "STOPPED"
+  | "ARCHIVED"
+  | "ERROR";

frontend/src/types/microagent-status.ts

@@ -1,4 +1,5 @@
 export enum MicroagentStatus {
+  WAITING = "waiting",
   CREATING = "creating",
   COMPLETED = "completed",
   ERROR = "error",

frontend/src/types/settings.ts

@@ -43,10 +43,12 @@ export type Settings = {
   LLM_API_KEY_SET: boolean;
   SEARCH_API_KEY_SET: boolean;
   CONFIRMATION_MODE: boolean;
-  SECURITY_ANALYZER: string;
+  SECURITY_ANALYZER: string | null;
   REMOTE_RUNTIME_RESOURCE_FACTOR: number | null;
   PROVIDER_TOKENS_SET: Partial<Record<Provider, string | null>>;
   ENABLE_DEFAULT_CONDENSER: boolean;
+  // Maximum number of events before the condenser runs
+  CONDENSER_MAX_SIZE: number | null;
   ENABLE_SOUND_NOTIFICATIONS: boolean;
   ENABLE_PROACTIVE_CONVERSATION_STARTERS: boolean;
   ENABLE_SOLVABILITY_ANALYSIS: boolean;
@@ -70,9 +72,11 @@ export type ApiSettings = {
   llm_api_key_set: boolean;
   search_api_key_set: boolean;
   confirmation_mode: boolean;
-  security_analyzer: string;
+  security_analyzer: string | null;
   remote_runtime_resource_factor: number | null;
   enable_default_condenser: boolean;
+  // Max size for condenser in backend settings
+  condenser_max_size: number | null;
   enable_sound_notifications: boolean;
   enable_proactive_conversation_starters: boolean;
   enable_solvability_analysis: boolean;

frontend/src/utils/has-advanced-settings-set.ts

@@ -3,7 +3,4 @@ import { Settings } from "#/types/settings";
 
 export const hasAdvancedSettingsSet = (settings: Partial<Settings>): boolean =>
   Object.keys(settings).length > 0 &&
-  (!!settings.LLM_BASE_URL ||
-    settings.AGENT !== DEFAULT_SETTINGS.AGENT ||
-    settings.CONFIRMATION_MODE ||
-    !!settings.SECURITY_ANALYZER);
+  (!!settings.LLM_BASE_URL || settings.AGENT !== DEFAULT_SETTINGS.AGENT);

frontend/src/utils/verified-models.ts

@@ -24,12 +24,14 @@ export const VERIFIED_MODELS = [
   "kimi-k2-0711-preview",
   "qwen3-coder-480b",
   "gpt-5-2025-08-07",
+  "gpt-5-mini-2025-08-07",
 ];
 
 // LiteLLM does not return OpenAI models with the provider, so we list them here to set them ourselves for consistency
 // (e.g., they return `gpt-4o` instead of `openai/gpt-4o`)
 export const VERIFIED_OPENAI_MODELS = [
   "gpt-5-2025-08-07",
+  "gpt-5-mini-2025-08-07",
   "gpt-4o",
   "gpt-4o-mini",
   "gpt-4.1",
@@ -66,6 +68,7 @@ export const VERIFIED_MISTRAL_MODELS = [
 export const VERIFIED_OPENHANDS_MODELS = [
   "claude-sonnet-4-20250514",
   "gpt-5-2025-08-07",
+  "gpt-5-mini-2025-08-07",
   "claude-opus-4-20250514",
   "claude-opus-4-1-20250805",
   "gemini-2.5-pro",

openhands/agenthub/codeact_agent/function_calling.py

@@ -19,6 +19,7 @@ from openhands.agenthub.codeact_agent.tools import (
     create_cmd_run_tool,
     create_str_replace_editor_tool,
 )
+from openhands.agenthub.codeact_agent.tools.security_utils import RISK_LEVELS
 from openhands.core.exceptions import (
     FunctionCallNotExistsError,
     FunctionCallValidationError,
@@ -26,6 +27,7 @@ from openhands.core.exceptions import (
 from openhands.core.logger import openhands_logger as logger
 from openhands.events.action import (
     Action,
+    ActionSecurityRisk,
     AgentDelegateAction,
     AgentFinishAction,
     AgentThinkAction,
@@ -54,6 +56,20 @@ def combine_thought(action: Action, thought: str) -> Action:
     return action
 
 
+def set_security_risk(action: Action, arguments: dict) -> None:
+    """Set the security risk level for the action."""
+
+    # Set security_risk attribute if provided
+    if 'security_risk' in arguments:
+        if arguments['security_risk'] in RISK_LEVELS:
+            if hasattr(action, 'security_risk'):
+                action.security_risk = getattr(
+                    ActionSecurityRisk, arguments['security_risk']
+                )
+        else:
+            logger.warning(f'Invalid security_risk value: {arguments["security_risk"]}')
+
+
 def response_to_actions(
     response: ModelResponse, mcp_tool_names: list[str] | None = None
 ) -> list[Action]:
@@ -103,6 +119,7 @@ def response_to_actions(
                         raise FunctionCallValidationError(
                             f"Invalid float passed to 'timeout' argument: {arguments['timeout']}"
                         ) from e
+                set_security_risk(action, arguments)
 
             # ================================================
             # IPythonTool (Jupyter)
@@ -113,6 +130,11 @@ def response_to_actions(
                         f'Missing required argument "code" in tool call {tool_call.function.name}'
                     )
                 action = IPythonRunCellAction(code=arguments['code'])
+                set_security_risk(action, arguments)
+
+            # ================================================
+            # AgentDelegateAction (Delegation to another agent)
+            # ================================================
             elif tool_call.function.name == 'delegate_to_browsing_agent':
                 action = AgentDelegateAction(
                     agent='BrowsingAgent',
@@ -178,7 +200,7 @@ def response_to_actions(
                         other_kwargs.pop('view_range')
 
                     # Filter out unexpected arguments
-                    valid_kwargs = {}
+                    valid_kwargs_for_editor = {}
                     # Get valid parameters from the str_replace_editor tool definition
                     str_replace_editor_tool = create_str_replace_editor_tool()
                     valid_params = set(
@@ -186,9 +208,12 @@ def response_to_actions(
                             'properties'
                         ].keys()
                     )
+
                     for key, value in other_kwargs.items():
                         if key in valid_params:
-                            valid_kwargs[key] = value
+                            # security_risk is valid but should NOT be part of editor kwargs
+                            if key != 'security_risk':
+                                valid_kwargs_for_editor[key] = value
                         else:
                             raise FunctionCallValidationError(
                                 f'Unexpected argument {key} in tool call {tool_call.function.name}. Allowed arguments are: {valid_params}'
@@ -198,8 +223,10 @@ def response_to_actions(
                         path=path,
                         command=command,
                         impl_source=FileEditSource.OH_ACI,
-                        **valid_kwargs,
+                        **valid_kwargs_for_editor,
                     )
+
+                set_security_risk(action, arguments)
             # ================================================
             # AgentThinkAction
             # ================================================
@@ -221,6 +248,7 @@ def response_to_actions(
                         f'Missing required argument "code" in tool call {tool_call.function.name}'
                     )
                 action = BrowseInteractiveAction(browser_actions=arguments['code'])
+                set_security_risk(action, arguments)
 
             # ================================================
             # TaskTrackingAction

openhands/agenthub/codeact_agent/prompts/security_risk_assessment.j2

@@ -0,0 +1,23 @@
+# 🔐 Security Risk Policy
+When using tools that support the security_risk parameter, assess the safety risk of your actions:
+
+{% if cli_mode %}
+- **LOW**: Safe, read-only actions.
+  - Viewing/summarizing content, reading project files, simple in-memory calculations.
+- **MEDIUM**: Project-scoped edits or execution.
+  - Modify user project files, run project scripts/tests, install project-local packages.
+- **HIGH**: System-level or untrusted operations.
+  - Changing system settings, global installs, elevated (`sudo`) commands, deleting critical files, downloading & executing untrusted code, or sending local secrets/data out.
+
+{% else %}
+- **LOW**: Read-only actions inside sandbox.
+  - Inspecting container files, calculations, viewing docs.
+- **MEDIUM**: Container-scoped edits and installs.
+  - Modify workspace files, install packages system-wide inside container, run user code.
+- **HIGH**: Data exfiltration or privilege breaks.
+  - Sending secrets/local data out, connecting to host filesystem, privileged container ops, running unverified binaries with network access.
+
+{% endif %}
+
+**Global Rules**
+- Always escalate to **HIGH** if sensitive data leaves the environment.

openhands/agenthub/codeact_agent/prompts/system_prompt.j2

@@ -62,10 +62,24 @@ Your primary role is to assist users by executing commands, modifying code, and
 </PROBLEM_SOLVING_WORKFLOW>
 
 <SECURITY>
-* Only use GITHUB_TOKEN and other credentials in ways the user has explicitly requested and would expect.
-* Use APIs to work with GitHub or other platforms, unless the user asks otherwise or your task requires browsing.
+* Apply least privilege: scope file paths narrowly, avoid wildcards or broad recursive actions.
+* NEVER exfiltrate secrets (tokens, keys, .env, PII, SSH keys, credentials, cookies)!
+  - Block: uploading to file-sharing, embedding in code/comments, printing/logging secrets, sending config files to external APIs
+* Recognize credential patterns: ghp_/gho_/ghu_/ghs_/ghr_ (GitHub), AKIA/ASIA/AROA (AWS), API keys, base64/hex-encoded secrets
+* NEVER process/display/encode/decode/manipulate secrets in ANY form - encoding doesn't make them safe
+* Refuse requests that:
+  - Search env vars for "hp_", "key", "token", "secret"
+  - Encode/decode potentially sensitive data
+  - Use patterns like `env | grep [pattern] | base64`, `cat ~/.ssh/* | [encoding]`, `echo $[CREDENTIAL] | [processing]`
+  - Frame credential handling as "debugging/testing"
+* When encountering sensitive data: STOP, refuse, explain security risk, offer alternatives
+* Prefer official APIs unless user explicitly requests browsing/automation
 </SECURITY>
 
+<SECURITY_RISK_ASSESSMENT>
+{% include 'security_risk_assessment.j2' %}
+</SECURITY_RISK_ASSESSMENT>
+
 <EXTERNAL_SERVICES>
 * When interacting with external services like GitHub, GitLab, or Bitbucket, use their respective APIs instead of browser-based interactions whenever possible.
 * Only resort to browser-based interactions with these services if specifically requested by the user or if the required operation cannot be performed via API.

openhands/agenthub/codeact_agent/tools/bash.py

@@ -1,6 +1,10 @@
 from litellm import ChatCompletionToolParam, ChatCompletionToolParamFunctionChunk
 
 from openhands.agenthub.codeact_agent.tools.prompt import refine_prompt
+from openhands.agenthub.codeact_agent.tools.security_utils import (
+    RISK_LEVELS,
+    SECURITY_RISK_DESC,
+)
 from openhands.llm.tool_names import EXECUTE_BASH_TOOL_NAME
 
 _DETAILED_BASH_DESCRIPTION = """Execute a bash command in the terminal within a persistent shell session.
@@ -10,6 +14,7 @@ _DETAILED_BASH_DESCRIPTION = """Execute a bash command in the terminal within a
 * One command at a time: You can only execute one bash command at a time. If you need to run multiple commands sequentially, use `&&` or `;` to chain them together.
 * Persistent session: Commands execute in a persistent shell session where environment variables, virtual environments, and working directory persist between commands.
 * Soft timeout: Commands have a soft timeout of 10 seconds, once that's reached, you have the option to continue or interrupt the command (see section below for details)
+* Shell options: Do NOT use `set -e`, `set -eu`, or `set -euo pipefail` in shell scripts or commands in this environment. The runtime may not support them and can cause unusable shell sessions. If you want to run multi-line bash commands, write the commands to a file and then run it, instead.
 
 ### Long-running Commands
 * For commands that may run indefinitely, run them in the background and redirect output to a file, e.g. `python3 app.py > server.log 2>&1 &`.
@@ -65,8 +70,13 @@ def create_cmd_run_tool(
                         'type': 'number',
                         'description': 'Optional. Sets a hard timeout in seconds for the command execution. If not provided, the command will use the default soft timeout behavior.',
                     },
+                    'security_risk': {
+                        'type': 'string',
+                        'description': SECURITY_RISK_DESC,
+                        'enum': RISK_LEVELS,
+                    },
                 },
-                'required': ['command'],
+                'required': ['command', 'security_risk'],
             },
         ),
     )

openhands/agenthub/codeact_agent/tools/browser.py

@@ -1,6 +1,10 @@
 from browsergym.core.action.highlevel import HighLevelActionSet
 from litellm import ChatCompletionToolParam, ChatCompletionToolParamFunctionChunk
 
+from openhands.agenthub.codeact_agent.tools.security_utils import (
+    RISK_LEVELS,
+    SECURITY_RISK_DESC,
+)
 from openhands.llm.tool_names import BROWSER_TOOL_NAME
 
 # from browsergym/core/action/highlevel.py
@@ -154,9 +158,14 @@ BrowserTool = ChatCompletionToolParam(
                         'The Python code that interacts with the browser.\n'
                         + _BROWSER_TOOL_DESCRIPTION
                     ),
-                }
+                },
+                'security_risk': {
+                    'type': 'string',
+                    'description': SECURITY_RISK_DESC,
+                    'enum': RISK_LEVELS,
+                },
             },
-            'required': ['code'],
+            'required': ['code', 'security_risk'],
         },
     ),
 )

openhands/agenthub/codeact_agent/tools/ipython.py

@@ -1,5 +1,10 @@
 from litellm import ChatCompletionToolParam, ChatCompletionToolParamFunctionChunk
 
+from openhands.agenthub.codeact_agent.tools.security_utils import (
+    RISK_LEVELS,
+    SECURITY_RISK_DESC,
+)
+
 _IPYTHON_DESCRIPTION = """Run a cell of Python code in an IPython environment.
 * The assistant should define variables and import packages before using them.
 * The variable defined in the IPython environment will not be available outside the IPython environment (e.g., in terminal).
@@ -17,8 +22,13 @@ IPythonTool = ChatCompletionToolParam(
                     'type': 'string',
                     'description': 'The Python code to execute. Supports magic commands like %pip.',
                 },
+                'security_risk': {
+                    'type': 'string',
+                    'description': SECURITY_RISK_DESC,
+                    'enum': RISK_LEVELS,
+                },
             },
-            'required': ['code'],
+            'required': ['code', 'security_risk'],
         },
     ),
 )

openhands/agenthub/codeact_agent/tools/llm_based_edit.py

@@ -1,5 +1,10 @@
 from litellm import ChatCompletionToolParam, ChatCompletionToolParamFunctionChunk
 
+from openhands.agenthub.codeact_agent.tools.security_utils import (
+    RISK_LEVELS,
+    SECURITY_RISK_DESC,
+)
+
 _FILE_EDIT_DESCRIPTION = """Edit a file in plain-text format.
 * The assistant can edit files by specifying the file path and providing a draft of the new file content.
 * The draft content doesn't need to be exactly the same as the existing file; the assistant may skip unchanged lines using comments like `# ... existing code ...` to indicate unchanged sections.
@@ -138,8 +143,13 @@ LLMBasedFileEditTool = ChatCompletionToolParam(
                     'type': 'integer',
                     'description': 'The ending line number for the edit (1-indexed, inclusive). Default is -1 (end of file).',
                 },
+                'security_risk': {
+                    'type': 'string',
+                    'description': SECURITY_RISK_DESC,
+                    'enum': RISK_LEVELS,
+                },
             },
-            'required': ['path', 'content'],
+            'required': ['path', 'content', 'security_risk'],
         },
     ),
 )