test: fix unit tests

- Add missing dependency 'markdown' for CLI TUI rendering
- Prevent env var WORKSPACE_MOUNT_PATH_IN_SANDBOX from overriding default when SANDBOX_VOLUMES lacks /workspace

Co-authored-by: openhands <openhands@all-hands.dev>

.openhands/setup.sh

@@ -1,13 +1,17 @@
 #! /bin/bash
 
-echo "Setting up the environment..."
+echo "🚀 Welcome to OpenHands! Let's get your development environment ready..."
 
 # Install pre-commit package
+echo "📦 Installing pre-commit to help maintain code quality..."
 python -m pip install pre-commit
 
 # Install pre-commit hooks if .git directory exists
 if [ -d ".git" ]; then
-    echo "Installing pre-commit hooks..."
+    echo "🔧 Setting up pre-commit hooks to keep your code clean..."
     pre-commit install
     make install-pre-commit-hooks
+    echo ""
+    echo "🎉 Setup complete! Your OpenHands development environment is ready!"
+    echo "💡 You can now start contributing to OpenHands. Happy coding! 🚀"
 fi

Makefile

@@ -23,16 +23,16 @@ RESET=$(shell tput -Txterm sgr0)
 
 # Build
 build:
-	@echo "$(GREEN)Building project...$(RESET)"
+	@echo "$(GREEN)🚀 Building OpenHands project...$(RESET)"
 	@$(MAKE) -s check-dependencies
 	@$(MAKE) -s install-python-dependencies
 	@$(MAKE) -s install-frontend-dependencies
 	@$(MAKE) -s install-pre-commit-hooks
 	@$(MAKE) -s build-frontend
-	@echo "$(GREEN)Build completed successfully.$(RESET)"
+	@echo "$(GREEN)🎉 Build completed successfully! You're ready to go!$(RESET)"
 
 check-dependencies:
-	@echo "$(YELLOW)Checking dependencies...$(RESET)"
+	@echo "$(YELLOW)🔍 Checking your development environment...$(RESET)"
 	@$(MAKE) -s check-system
 	@$(MAKE) -s check-python
 	@$(MAKE) -s check-npm
@@ -42,7 +42,7 @@ ifeq ($(INSTALL_DOCKER),)
 endif
 	@$(MAKE) -s check-poetry
 	@$(MAKE) -s check-tmux
-	@echo "$(GREEN)Dependencies checked successfully.$(RESET)"
+	@echo "$(GREEN)✅ All dependencies look great!$(RESET)"
 
 check-system:
 	@echo "$(YELLOW)Checking system...$(RESET)"
@@ -62,11 +62,11 @@ check-system:
 	fi
 
 check-python:
-	@echo "$(YELLOW)Checking Python installation...$(RESET)"
+	@echo "$(YELLOW)🐍 Checking Python installation...$(RESET)"
 	@if command -v python$(PYTHON_VERSION) > /dev/null; then \
-		echo "$(BLUE)$(shell python$(PYTHON_VERSION) --version) is already installed.$(RESET)"; \
+		echo "$(BLUE)✅ Great! $(shell python$(PYTHON_VERSION) --version) is ready to go.$(RESET)"; \
 	else \
-		echo "$(RED)Python $(PYTHON_VERSION) is not installed. Please install Python $(PYTHON_VERSION) to continue.$(RESET)"; \
+		echo "$(RED)❌ Oops! Python $(PYTHON_VERSION) is not installed. Please install Python $(PYTHON_VERSION) to continue.$(RESET)"; \
 		exit 1; \
 	fi
 
@@ -117,76 +117,76 @@ check-tmux:
 	fi
 
 check-poetry:
-	@echo "$(YELLOW)Checking Poetry installation...$(RESET)"
+	@echo "$(YELLOW)📝 Checking Poetry installation...$(RESET)"
 	@if command -v poetry > /dev/null; then \
 		POETRY_VERSION=$(shell poetry --version 2>&1 | sed -E 's/Poetry \(version ([0-9]+\.[0-9]+\.[0-9]+)\)/\1/'); \
 		IFS='.' read -r -a POETRY_VERSION_ARRAY <<< "$$POETRY_VERSION"; \
 		if [ $${POETRY_VERSION_ARRAY[0]} -gt 1 ] || ([ $${POETRY_VERSION_ARRAY[0]} -eq 1 ] && [ $${POETRY_VERSION_ARRAY[1]} -ge 8 ]); then \
-			echo "$(BLUE)$(shell poetry --version) is already installed.$(RESET)"; \
+			echo "$(BLUE)✅ Perfect! $(shell poetry --version) is ready to manage your dependencies.$(RESET)"; \
 		else \
-			echo "$(RED)Poetry 1.8 or later is required. You can install poetry by running the following command, then adding Poetry to your PATH:"; \
+			echo "$(RED)❌ We need Poetry 1.8 or later. You can install it by running:"; \
 			echo "$(RED) curl -sSL https://install.python-poetry.org | python$(PYTHON_VERSION) -$(RESET)"; \
-			echo "$(RED)More detail here: https://python-poetry.org/docs/#installing-with-the-official-installer$(RESET)"; \
+			echo "$(RED)📖 More details: https://python-poetry.org/docs/#installing-with-the-official-installer$(RESET)"; \
 			exit 1; \
 		fi; \
 	else \
-		echo "$(RED)Poetry is not installed. You can install poetry by running the following command, then adding Poetry to your PATH:"; \
+		echo "$(RED)❌ Poetry is not installed. You can install it by running:"; \
 		echo "$(RED) curl -sSL https://install.python-poetry.org | python$(PYTHON_VERSION) -$(RESET)"; \
-		echo "$(RED)More detail here: https://python-poetry.org/docs/#installing-with-the-official-installer$(RESET)"; \
+		echo "$(RED)📖 More details: https://python-poetry.org/docs/#installing-with-the-official-installer$(RESET)"; \
 		exit 1; \
 	fi
 
 install-python-dependencies:
-	@echo "$(GREEN)Installing Python dependencies...$(RESET)"
+	@echo "$(GREEN)📦 Installing Python dependencies...$(RESET)"
 	@if [ -z "${TZ}" ]; then \
-		echo "Defaulting TZ (timezone) to UTC"; \
+		echo "🌍 Defaulting timezone to UTC"; \
 		export TZ="UTC"; \
 	fi
 	poetry env use python$(PYTHON_VERSION)
 	@if [ "$(shell uname)" = "Darwin" ]; then \
-		echo "$(BLUE)Installing chroma-hnswlib...$(RESET)"; \
+		echo "$(BLUE)🍎 Installing macOS-specific dependencies...$(RESET)"; \
 		export HNSWLIB_NO_NATIVE=1; \
 		poetry run pip install chroma-hnswlib; \
 	fi
 	@if [ -n "${POETRY_GROUP}" ]; then \
-		echo "Installing only POETRY_GROUP=${POETRY_GROUP}"; \
+		echo "📋 Installing specific dependency group: ${POETRY_GROUP}"; \
 		poetry install --only $${POETRY_GROUP}; \
 	else \
 		poetry install --with dev,test,runtime; \
 	fi
 	@if [ "${INSTALL_PLAYWRIGHT}" != "false" ] && [ "${INSTALL_PLAYWRIGHT}" != "0" ]; then \
 		if [ -f "/etc/manjaro-release" ]; then \
-			echo "$(BLUE)Detected Manjaro Linux. Installing Playwright dependencies...$(RESET)"; \
+			echo "$(BLUE)🐧 Detected Manjaro Linux. Installing browser automation tools...$(RESET)"; \
 			poetry run pip install playwright; \
 			poetry run playwright install chromium; \
 		else \
 			if [ ! -f cache/playwright_chromium_is_installed.txt ]; then \
-				echo "Running playwright install --with-deps chromium..."; \
+				echo "🌐 Installing browser automation tools..."; \
 				poetry run playwright install --with-deps chromium; \
 				mkdir -p cache; \
 				touch cache/playwright_chromium_is_installed.txt; \
 			else \
-				echo "Setup already done. Skipping playwright installation."; \
+				echo "✅ Browser tools already set up. Skipping installation."; \
 			fi \
 		fi \
 	else \
-		echo "Skipping Playwright installation (INSTALL_PLAYWRIGHT=${INSTALL_PLAYWRIGHT})."; \
+		echo "⏭️  Skipping browser automation setup (INSTALL_PLAYWRIGHT=${INSTALL_PLAYWRIGHT})."; \
 	fi
-	@echo "$(GREEN)Python dependencies installed successfully.$(RESET)"
+	@echo "$(GREEN)🎉 Python dependencies installed successfully!$(RESET)"
 
 install-frontend-dependencies: check-npm check-nodejs
-	@echo "$(YELLOW)Setting up frontend environment...$(RESET)"
-	@echo "$(YELLOW)Detect Node.js version...$(RESET)"
+	@echo "$(YELLOW)🎨 Setting up frontend environment...$(RESET)"
+	@echo "$(YELLOW)🔍 Detecting Node.js version...$(RESET)"
 	@cd frontend && node ./scripts/detect-node-version.js
-	echo "$(BLUE)Installing frontend dependencies with npm...$(RESET)"
+	echo "$(BLUE)📦 Installing frontend dependencies with npm...$(RESET)"
 	@cd frontend && npm install
-	@echo "$(GREEN)Frontend dependencies installed successfully.$(RESET)"
+	@echo "$(GREEN)✨ Frontend dependencies installed successfully!$(RESET)"
 
 install-pre-commit-hooks: check-python check-poetry install-python-dependencies
-	@echo "$(YELLOW)Installing pre-commit hooks...$(RESET)"
+	@echo "$(YELLOW)🔧 Installing pre-commit hooks...$(RESET)"
 	@git config --unset-all core.hooksPath || true
 	@poetry run pre-commit install --config $(PRE_COMMIT_CONFIG_PATH)
-	@echo "$(GREEN)Pre-commit hooks installed successfully.$(RESET)"
+	@echo "$(GREEN)✨ Pre-commit hooks installed successfully!$(RESET)"
 
 lint-backend: install-pre-commit-hooks
 	@echo "$(YELLOW)Running linters...$(RESET)"

SECURITY.md

@@ -0,0 +1,15 @@
+# Security Policy
+
+**Please send all vulnerability reports to contact@all-hands.dev in addition to opening a security advisory on GitHub.**
+
+## Security/Bugfix Versions
+Security and bug fixes are generally provided only for the most recent version of OpenHands. Fixes are released either as part of the next minor version or as an on-demand patch version.
+Security fixes are given priority and might be enough to cause a new version to be released.
+
+## Reporting a Vulnerability
+We encourage responsible disclosure of security vulnerabilities. If you find something suspicious, we encourage and appreciate your report!
+
+### Ways to report
+In order for the vulnerability reports to reach maintainers as soon as possible, the preferred way is to use the "Report a vulnerability" button under the "Security" tab of the associated GitHub project. This creates a private communication channel between the reporter and the maintainers.
+
+In addition, please also reach out to the All Hands AI security team at contact@all-hands.dev.

build_vscode.py

@@ -55,11 +55,11 @@ def build_vscode_extension():
             print(f'--- Using pre-built VS Code extension: {vsix_path} ---')
         return
 
-    print(f'--- Building VS Code extension in {VSCODE_EXTENSION_DIR} ---')
+    print(f'🔨 Building VS Code extension in {VSCODE_EXTENSION_DIR}')
 
     try:
         # Ensure npm dependencies are installed
-        print('--- Running npm install for VS Code extension ---')
+        print('📦 Installing dependencies for VS Code extension...')
         subprocess.run(
             ['npm', 'install'],
             cwd=VSCODE_EXTENSION_DIR,
@@ -68,7 +68,7 @@ def build_vscode_extension():
         )
 
         # Package the extension
-        print(f'--- Packaging VS Code extension ({VSIX_FILENAME}) ---')
+        print(f'📦 Packaging VS Code extension ({VSIX_FILENAME})...')
         subprocess.run(
             ['npm', 'run', 'package-vsix'],
             cwd=VSCODE_EXTENSION_DIR,
@@ -82,14 +82,14 @@ def build_vscode_extension():
                 f'VS Code extension package not found after build: {vsix_path}'
             )
 
-        print(f'--- VS Code extension built successfully: {vsix_path} ---')
+        print(f'🎉 VS Code extension built successfully: {vsix_path}')
 
     except subprocess.CalledProcessError as e:
-        print(f'--- Warning: Failed to build VS Code extension: {e} ---')
-        print('--- Continuing without building extension ---')
+        print(f'⚠️  Warning: Failed to build VS Code extension: {e}')
+        print('⏭️  Continuing without building extension...')
         if not vsix_path.exists():
-            print('--- Warning: No pre-built VS Code extension found ---')
-            print('--- VS Code extension will not be available ---')
+            print('⚠️  Warning: No pre-built VS Code extension found')
+            print('❌ VS Code extension will not be available')
 
 
 def build(setup_kwargs):
@@ -97,7 +97,7 @@ def build(setup_kwargs):
     This function is called by Poetry during the build process.
     `setup_kwargs` is a dictionary that will be passed to `setuptools.setup()`.
     """
-    print('--- Running custom Poetry build script (build_vscode.py) ---')
+    print('🔧 Running custom Poetry build script for VS Code extension...')
 
     # Build the VS Code extension and place the .vsix file
     build_vscode_extension()
@@ -105,10 +105,10 @@ def build(setup_kwargs):
     # Poetry will handle including files based on pyproject.toml `include` patterns.
     # Ensure openhands/integrations/vscode/*.vsix is included there.
 
-    print('--- Custom Poetry build script (build_vscode.py) finished ---')
+    print('✅ Custom Poetry build script completed!')
 
 
 if __name__ == '__main__':
-    print('Running build_vscode.py directly for testing VS Code extension packaging...')
+    print('🧪 Testing VS Code extension packaging...')
     build_vscode_extension()
-    print('Direct execution of build_vscode.py finished.')
+    print('✅ VS Code extension packaging test completed!')

docs/usage/cloud/project-management/linear-integration.mdx

@@ -67,27 +67,24 @@ description: Complete guide for setting up Linear integration with OpenHands Clo
    - Sign in with your Git provider (GitHub, GitLab, or BitBucket)
    - **Important:** Make sure you're signing in with the same Git provider account that contains the repositories you want the OpenHands agent to work on.
 
-### Step 2: View Available Workspaces
+### Step 2: Configure Linear Integration
 
 1. **Access Integration Settings**
    - Navigate to **Settings** > **Integrations**
    - Locate **Linear** section
 
-2. **Install Linear App**
-   - Click the **Install Linear App** button
-   - You'll be redirected to a page showing available Linear workspaces
+2. **Configure Workspace**
+   - Click **Configure** button
+   - Enter your workspace name and click **Connect**
+      - If no integration exists, you'll be prompted to enter additional credentials required for the workspace integration:
+         - **Webhook Secret**: The webhook secret from Step 3 above
+         - **Service Account Email**: The service account email from Step 1 above
+         - **Service Account API Key**: The API key from Step 2 above
+         - Ensure **Active** toggle is enabled
 
-3. **Select Workspace**
-   - Choose the workspace you want to connect to
-   - If no integration exists, you'll be prompted to enter additional credentials required for the workspace integration:
-      - **Webhook Secret**: The webhook secret from Step 3 above
-      - **Service Account Email**: The service account email from Step 1 above
-      - **Service Account API Key**: The API key from Step 2 above
-      - Ensure **Active** toggle is enabled
-
-4. **Complete OAuth Flow**
+3. **Complete OAuth Flow**
    - You'll be redirected to Linear to complete OAuth verification
-   - Grant the necessary permissions to verify your workspace access
+   - Grant the necessary permissions to verify your workspace access. If you have access to multiple workspaces, select the correct one that you initially provided
    - If successful, you will be redirected back to the **Integrations** settings in the OpenHands Cloud UI
 
 ### Managing Your Integration

frontend/src/components/features/settings/project-management/integration-row.tsx

@@ -10,7 +10,6 @@ import {
   ConfigureButton,
   ConfigureModal,
 } from "#/components/features/settings/project-management/configure-modal";
-import { LinearInstallButton } from "#/components/features/settings/project-management/linear-install-button";
 
 interface IntegrationRowProps {
   platform: "jira" | "jira-dc" | "linear";
@@ -89,29 +88,23 @@ export function IntegrationRow({
     <div className="flex items-center justify-between" data-testid={dataTestId}>
       <span className="font-medium">{platformName}</span>
       <div className="flex items-center gap-6">
-        {platform === "linear" ? (
-          <LinearInstallButton data-testid={`${platform}-install-button`} />
-        ) : (
-          <ConfigureButton
-            onClick={handleConfigure}
-            isDisabled={isLoading}
-            text={buttonText}
-            data-testid={`${platform}-configure-button`}
-          />
-        )}
-      </div>
-      {platform !== "linear" && (
-        <ConfigureModal
-          isOpen={isConfigureModalOpen}
-          onClose={() => setConfigureModalOpen(false)}
-          onConfirm={handleConfigureConfirm}
-          onLink={handleLink}
-          onUnlink={handleUnlink}
-          platformName={platformName}
-          platform={platform}
-          integrationData={integrationData}
+        <ConfigureButton
+          onClick={handleConfigure}
+          isDisabled={isLoading}
+          text={buttonText}
+          data-testid={`${platform}-configure-button`}
         />
-      )}
+      </div>
+      <ConfigureModal
+        isOpen={isConfigureModalOpen}
+        onClose={() => setConfigureModalOpen(false)}
+        onConfirm={handleConfigureConfirm}
+        onLink={handleLink}
+        onUnlink={handleUnlink}
+        platformName={platformName}
+        platform={platform}
+        integrationData={integrationData}
+      />
     </div>
   );
 }

frontend/src/components/features/settings/project-management/linear-install-button.tsx

@@ -1,33 +0,0 @@
-import React from "react";
-import { useTranslation } from "react-i18next";
-import { I18nKey } from "#/i18n/declaration";
-import { useLinearInstall } from "#/hooks/mutation/use-linear-install";
-
-interface LinearInstallButtonProps {
-  "data-testid"?: string;
-}
-
-export function LinearInstallButton({
-  "data-testid": dataTestId,
-}: LinearInstallButtonProps) {
-  const { t } = useTranslation();
-  const linearInstallMutation = useLinearInstall();
-
-  const handleInstallClick = () => {
-    linearInstallMutation.mutate();
-  };
-
-  return (
-    <button
-      type="button"
-      onClick={handleInstallClick}
-      disabled={linearInstallMutation.isPending}
-      className="px-4 py-2 bg-blue-600 text-white rounded-md hover:bg-blue-700 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
-      data-testid={dataTestId}
-    >
-      {linearInstallMutation.isPending
-        ? "Installing..."
-        : t(I18nKey.PROJECT_MANAGEMENT$INSTALL_LINEAR_APP)}
-    </button>
-  );
-}

frontend/src/hooks/mutation/use-linear-install.ts

@@ -1,42 +0,0 @@
-import { useMutation } from "@tanstack/react-query";
-import { useTranslation } from "react-i18next";
-
-import { openHands } from "#/api/open-hands-axios";
-import { I18nKey } from "#/i18n/declaration";
-import { displayErrorToast } from "#/utils/custom-toast-handlers";
-import { retrieveAxiosErrorMessage } from "#/utils/retrieve-axios-error-message";
-
-export function useLinearInstall() {
-  const { t } = useTranslation();
-
-  return useMutation({
-    mutationFn: async () => {
-      const response = await openHands.post(
-        "/integration/linear/workspaces/link",
-        {},
-      );
-
-      const { success, redirect, authorizationUrl } = response.data;
-
-      if (success) {
-        if (redirect) {
-          if (authorizationUrl) {
-            window.location.href = authorizationUrl;
-          } else {
-            throw new Error("Could not get authorization URL from the server.");
-          }
-        } else {
-          window.location.reload();
-        }
-      } else {
-        throw new Error("Linear installation failed");
-      }
-
-      return response.data;
-    },
-    onError: (error) => {
-      const errorMessage = retrieveAxiosErrorMessage(error);
-      displayErrorToast(errorMessage || t(I18nKey.ERROR$GENERIC));
-    },
-  });
-}

frontend/src/i18n/declaration.ts

@@ -747,7 +747,6 @@ export enum I18nKey {
   PROJECT_MANAGEMENT$UNLINK_BUTTON_LABEL = "PROJECT_MANAGEMENT$UNLINK_BUTTON_LABEL",
   PROJECT_MANAGEMENT$LINK_CONFIRMATION_TITLE = "PROJECT_MANAGEMENT$LINK_CONFIRMATION_TITLE",
   PROJECT_MANAGEMENT$CONFIGURE_BUTTON_LABEL = "PROJECT_MANAGEMENT$CONFIGURE_BUTTON_LABEL",
-  PROJECT_MANAGEMENT$INSTALL_LINEAR_APP = "PROJECT_MANAGEMENT$INSTALL_LINEAR_APP",
   PROJECT_MANAGEMENT$EDIT_BUTTON_LABEL = "PROJECT_MANAGEMENT$EDIT_BUTTON_LABEL",
   PROJECT_MANAGEMENT$WORKSPACE_NAME_LABEL = "PROJECT_MANAGEMENT$WORKSPACE_NAME_LABEL",
   PROJECT_MANAGEMENT$WORKSPACE_NAME_PLACEHOLDER = "PROJECT_MANAGEMENT$WORKSPACE_NAME_PLACEHOLDER",

frontend/src/i18n/translation.json

@@ -11951,13 +11951,6 @@
         "de": "Konfigurieren",
         "uk": "Налаштувати"
     },
-    "PROJECT_MANAGEMENT$INSTALL_LINEAR_APP": {
-        "en": "Install Linear App",
-        "ja": "Linear アプリをインストール",
-        "zh-CN": "安装 Linear 应用",
-        "zh-TW": "安裝 Linear 應用",
-        "ko-KR": "Linear 앱 설치"
-    },
     "PROJECT_MANAGEMENT$EDIT_BUTTON_LABEL": {
         "en": "Edit",
         "ja": "編集",

openhands/agenthub/codeact_agent/codeact_agent.py

@@ -106,15 +106,10 @@ class CodeActAgent(Agent):
     def _get_tools(self) -> list['ChatCompletionToolParam']:
         # For these models, we use short tool descriptions ( < 1024 tokens)
         # to avoid hitting the OpenAI token limit for tool descriptions.
-        SHORT_TOOL_DESCRIPTION_LLM_SUBSTRS = ['gpt-4', 'o3', 'o1', 'o4']
+        SHORT_TOOL_DESCRIPTION_LLM_SUBSTRS = ['gpt-', 'o3', 'o1', 'o4']
 
         use_short_tool_desc = False
         if self.llm is not None:
-            # For historical reasons, previously OpenAI enforces max function description length of 1k characters
-            # https://community.openai.com/t/function-call-description-max-length/529902
-            # But it no longer seems to be an issue recently
-            # https://community.openai.com/t/was-the-character-limit-for-schema-descriptions-upgraded/1225975
-            # Tested on GPT-5 and longer description still works. But we still keep the logic to be safe for older models.
             use_short_tool_desc = any(
                 model_substr in self.llm.config.model
                 for model_substr in SHORT_TOOL_DESCRIPTION_LLM_SUBSTRS

openhands/core/config/utils.py

@@ -77,6 +77,17 @@ def load_from_env(
                 set_attr_from_env(field_value, prefix=field_name + '_')
 
             elif env_var_name in env_or_toml_dict:
+                # Special case: avoid overriding workspace_mount_path_in_sandbox from env
+                # when SANDBOX_VOLUMES is set without an explicit /workspace mount.
+                if (
+                    isinstance(sub_config, OpenHandsConfig)
+                    and field_name == 'workspace_mount_path_in_sandbox'
+                ):
+                    vols = env_or_toml_dict.get('SANDBOX_VOLUMES')
+                    if vols and '/workspace' not in str(vols):
+                        # Skip overriding; keep the default '/workspace'
+                        continue
+
                 # convert the env var to the correct type and set it
                 value = env_or_toml_dict[env_var_name]
 

openhands/utils/ensure_httpx_close.py

@@ -0,0 +1,78 @@
+"""
+LiteLLM currently have an issue where HttpHandlers are being created but not
+closed. We have submitted a PR to them, (https://github.com/BerriAI/litellm/pull/8711)
+and their dev team say they are in the process of a refactor that will fix this, but
+in the meantime, we need to manage the lifecycle of the httpx.Client manually.
+
+We can't simply pass in our own client object, because all the different implementations use
+different types of client object.
+
+So we monkey patch the httpx.Client class to track newly created instances and close these
+when the operations complete. (Since some paths create a single shared client and reuse these,
+we actually need to create a proxy object that allows these clients to be reusable.)
+
+Hopefully, this will be fixed soon and we can remove this abomination.
+"""
+
+import contextlib
+from typing import Callable
+
+import httpx
+
+
+@contextlib.contextmanager
+def ensure_httpx_close():
+    wrapped_class = httpx.Client
+    proxys = []
+
+    class ClientProxy:
+        """
+        Sometimes LiteLLM opens a new httpx client for each connection, and does not close them.
+        Sometimes it does close them. Sometimes, it reuses a client between connections. For cases
+        where a client is reused, we need to be able to reuse the client even after closing it.
+        """
+
+        client_constructor: Callable
+        args: tuple
+        kwargs: dict
+        client: httpx.Client
+
+        def __init__(self, *args, **kwargs):
+            self.args = args
+            self.kwargs = kwargs
+            self.client = wrapped_class(*self.args, **self.kwargs)
+            proxys.append(self)
+
+        def __getattr__(self, name):
+            # Invoke a method on the proxied client - create one if required
+            if self.client is None:
+                self.client = wrapped_class(*self.args, **self.kwargs)
+            return getattr(self.client, name)
+
+        def close(self):
+            # Close the client if it is open
+            if self.client:
+                self.client.close()
+                self.client = None
+
+        def __iter__(self, *args, **kwargs):
+            # We have to override this as debuggers invoke it causing the client to reopen
+            if self.client:
+                return self.client.iter(*args, **kwargs)
+            return object.__getattribute__(self, 'iter')(*args, **kwargs)
+
+        @property
+        def is_closed(self):
+            # Check if closed
+            if self.client is None:
+                return True
+            return self.client.is_closed
+
+    httpx.Client = ClientProxy
+    try:
+        yield
+    finally:
+        httpx.Client = wrapped_class
+        while proxys:
+            proxy = proxys.pop()
+            proxy.close()

poetry.lock

@@ -5152,8 +5152,11 @@ files = [
     {file = "lxml-5.4.0-cp36-cp36m-win_amd64.whl", hash = "sha256:7ce1a171ec325192c6a636b64c94418e71a1964f56d002cc28122fceff0b6121"},
     {file = "lxml-5.4.0-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:795f61bcaf8770e1b37eec24edf9771b307df3af74d1d6f27d812e15a9ff3872"},
     {file = "lxml-5.4.0-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:29f451a4b614a7b5b6c2e043d7b64a15bd8304d7e767055e8ab68387a8cacf4e"},
+    {file = "lxml-5.4.0-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:891f7f991a68d20c75cb13c5c9142b2a3f9eb161f1f12a9489c82172d1f133c0"},
     {file = "lxml-5.4.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4aa412a82e460571fad592d0f93ce9935a20090029ba08eca05c614f99b0cc92"},
+    {file = "lxml-5.4.0-cp37-cp37m-manylinux_2_28_aarch64.whl", hash = "sha256:ac7ba71f9561cd7d7b55e1ea5511543c0282e2b6450f122672a2694621d63b7e"},
     {file = "lxml-5.4.0-cp37-cp37m-manylinux_2_28_x86_64.whl", hash = "sha256:c5d32f5284012deaccd37da1e2cd42f081feaa76981f0eaa474351b68df813c5"},
+    {file = "lxml-5.4.0-cp37-cp37m-musllinux_1_2_aarch64.whl", hash = "sha256:ce31158630a6ac85bddd6b830cffd46085ff90498b397bd0a259f59d27a12188"},
     {file = "lxml-5.4.0-cp37-cp37m-musllinux_1_2_x86_64.whl", hash = "sha256:31e63621e073e04697c1b2d23fcb89991790eef370ec37ce4d5d469f40924ed6"},
     {file = "lxml-5.4.0-cp37-cp37m-win32.whl", hash = "sha256:be2ba4c3c5b7900246a8f866580700ef0d538f2ca32535e991027bdaba944063"},
     {file = "lxml-5.4.0-cp37-cp37m-win_amd64.whl", hash = "sha256:09846782b1ef650b321484ad429217f5154da4d6e786636c38e434fa32e94e49"},
@@ -5227,6 +5230,22 @@ files = [
 [package.dependencies]
 cobble = ">=0.1.3,<0.2"
 
+[[package]]
+name = "markdown"
+version = "3.8.2"
+description = "Python implementation of John Gruber's Markdown."
+optional = false
+python-versions = ">=3.9"
+groups = ["main"]
+files = [
+    {file = "markdown-3.8.2-py3-none-any.whl", hash = "sha256:5c83764dbd4e00bdd94d85a19b8d55ccca20fe35b2e678a1422b380324dd5f24"},
+    {file = "markdown-3.8.2.tar.gz", hash = "sha256:247b9a70dd12e27f67431ce62523e675b866d254f900c4fe75ce3dda62237c45"},
+]
+
+[package.extras]
+docs = ["mdx_gh_links (>=0.2)", "mkdocs (>=1.6)", "mkdocs-gen-files", "mkdocs-literate-nav", "mkdocs-nature (>=0.6)", "mkdocs-section-index", "mkdocstrings[python]"]
+testing = ["coverage", "pyyaml"]
+
 [[package]]
 name = "markdown-it-py"
 version = "3.0.0"
@@ -11766,4 +11785,4 @@ third-party-runtimes = ["daytona", "e2b", "modal", "runloop-api-client"]
 [metadata]
 lock-version = "2.1"
 python-versions = "^3.12,<3.14"
-content-hash = "8568c6ec2e11d4fcb23e206a24896b4d2d50e694c04011b668148f484e95b406"
+content-hash = "d83111cc28bf935f1c759d3ce07a21c69a85f6df035db26042326bd8fba4969f"

pyproject.toml

@@ -58,6 +58,7 @@ whatthepatch = "^1.0.6"
 protobuf = "^5.0.0,<6.0.0"                         # Updated to support newer opentelemetry
 opentelemetry-api = "^1.33.1"
 opentelemetry-exporter-otlp-proto-grpc = "^1.33.1"
+markdown = "^3.6"                                  # Required for CLI TUI rendering
 
 libtmux = ">=0.37,<0.40"
 pygithub = "^2.5.0"

tests/unit/test_ensure_httpx_close.py

@@ -0,0 +1,69 @@
+import httpx
+
+from openhands.utils.ensure_httpx_close import ensure_httpx_close
+
+
+def test_ensure_httpx_close_basic():
+    """Test basic functionality of ensure_httpx_close."""
+    ctx = ensure_httpx_close()
+    with ctx:
+        # Create a client - should be tracked
+        client = httpx.Client()
+
+    # After context exit, client should be closed
+    assert client.is_closed
+
+
+def test_ensure_httpx_close_multiple_clients():
+    """Test ensure_httpx_close with multiple clients."""
+    ctx = ensure_httpx_close()
+    with ctx:
+        client1 = httpx.Client()
+        client2 = httpx.Client()
+
+    assert client1.is_closed
+    assert client2.is_closed
+
+
+def test_ensure_httpx_close_nested():
+    """Test nested usage of ensure_httpx_close."""
+    with ensure_httpx_close():
+        client1 = httpx.Client()
+
+        with ensure_httpx_close():
+            client2 = httpx.Client()
+            assert not client2.is_closed
+
+        # After inner context, client2 should be closed
+        assert client2.is_closed
+        # client1 should still be open since outer context is still active
+        assert not client1.is_closed
+
+    # After outer context, both clients should be closed
+    assert client1.is_closed
+    assert client2.is_closed
+
+
+def test_ensure_httpx_close_exception():
+    """Test ensure_httpx_close when an exception occurs."""
+    client = None
+    try:
+        with ensure_httpx_close():
+            client = httpx.Client()
+            raise ValueError('Test exception')
+    except ValueError:
+        pass
+
+    # Client should be closed even if an exception occurred
+    assert client is not None
+    assert client.is_closed
+
+
+def test_ensure_httpx_close_restore_client():
+    """Test that the original client is restored after context exit."""
+    original_client = httpx.Client
+    with ensure_httpx_close():
+        assert httpx.Client != original_client
+
+    # Original __init__ should be restored
+    assert httpx.Client == original_client