Merge branch 'main' into jps/telemetry-m2

- Fix import ordering in clustered_conversation_manager.py
- Fix trailing whitespace and import ordering in minimal_conversation_metadata.py
- Ensure all pre-commit hooks pass

Co-authored-by: openhands <openhands@all-hands.dev>

.github/CODEOWNERS

@@ -1,8 +1,12 @@
 # CODEOWNERS file for OpenHands repository
 # See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
 
-/frontend/ @amanape @hieptl
-/openhands-ui/ @amanape @hieptl
-/openhands/ @tofarr @malhotra5 @hieptl
-/enterprise/ @chuckbutkus @tofarr @malhotra5
+# Frontend code owners
+/frontend/ @amanape
+/openhands-ui/ @amanape
+
+# Evaluation code owners
 /evaluation/ @xingyaoww @neubig
+
+# Documentation code owners
+/docs/ @mamoodi

.github/workflows/check-package-versions.yml

@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
         with:
           python-version: "3.12"
 

.github/workflows/e2e-tests.yml

@@ -27,7 +27,7 @@ jobs:
           poetry-version: 2.1.3
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
         with:
           python-version: '3.12'
           cache: 'poetry'
@@ -38,7 +38,7 @@ jobs:
           sudo apt-get install -y libgtk-3-0 libnotify4 libnss3 libxss1 libxtst6 xauth xvfb libgbm1 libasound2t64 netcat-openbsd
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: '22'
           cache: 'npm'
@@ -192,7 +192,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
         with:
           name: playwright-report
           path: tests/e2e/test-results/
@@ -200,7 +200,7 @@ jobs:
 
       - name: Upload OpenHands logs
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
         with:
           name: openhands-logs
           path: |

.github/workflows/enterprise-check-migrations.yml

@@ -43,7 +43,7 @@ jobs:
             ⚠️ This PR contains **migrations**
 
       - name: Comment warning on PR
-        uses: peter-evans/create-or-update-comment@v5
+        uses: peter-evans/create-or-update-comment@v4
         with:
           issue-number: ${{ github.event.pull_request.number }}
           comment-id: ${{ steps.find-comment.outputs.comment-id }}

.github/workflows/enterprise-preview.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Trigger remote job
         run: |
           curl --fail-with-body -sS -X POST \
-            -H "Authorization: Bearer ${{ secrets.ALLHANDS_BOT_GITHUB_PAT }}" \
+            -H "Authorization: Bearer ${{ secrets.PAT_TOKEN }}" \
             -H "Accept: application/vnd.github+json" \
             -d "{\"ref\": \"main\", \"inputs\": {\"openhandsPrNumber\": \"${{ github.event.pull_request.number }}\", \"deployEnvironment\": \"feature\", \"enterpriseImageTag\": \"pr-${{ github.event.pull_request.number }}\" }}" \
             https://api.github.com/repos/OpenHands/deploy/actions/workflows/deploy.yaml/dispatches

.github/workflows/fe-e2e-tests.yml

@@ -39,7 +39,7 @@ jobs:
         working-directory: ./frontend
         run: npx playwright test --project=chromium
       - name: Upload Playwright report
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
         if: always()
         with:
           name: playwright-report

.github/workflows/ghcr-build.yml

@@ -64,7 +64,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.7.0
+        uses: docker/setup-qemu-action@v3.6.0
         with:
           image: tonistiigi/binfmt:latest
       - name: Login to GHCR
@@ -102,7 +102,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.7.0
+        uses: docker/setup-qemu-action@v3.6.0
         with:
           image: tonistiigi/binfmt:latest
       - name: Login to GHCR
@@ -161,7 +161,7 @@ jobs:
           context: containers/runtime
       - name: Upload runtime source for fork
         if: github.event.pull_request.head.repo.fork
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
         with:
           name: runtime-src-${{ matrix.base_image.tag }}
           path: containers/runtime
@@ -247,7 +247,7 @@ jobs:
       - name: Trigger remote job
         run: |
           curl --fail-with-body -sS -X POST \
-            -H "Authorization: Bearer ${{ secrets.ALLHANDS_BOT_GITHUB_PAT }}" \
+            -H "Authorization: Bearer ${{ secrets.PAT_TOKEN }}" \
             -H "Accept: application/vnd.github+json" \
             -d "{\"ref\": \"main\", \"inputs\": {\"openhandsPrNumber\": \"${{ github.event.pull_request.number }}\", \"deployEnvironment\": \"feature\", \"enterpriseImageTag\": \"pr-${{ github.event.pull_request.number }}\" }}" \
             https://api.github.com/repos/OpenHands/deploy/actions/workflows/deploy.yaml/dispatches
@@ -268,7 +268,7 @@ jobs:
         uses: docker/setup-buildx-action@v3
       - name: Download runtime source for fork
         if: github.event.pull_request.head.repo.fork
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v4
         with:
           name: runtime-src-${{ matrix.base_image.tag }}
           path: containers/runtime
@@ -330,7 +330,7 @@ jobs:
         uses: docker/setup-buildx-action@v3
       - name: Download runtime source for fork
         if: github.event.pull_request.head.repo.fork
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v4
         with:
           name: runtime-src-${{ matrix.base_image.tag }}
           path: containers/runtime

.github/workflows/openhands-resolver.yml

@@ -89,7 +89,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
         with:
           python-version: "3.12"
       - name: Upgrade pip
@@ -118,7 +118,7 @@ jobs:
               contains(github.event.review.body, '@openhands-agent-exp')
             )
           )
-        uses: actions/cache@v5
+        uses: actions/cache@v4
         with:
           path: ${{ env.pythonLocation }}/lib/python3.12/site-packages/*
           key: ${{ runner.os }}-pip-openhands-resolver-${{ hashFiles('/tmp/requirements.txt') }}
@@ -269,7 +269,7 @@ jobs:
           fi
 
       - name: Upload output.jsonl as artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
         if: always() # Upload even if the previous steps fail
         with:
           name: resolver-output

.github/workflows/py-tests.yml

@@ -63,7 +63,7 @@ jobs:
         env:
           COVERAGE_FILE: ".coverage.runtime.${{ matrix.python_version }}"
       - name: Store coverage file
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
         with:
           name: coverage-openhands
           path: |
@@ -95,7 +95,7 @@ jobs:
         env:
           COVERAGE_FILE: ".coverage.enterprise.${{ matrix.python_version }}"
       - name: Store coverage file
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
         with:
           name: coverage-enterprise
           path: ".coverage.enterprise.${{ matrix.python_version }}"
@@ -113,7 +113,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@v5
         id: download
         with:
           pattern: coverage-*

.github/workflows/stale.yml

@@ -9,7 +9,6 @@ on:
 jobs:
   stale:
     runs-on: blacksmith-4vcpu-ubuntu-2204
-    if: github.repository == 'OpenHands/OpenHands'
     steps:
       - uses: actions/stale@v9
         with:

.github/workflows/vscode-extension-build.yml

@@ -0,0 +1,156 @@
+# Workflow that validates the VSCode extension builds correctly
+name: VSCode Extension CI
+
+# * Always run on "main"
+# * Run on PRs that have changes in the VSCode extension folder or this workflow
+# * Run on tags that start with "ext-v"
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - 'ext-v*'
+  pull_request:
+    paths:
+      - 'openhands/integrations/vscode/**'
+      - 'build_vscode.py'
+      - '.github/workflows/vscode-extension-build.yml'
+
+# If triggered by a PR, it will be in the same group. However, each commit on main will be in its own unique group
+concurrency:
+  group: ${{ github.workflow }}-${{ (github.head_ref && github.ref) || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  # Validate VSCode extension builds correctly
+  validate-vscode-extension:
+    name: Validate VSCode Extension Build
+    runs-on: blacksmith-4vcpu-ubuntu-2204
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: useblacksmith/setup-node@v5
+        with:
+          node-version: '22'
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install VSCode extension dependencies
+        working-directory: ./openhands/integrations/vscode
+        run: npm ci
+
+      - name: Build VSCode extension via build_vscode.py
+        run: python build_vscode.py
+        env:
+          # Ensure we don't skip the build
+          SKIP_VSCODE_BUILD: ""
+
+      - name: Validate .vsix file
+        run: |
+          # Verify the .vsix was created and is valid
+          if [ -f "openhands/integrations/vscode/openhands-vscode-0.0.1.vsix" ]; then
+            echo "✅ VSCode extension built successfully"
+            ls -la openhands/integrations/vscode/openhands-vscode-0.0.1.vsix
+
+            # Basic validation that the .vsix is a valid zip file
+            echo "🔍 Validating .vsix structure..."
+            file openhands/integrations/vscode/openhands-vscode-0.0.1.vsix
+            unzip -t openhands/integrations/vscode/openhands-vscode-0.0.1.vsix
+
+            echo "✅ VSCode extension validation passed"
+          else
+            echo "❌ VSCode extension build failed - .vsix not found"
+            exit 1
+          fi
+
+      - name: Upload VSCode extension artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: vscode-extension
+          path: openhands/integrations/vscode/openhands-vscode-0.0.1.vsix
+          retention-days: 7
+
+      - name: Comment on PR with artifact link
+        if: github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const path = require('path');
+
+            // Get file size for display
+            const vsixPath = 'openhands/integrations/vscode/openhands-vscode-0.0.1.vsix';
+            const stats = fs.statSync(vsixPath);
+            const fileSizeKB = Math.round(stats.size / 1024);
+
+            const comment = `## 🔧 VSCode Extension Built Successfully!
+
+            The VSCode extension has been built and is ready for testing.
+
+            **📦 Download**: [openhands-vscode-0.0.1.vsix](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) (${fileSizeKB} KB)
+
+            **🚀 To install**:
+            1. Download the artifact from the workflow run above
+            2. In VSCode: \`Ctrl+Shift+P\` → "Extensions: Install from VSIX..."
+            3. Select the downloaded \`.vsix\` file
+
+            **✅ Tested with**: Node.js 22
+            **🔍 Validation**: File structure and integrity verified
+
+            ---
+            *Built from commit ${{ github.sha }}*`;
+
+            // Check if we already commented on this PR and delete it
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+
+            const botComment = comments.find(comment =>
+              comment.user.login === 'github-actions[bot]' &&
+              comment.body.includes('VSCode Extension Built Successfully')
+            );
+
+            if (botComment) {
+              await github.rest.issues.deleteComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: botComment.id,
+              });
+            }
+
+            // Create a new comment
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: comment
+            });
+
+  release:
+    name: Create GitHub Release
+    runs-on: blacksmith-4vcpu-ubuntu-2204
+    needs: validate-vscode-extension
+    if: startsWith(github.ref, 'refs/tags/ext-v')
+
+    steps:
+      - name: Download .vsix artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: vscode-extension
+          path: ./
+
+      - name: Create Release
+        uses: ncipollo/release-action@v1.16.0
+        with:
+          artifacts: "*.vsix"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          draft: true
+          allowUpdates: true

.openhands/microagents/repo.md

@@ -150,9 +150,9 @@ Each integration follows a consistent pattern with service classes, storage mode
 
 **Important Notes:**
 - Enterprise code is licensed under Polyform Free Trial License (30-day limit)
-- The enterprise server extends the OpenHands server through dynamic imports
+- The enterprise server extends the OSS server through dynamic imports
 - Database changes require careful migration planning in `enterprise/migrations/`
-- Always test changes in both OpenHands and enterprise contexts
+- Always test changes in both OSS and enterprise contexts
 - Use the enterprise-specific Makefile commands for development
 
 **Enterprise Testing Best Practices:**
@@ -166,7 +166,7 @@ Each integration follows a consistent pattern with service classes, storage mode
 **Import Patterns:**
 - Use relative imports without `enterprise.` prefix in enterprise code
 - Example: `from storage.database import session_maker` not `from enterprise.storage.database import session_maker`
-- This ensures code works in both OpenHands and enterprise contexts
+- This ensures code works in both OSS and enterprise contexts
 
 **Test Structure:**
 - Place tests in `enterprise/tests/unit/` following the same structure as the source code

.openhands/pre-commit.sh

@@ -13,6 +13,7 @@ STAGED_FILES=$(git diff --cached --name-only)
 # Check if any files match specific patterns
 has_frontend_changes=false
 has_backend_changes=false
+has_vscode_changes=false
 
 # Check each file individually to avoid issues with grep
 for file in $STAGED_FILES; do
@@ -20,12 +21,17 @@ for file in $STAGED_FILES; do
         has_frontend_changes=true
     elif [[ $file == openhands/* || $file == evaluation/* || $file == tests/* ]]; then
         has_backend_changes=true
+        # Check for VSCode extension changes (subset of backend changes)
+        if [[ $file == openhands/integrations/vscode/* ]]; then
+            has_vscode_changes=true
+        fi
     fi
 done
 
 echo "Analyzing changes..."
 echo "- Frontend changes: $has_frontend_changes"
 echo "- Backend changes: $has_backend_changes"
+echo "- VSCode extension changes: $has_vscode_changes"
 
 # Run frontend linting if needed
 if [ "$has_frontend_changes" = true ]; then
@@ -86,6 +92,51 @@ else
     echo "Skipping backend checks (no backend changes detected)."
 fi
 
+# Run VSCode extension checks if needed
+if [ "$has_vscode_changes" = true ]; then
+    # Check if we're in a CI environment
+    if [ -n "$CI" ]; then
+        echo "Skipping VSCode extension checks (CI environment detected)."
+        echo "WARNING: VSCode extension files have changed but checks are being skipped."
+        echo "Please run VSCode extension checks manually before submitting your PR."
+    else
+        echo "Running VSCode extension checks..."
+        if [ -d "openhands/integrations/vscode" ]; then
+            cd openhands/integrations/vscode || exit 1
+
+            echo "Running npm lint:fix..."
+            npm run lint:fix
+            if [ $? -ne 0 ]; then
+                echo "VSCode extension linting failed. Please fix the issues before committing."
+                EXIT_CODE=1
+            else
+                echo "VSCode extension linting passed!"
+            fi
+
+            echo "Running npm typecheck..."
+            npm run typecheck
+            if [ $? -ne 0 ]; then
+                echo "VSCode extension type checking failed. Please fix the issues before committing."
+                EXIT_CODE=1
+            else
+                echo "VSCode extension type checking passed!"
+            fi
+
+            echo "Running npm compile..."
+            npm run compile
+            if [ $? -ne 0 ]; then
+                echo "VSCode extension compilation failed. Please fix the issues before committing."
+                EXIT_CODE=1
+            else
+                echo "VSCode extension compilation passed!"
+            fi
+
+            cd ../../..
+        fi
+    fi
+else
+    echo "Skipping VSCode extension checks (no VSCode extension changes detected)."
+fi
 
 # If no specific code changes detected, run basic checks
 if [ "$has_frontend_changes" = false ] && [ "$has_backend_changes" = false ]; then

CONTRIBUTING.md

@@ -31,7 +31,7 @@ We're always looking to improve the look and feel of the application. If you've
 for something that's bugging you, feel free to open up a PR that changes the [`./frontend`](./frontend) directory.
 
 If you're looking to make a bigger change, add a new UI element, or significantly alter the style
-of the application, please open an issue first, or better, join the #dev-ui-ux channel in our Slack
+of the application, please open an issue first, or better, join the #eng-ui-ux channel in our Slack
 to gather consensus from our design team first.
 
 #### Improving the agent

Development.md

@@ -161,7 +161,7 @@ poetry run pytest ./tests/unit/test_*.py
 To reduce build time (e.g., if no changes were made to the client-runtime component), you can use an existing Docker
 container image by setting the SANDBOX_RUNTIME_CONTAINER_IMAGE environment variable to the desired Docker image.
 
-Example: `export SANDBOX_RUNTIME_CONTAINER_IMAGE=ghcr.io/openhands/runtime:1.1-nikolaik`
+Example: `export SANDBOX_RUNTIME_CONTAINER_IMAGE=ghcr.io/openhands/runtime:1.0-nikolaik`
 
 ## Develop inside Docker container
 

build_vscode.py

@@ -0,0 +1,113 @@
+import os
+import pathlib
+import subprocess
+
+# This script is intended to be run by Poetry during the build process.
+
+# Define the expected name of the .vsix file based on the extension's package.json
+# This should match the name and version in openhands-vscode/package.json
+EXTENSION_NAME = 'openhands-vscode'
+EXTENSION_VERSION = '0.0.1'
+VSIX_FILENAME = f'{EXTENSION_NAME}-{EXTENSION_VERSION}.vsix'
+
+# Paths
+ROOT_DIR = pathlib.Path(__file__).parent.resolve()
+VSCODE_EXTENSION_DIR = ROOT_DIR / 'openhands' / 'integrations' / 'vscode'
+
+
+def check_node_version():
+    """Check if Node.js version is sufficient for building the extension."""
+    try:
+        result = subprocess.run(
+            ['node', '--version'], capture_output=True, text=True, check=True
+        )
+        version_str = result.stdout.strip()
+        # Extract major version number (e.g., "v12.22.9" -> 12)
+        major_version = int(version_str.lstrip('v').split('.')[0])
+        return major_version >= 18  # Align with frontend actual usage (18.20.1)
+    except (subprocess.CalledProcessError, FileNotFoundError, ValueError):
+        return False
+
+
+def build_vscode_extension():
+    """Builds the VS Code extension."""
+    vsix_path = VSCODE_EXTENSION_DIR / VSIX_FILENAME
+
+    # Check if VSCode extension build is disabled via environment variable
+    if os.environ.get('SKIP_VSCODE_BUILD', '').lower() in ('1', 'true', 'yes'):
+        print('--- Skipping VS Code extension build (SKIP_VSCODE_BUILD is set) ---')
+        if vsix_path.exists():
+            print(f'--- Using existing VS Code extension: {vsix_path} ---')
+        else:
+            print('--- No pre-built VS Code extension found ---')
+        return
+
+    # Check Node.js version - if insufficient, use pre-built extension as fallback
+    if not check_node_version():
+        print('--- Warning: Node.js version < 18 detected or Node.js not found ---')
+        print('--- Skipping VS Code extension build (requires Node.js >= 18) ---')
+        print('--- Using pre-built extension if available ---')
+
+        if not vsix_path.exists():
+            print('--- Warning: No pre-built VS Code extension found ---')
+            print('--- VS Code extension will not be available ---')
+        else:
+            print(f'--- Using pre-built VS Code extension: {vsix_path} ---')
+        return
+
+    print(f'--- Building VS Code extension in {VSCODE_EXTENSION_DIR} ---')
+
+    try:
+        # Ensure npm dependencies are installed
+        print('--- Running npm install for VS Code extension ---')
+        subprocess.run(
+            ['npm', 'install'],
+            cwd=VSCODE_EXTENSION_DIR,
+            check=True,
+            shell=os.name == 'nt',
+        )
+
+        # Package the extension
+        print(f'--- Packaging VS Code extension ({VSIX_FILENAME}) ---')
+        subprocess.run(
+            ['npm', 'run', 'package-vsix'],
+            cwd=VSCODE_EXTENSION_DIR,
+            check=True,
+            shell=os.name == 'nt',
+        )
+
+        # Verify the generated .vsix file exists
+        if not vsix_path.exists():
+            raise FileNotFoundError(
+                f'VS Code extension package not found after build: {vsix_path}'
+            )
+
+        print(f'--- VS Code extension built successfully: {vsix_path} ---')
+
+    except subprocess.CalledProcessError as e:
+        print(f'--- Warning: Failed to build VS Code extension: {e} ---')
+        print('--- Continuing without building extension ---')
+        if not vsix_path.exists():
+            print('--- Warning: No pre-built VS Code extension found ---')
+            print('--- VS Code extension will not be available ---')
+
+
+def build(setup_kwargs):
+    """This function is called by Poetry during the build process.
+    `setup_kwargs` is a dictionary that will be passed to `setuptools.setup()`.
+    """
+    print('--- Running custom Poetry build script (build_vscode.py) ---')
+
+    # Build the VS Code extension and place the .vsix file
+    build_vscode_extension()
+
+    # Poetry will handle including files based on pyproject.toml `include` patterns.
+    # Ensure openhands/integrations/vscode/*.vsix is included there.
+
+    print('--- Custom Poetry build script (build_vscode.py) finished ---')
+
+
+if __name__ == '__main__':
+    print('Running build_vscode.py directly for testing VS Code extension packaging...')
+    build_vscode_extension()
+    print('Direct execution of build_vscode.py finished.')

containers/app/Dockerfile

@@ -1,5 +1,5 @@
 ARG OPENHANDS_BUILD_VERSION=dev
-FROM node:25.2-trixie-slim AS frontend-builder
+FROM node:24.8-trixie-slim AS frontend-builder
 
 WORKDIR /app
 

containers/dev/compose.yml

@@ -12,7 +12,7 @@ services:
       - SANDBOX_API_HOSTNAME=host.docker.internal
       - DOCKER_HOST_ADDR=host.docker.internal
       #
-      - SANDBOX_RUNTIME_CONTAINER_IMAGE=${SANDBOX_RUNTIME_CONTAINER_IMAGE:-ghcr.io/openhands/runtime:1.1-nikolaik}
+      - SANDBOX_RUNTIME_CONTAINER_IMAGE=${SANDBOX_RUNTIME_CONTAINER_IMAGE:-ghcr.io/openhands/runtime:1.0-nikolaik}
       - SANDBOX_USER_ID=${SANDBOX_USER_ID:-1234}
       - WORKSPACE_MOUNT_PATH=${WORKSPACE_BASE:-$PWD/workspace}
     ports:

dev_config/python/.pre-commit-config.yaml

@@ -10,15 +10,6 @@ repos:
         args: ["--allow-multiple-documents"]
       - id: debug-statements
 
-
-  - repo: local
-    hooks:
-      - id: warn-appmode-oss
-        name: "Warn on AppMode.OSS in backend (use AppMode.OPENHANDS)"
-        language: system
-        entry: bash -lc 'if rg -n "\\bAppMode\\.OSS\\b" openhands tests/unit; then echo "Found AppMode.OSS usage. Prefer AppMode.OPENHANDS."; exit 1; fi'
-        pass_filenames: false
-
   - repo: https://github.com/tox-dev/pyproject-fmt
     rev: v2.5.1
     hooks:

docker-compose.yml

@@ -7,7 +7,7 @@ services:
     image: openhands:latest
     container_name: openhands-app-${DATE:-}
     environment:
-      - SANDBOX_RUNTIME_CONTAINER_IMAGE=${SANDBOX_RUNTIME_CONTAINER_IMAGE:-docker.openhands.dev/openhands/runtime:1.1-nikolaik}
+      - SANDBOX_RUNTIME_CONTAINER_IMAGE=${SANDBOX_RUNTIME_CONTAINER_IMAGE:-docker.openhands.dev/openhands/runtime:1.0-nikolaik}
       #- SANDBOX_USER_ID=${SANDBOX_USER_ID:-1234} # enable this only if you want a specific non-root sandbox user but you will have to manually adjust permissions of ~/.openhands for this user
       - WORKSPACE_MOUNT_PATH=${WORKSPACE_BASE:-$PWD/workspace}
     ports:

enterprise/Dockerfile

@@ -31,8 +31,9 @@ RUN pip install alembic psycopg2-binary cloud-sql-python-connector pg8000 gsprea
         "pillow>=11.3.0"
 
 WORKDIR /app
-COPY --chown=openhands:openhands --chmod=770 enterprise .
+COPY enterprise .
 
+RUN chown -R openhands:openhands /app && chmod -R 770 /app
 USER openhands
 
 # Command will be overridden by Kubernetes deployment template

enterprise/README.md

@@ -10,13 +10,13 @@ This directory contains the enterprise server used by [OpenHands Cloud](https://
 
 You may also want to check out the MIT-licensed [OpenHands](https://github.com/OpenHands/OpenHands)
 
-## Extension of OpenHands
+## Extension of OpenHands (OSS)
 
-The code in `/enterprise` builds on top of OpenHands (MIT-licensed), extending its functionality. The enterprise code is entangled with OpenHands in two ways:
+The code in `/enterprise` directory builds on top of open source (OSS) code, extending its functionality. The enterprise code is entangled with the OSS code in two ways
 
-- Enterprise stacks on top of OpenHands. For example, the middleware in enterprise is stacked right on top of the middlewares in OpenHands. In `SAAS`, the middleware from BOTH repos will be present and running (which can sometimes cause conflicts)
+- Enterprise stacks on top of OSS. For example, the middleware in enterprise is stacked right on top of the middlewares in OSS. In `SAAS`, the middleware from BOTH repos will be present and running (which can sometimes cause conflicts)
 
-- Enterprise overrides the implementation in OpenHands (only one is present at a time). For example, the server config SaasServerConfig overrides [`ServerConfig`](https://github.com/OpenHands/OpenHands/blob/main/openhands/server/config/server_config.py#L8) in OpenHands. This is done through dynamic imports ([see here](https://github.com/OpenHands/OpenHands/blob/main/openhands/server/config/server_config.py#L37-#L45))
+- Enterprise overrides the implementation in OSS (only one is present at a time). For example, the server config SaasServerConfig which overrides [`ServerConfig`](https://github.com/OpenHands/OpenHands/blob/main/openhands/server/config/server_config.py#L8) on OSS. This is done through dynamic imports ([see here](https://github.com/OpenHands/OpenHands/blob/main/openhands/server/config/server_config.py#L37-#L45))
 
 Key areas that change on `SAAS` are
 
@@ -26,11 +26,11 @@ Key areas that change on `SAAS` are
 
 ### Authentication
 
-| Aspect                    | OpenHands                                              | Enterprise                                                                                                                                 |
+| Aspect                    | OSS                                                    | Enterprise                                                                                                                                 |
 | ------------------------- | ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------- |
-| **Authentication Method** | User adds a personal access token (PAT) through the UI | User performs OAuth through the UI. The GitHub app provides a short-lived access token and refresh token                            |
+| **Authentication Method** | User adds a personal access token (PAT) through the UI | User performs OAuth through the UI. The Github app provides a short-lived access token and refresh token                            |
 | **Token Storage**         | PAT is stored in **Settings**                          | Token is stored in **GithubTokenManager** (a file store in our backend)                                                             |
-| **Authenticated status**  | We simply check if token exists in `Settings`          | We issue a signed cookie with `github_user_id` during OAuth, so subsequent requests with the cookie can be considered authenticated |
+| **Authenticated status**  | We simply check if token exists in `Settings`          | We issue a signed cookie with `github_user_id` during oauth, so subsequent requests with the cookie can be considered authenticated |
 
 Note that in the future, authentication will happen via keycloak. All modifications for authentication will happen in enterprise.
 
@@ -38,7 +38,7 @@ Note that in the future, authentication will happen via keycloak. All modificati
 
 The github service is responsible for interacting with Github APIs. As a consequence, it uses the user's token and refreshes it if need be
 
-| Aspect                    | OpenHands                               | Enterprise                                            |
+| Aspect                    | OSS                                    | Enterprise                                            |
 | ------------------------- | -------------------------------------- | ---------------------------------------------- |
 | **Class used**            | `GitHubService`                        | `SaaSGitHubService`                            |
 | **Token used**            | User's PAT fetched from `Settings`     | User's token fetched from `GitHubTokenManager` |
@@ -50,7 +50,7 @@ NOTE: in the future we will simply replace the `GithubTokenManager` with keycloa
 
 ## User ID vs User Token
 
-- In OpenHands, the entire app revolves around the GitHub token the user sets. `openhands/server` uses `request.state.github_token` for the entire app
+- On OSS, the entire APP revolves around the Github token the user sets. `openhands/server` uses `request.state.github_token` for the entire app
 - On Enterprise, the entire APP resolves around the Github User ID. This is because the cookie sets it, so `openhands/server` AND `enterprise/server` depend on it and completly ignore `request.state.github_token` (token is fetched from `GithubTokenManager` instead)
 
-Note that introducing GitHub User ID in OpenHands, for instance, will cause large breakages.
+Note that introducing Github User ID on OSS, for instance, will cause large breakages.

enterprise/enterprise_local/README.md

@@ -2,7 +2,7 @@
 
 You have a few options here, which are expanded on below:
 
-- A simple local development setup, with live reloading for both OpenHands and this repo
+- A simple local development setup, with live reloading for both OSS and this repo
 - A more complex setup that includes Redis
 - An even more complex setup that includes GitHub events
 
@@ -26,7 +26,7 @@ Before starting, make sure you have the following tools installed:
 
 ## Option 1: Simple local development
 
-This option will allow you to modify both the OpenHands code and the code in this repo,
+This option will allow you to modify the both the OSS code and the code in this repo,
 and see the changes in real-time.
 
 This option works best for most scenarios. The only thing it's missing is
@@ -50,7 +50,7 @@ First run this to retrieve Github App secrets
 ```
 gcloud auth application-default login
 gcloud config set project global-432717
-enterprise_local/decrypt_env.sh /path/to/root/of/deploy/repo
+local/decrypt_env.sh
 ```
 
 Now run this to generate a `.env` file, which will used to run SAAS locally
@@ -105,7 +105,7 @@ export REDIS_PORT=6379
 
 (see above)
 
-### 2. Build OpenHands
+### 2. Build OSS Openhands
 
 Develop on [Openhands](https://github.com/All-Hands-AI/OpenHands) locally. When ready, run the following inside Openhands repo (not the Deploy repo)
 
@@ -155,7 +155,7 @@ Visit the tunnel domain found in Step 4 to run the app (`https://bc71-2603-7000-
 
 ### Local Debugging with VSCode
 
-Local Development necessitates running a version of OpenHands that is as similar as possible to the version running in the SAAS Environment. Before running these steps, it is assumed you have a local development version of OpenHands running.
+Local Development necessitates running a version of OpenHands that is as similar as possible to the version running in the SAAS Environment. Before running these steps, it is assumed you have a local development version of the OSS OpenHands project running.
 
 #### Redis
 
@@ -201,8 +201,8 @@ And then invoking `printenv`. NOTE: _DO NOT DO THIS WITH PROD!!!_ (Hopefully by
                 "DEBUG": "1",
                 "FILE_STORE": "local",
                 "REDIS_HOST": "localhost:6379",
-                "OPENHANDS": "<YOUR LOCAL OPENHANDS DIR>",
-                "FRONTEND_DIRECTORY": "<YOUR LOCAL OPENHANDS DIR>/frontend/build",
+                "OPENHANDS": "<YOUR LOCAL OSS OPENHANDS DIR>",
+                "FRONTEND_DIRECTORY": "<YOUR LOCAL OSS OPENHANDS DIR>/frontend/build",
                 "SANDBOX_RUNTIME_CONTAINER_IMAGE": "ghcr.io/openhands/runtime:main-nikolaik",
                 "FILE_STORE_PATH": "<YOUR HOME DIRECTORY>>/.openhands-state",
                 "OPENHANDS_CONFIG_CLS": "server.config.SaaSServerConfig",
@@ -235,8 +235,8 @@ And then invoking `printenv`. NOTE: _DO NOT DO THIS WITH PROD!!!_ (Hopefully by
                 "DEBUG": "1",
                 "FILE_STORE": "local",
                 "REDIS_HOST": "localhost:6379",
-                "OPENHANDS": "<YOUR LOCAL OPENHANDS DIR>",
-                "FRONTEND_DIRECTORY": "<YOUR LOCAL OPENHANDS DIR>/frontend/build",
+                "OPENHANDS": "<YOUR LOCAL OSS OPENHANDS DIR>",
+                "FRONTEND_DIRECTORY": "<YOUR LOCAL OSS OPENHANDS DIR>/frontend/build",
                 "SANDBOX_RUNTIME_CONTAINER_IMAGE": "ghcr.io/openhands/runtime:main-nikolaik",
                 "FILE_STORE_PATH": "<YOUR HOME DIRECTORY>>/.openhands-state",
                 "OPENHANDS_CONFIG_CLS": "server.config.SaaSServerConfig",

enterprise/enterprise_local/convert_to_env.py

@@ -116,7 +116,7 @@ lines.append('POSTHOG_CLIENT_KEY=test')
 lines.append('ENABLE_PROACTIVE_CONVERSATION_STARTERS=true')
 lines.append('MAX_CONCURRENT_CONVERSATIONS=10')
 lines.append('LITE_LLM_API_URL=https://llm-proxy.eval.all-hands.dev')
-lines.append('LITELLM_DEFAULT_MODEL=litellm_proxy/claude-opus-4-5-20251101')
+lines.append('LITELLM_DEFAULT_MODEL=litellm_proxy/claude-sonnet-4-20250514')
 lines.append(f'LITE_LLM_API_KEY={lite_llm_api_key}')
 lines.append('LOCAL_DEPLOYMENT=true')
 lines.append('DB_HOST=localhost')

enterprise/enterprise_local/decrypt_env.sh

@@ -4,12 +4,12 @@ set -euo pipefail
 # Check if DEPLOY_DIR argument was provided
 if [ $# -lt 1 ]; then
   echo "Usage: $0 <DEPLOY_DIR>"
-  echo "Example: $0 /path/to/root/of/deploy/repo"
+  echo "Example: $0 /path/to/deploy"
   exit 1
 fi
 
 # Normalize path (remove trailing slash)
-DEPLOY_DIR="${1%/}"
+DEPLOY_DIR="${DEPLOY_DIR%/}"
 
 # Function to decrypt and rename
 decrypt_and_move() {

enterprise/integrations/github/data_collector.py

@@ -6,7 +6,7 @@ from datetime import datetime
 from enum import Enum
 from typing import Any
 
-from github import Auth, Github, GithubIntegration
+from github import Github, GithubIntegration
 from integrations.github.github_view import (
     GithubIssue,
 )
@@ -84,7 +84,7 @@ class GitHubDataCollector:
         # self.full_saved_pr_path = 'github_data/prs/{}-{}/data.json'
         self.full_saved_pr_path = 'prs/github/{}-{}/data.json'
         self.github_integration = GithubIntegration(
-            auth=Auth.AppAuth(GITHUB_APP_CLIENT_ID, GITHUB_APP_PRIVATE_KEY)
+            GITHUB_APP_CLIENT_ID, GITHUB_APP_PRIVATE_KEY
         )
         self.conversation_id = None
 
@@ -143,7 +143,7 @@ class GitHubDataCollector:
         try:
             installation_token = self._get_installation_access_token(installation_id)
 
-            with Github(auth=Auth.Token(installation_token)) as github_client:
+            with Github(installation_token) as github_client:
                 repo = github_client.get_repo(repo_name)
                 issue = repo.get_issue(issue_number)
                 comments = []
@@ -237,7 +237,7 @@ class GitHubDataCollector:
     def _get_pr_commits(self, installation_id: str, repo_name: str, pr_number: int):
         commits = []
         installation_token = self._get_installation_access_token(installation_id)
-        with Github(auth=Auth.Token(installation_token)) as github_client:
+        with Github(installation_token) as github_client:
             repo = github_client.get_repo(repo_name)
             pr = repo.get_pull(pr_number)
 

enterprise/integrations/github/github_manager.py

@@ -1,6 +1,6 @@
 from types import MappingProxyType
 
-from github import Auth, Github, GithubIntegration
+from github import Github, GithubIntegration
 from integrations.github.data_collector import GitHubDataCollector
 from integrations.github.github_solvability import summarize_issue_solvability
 from integrations.github.github_view import (
@@ -21,7 +21,6 @@ from integrations.utils import (
     CONVERSATION_URL,
     HOST_URL,
     OPENHANDS_RESOLVER_TEMPLATES_DIR,
-    get_session_expired_message,
 )
 from integrations.v1_utils import get_saas_user_auth
 from jinja2 import Environment, FileSystemLoader
@@ -32,11 +31,7 @@ from server.utils.conversation_callback_utils import register_callback_processor
 
 from openhands.core.logger import openhands_logger as logger
 from openhands.integrations.provider import ProviderToken, ProviderType
-from openhands.server.types import (
-    LLMAuthenticationError,
-    MissingSettingsError,
-    SessionExpiredError,
-)
+from openhands.server.types import LLMAuthenticationError, MissingSettingsError
 from openhands.storage.data_models.secrets import Secrets
 from openhands.utils.async_utils import call_sync_from_async
 
@@ -48,7 +43,7 @@ class GithubManager(Manager):
         self.token_manager = token_manager
         self.data_collector = data_collector
         self.github_integration = GithubIntegration(
-            auth=Auth.AppAuth(GITHUB_APP_CLIENT_ID, GITHUB_APP_PRIVATE_KEY)
+            GITHUB_APP_CLIENT_ID, GITHUB_APP_PRIVATE_KEY
         )
 
         self.jinja_env = Environment(
@@ -82,7 +77,7 @@ class GithubManager(Manager):
             reaction: The reaction to add (e.g. "eyes", "+1", "-1", "laugh", "confused", "heart", "hooray", "rocket")
             installation_token: GitHub installation access token for API access
         """
-        with Github(auth=Auth.Token(installation_token)) as github_client:
+        with Github(installation_token) as github_client:
             repo = github_client.get_repo(github_view.full_repo_name)
             # Add reaction based on view type
             if isinstance(github_view, GithubInlinePRComment):
@@ -204,7 +199,7 @@ class GithubManager(Manager):
         outgoing_message = message.message
 
         if isinstance(github_view, GithubInlinePRComment):
-            with Github(auth=Auth.Token(installation_token)) as github_client:
+            with Github(installation_token) as github_client:
                 repo = github_client.get_repo(github_view.full_repo_name)
                 pr = repo.get_pull(github_view.issue_number)
                 pr.create_review_comment_reply(
@@ -216,7 +211,7 @@ class GithubManager(Manager):
             or isinstance(github_view, GithubIssueComment)
             or isinstance(github_view, GithubIssue)
         ):
-            with Github(auth=Auth.Token(installation_token)) as github_client:
+            with Github(installation_token) as github_client:
                 repo = github_client.get_repo(github_view.full_repo_name)
                 issue = repo.get_issue(number=github_view.issue_number)
                 issue.create_comment(outgoing_message)
@@ -310,7 +305,7 @@ class GithubManager(Manager):
                     f'[GitHub] Created conversation {conversation_id} for user {user_info.username}'
                 )
 
-                if not github_view.v1_enabled:
+                if not github_view.v1:
                     # Create a GithubCallbackProcessor
                     processor = GithubCallbackProcessor(
                         github_view=github_view,
@@ -347,13 +342,6 @@ class GithubManager(Manager):
 
                 msg_info = f'@{user_info.username} please set a valid LLM API key in [OpenHands Cloud]({HOST_URL}) before starting a job.'
 
-            except SessionExpiredError as e:
-                logger.warning(
-                    f'[GitHub] Session expired for user {user_info.username}: {str(e)}'
-                )
-
-                msg_info = get_session_expired_message(user_info.username)
-
             msg = self.create_outgoing_message(msg_info)
             await self.send_message(msg, github_view)
 

enterprise/integrations/github/github_solvability.py

@@ -1,7 +1,7 @@
 import asyncio
 import time
 
-from github import Auth, Github
+from github import Github
 from integrations.github.github_view import (
     GithubInlinePRComment,
     GithubIssueComment,
@@ -47,7 +47,7 @@ def fetch_github_issue_context(
     context_parts.append(f'Title: {github_view.title}')
     context_parts.append(f'Description:\n{github_view.description}')
 
-    with Github(auth=Auth.Token(user_token)) as github_client:
+    with Github(user_token) as github_client:
         repo = github_client.get_repo(github_view.full_repo_name)
         issue = repo.get_issue(github_view.issue_number)
         if issue.labels:

enterprise/integrations/github/github_view.py

@@ -1,7 +1,7 @@
 from dataclasses import dataclass
 from uuid import UUID, uuid4
 
-from github import Auth, Github, GithubIntegration
+from github import Github, GithubIntegration
 from github.Issue import Issue
 from integrations.github.github_types import (
     WorkflowRun,
@@ -140,10 +140,7 @@ class GithubIssue(ResolverViewInterface):
     title: str
     description: str
     previous_comments: list[Comment]
-    v1_enabled: bool
-
-    def _get_branch_name(self) -> str | None:
-        return getattr(self, 'branch_name', None)
+    v1: bool
 
     async def _load_resolver_context(self):
         github_service = GithubServiceImpl(
@@ -191,27 +188,23 @@ class GithubIssue(ResolverViewInterface):
     async def initialize_new_conversation(self) -> ConversationMetadata:
         # FIXME: Handle if initialize_conversation returns None
 
-        self.v1_enabled = await get_user_v1_enabled_setting(
-            self.user_info.keycloak_user_id
-        )
+        v1_enabled = await get_user_v1_enabled_setting(self.user_info.keycloak_user_id)
         logger.info(
-            f'[GitHub V1]: User flag found for {self.user_info.keycloak_user_id} is {self.v1_enabled}'
+            f'[GitHub V1]: User flag found for {self.user_info.keycloak_user_id} is {v1_enabled}'
         )
-        if self.v1_enabled:
+        if v1_enabled:
             # Create dummy conversationm metadata
             # Don't save to conversation store
             # V1 conversations are stored in a separate table
-            self.conversation_id = uuid4().hex
             return ConversationMetadata(
-                conversation_id=self.conversation_id,
-                selected_repository=self.full_repo_name,
+                conversation_id=uuid4().hex, selected_repository=self.full_repo_name
             )
 
         conversation_metadata: ConversationMetadata = await initialize_conversation(  # type: ignore[assignment]
             user_id=self.user_info.keycloak_user_id,
             conversation_id=None,
             selected_repository=self.full_repo_name,
-            selected_branch=self._get_branch_name(),
+            selected_branch=None,
             conversation_trigger=ConversationTrigger.RESOLVER,
             git_provider=ProviderType.GITHUB,
         )
@@ -225,18 +218,25 @@ class GithubIssue(ResolverViewInterface):
         conversation_metadata: ConversationMetadata,
         saas_user_auth: UserAuth,
     ):
+        v1_enabled = await get_user_v1_enabled_setting(self.user_info.keycloak_user_id)
         logger.info(
-            f'[GitHub V1]: User flag found for {self.user_info.keycloak_user_id} is {self.v1_enabled}'
+            f'[GitHub V1]: User flag found for {self.user_info.keycloak_user_id} is {v1_enabled}'
+        )
+        if v1_enabled:
+            try:
+                # Use V1 app conversation service
+                await self._create_v1_conversation(
+                    jinja_env, saas_user_auth, conversation_metadata
+                )
+                return
+
+            except Exception as e:
+                logger.warning(f'Error checking V1 settings, falling back to V0: {e}')
+
+        # Use existing V0 conversation service
+        await self._create_v0_conversation(
+            jinja_env, git_provider_tokens, conversation_metadata
         )
-        if self.v1_enabled:
-            # Use V1 app conversation service
-            await self._create_v1_conversation(
-                jinja_env, saas_user_auth, conversation_metadata
-            )
-        else:
-            await self._create_v0_conversation(
-                jinja_env, git_provider_tokens, conversation_metadata
-            )
 
     async def _create_v0_conversation(
         self,
@@ -294,7 +294,6 @@ class GithubIssue(ResolverViewInterface):
             system_message_suffix=conversation_instructions,
             initial_message=initial_message,
             selected_repository=self.full_repo_name,
-            selected_branch=self._get_branch_name(),
             git_provider=ProviderType.GITHUB,
             title=f'GitHub Issue #{self.issue_number}: {self.title}',
             trigger=ConversationTrigger.RESOLVER,
@@ -319,9 +318,11 @@ class GithubIssue(ResolverViewInterface):
                         f'Failed to start V1 conversation: {task.detail}'
                     )
 
+        self.v1 = True
+
     def _create_github_v1_callback_processor(self):
         """Create a V1 callback processor for GitHub integration."""
-        from integrations.github.github_v1_callback_processor import (
+        from openhands.app_server.event_callback.github_v1_callback_processor import (
             GithubV1CallbackProcessor,
         )
 
@@ -389,6 +390,31 @@ class GithubPRComment(GithubIssueComment):
 
         return user_instructions, conversation_instructions
 
+    async def initialize_new_conversation(self) -> ConversationMetadata:
+        v1_enabled = await get_user_v1_enabled_setting(self.user_info.keycloak_user_id)
+        logger.info(
+            f'[GitHub V1]: User flag found for {self.user_info.keycloak_user_id} is {v1_enabled}'
+        )
+        if v1_enabled:
+            # Create dummy conversationm metadata
+            # Don't save to conversation store
+            # V1 conversations are stored in a separate table
+            return ConversationMetadata(
+                conversation_id=uuid4().hex, selected_repository=self.full_repo_name
+            )
+
+        conversation_metadata: ConversationMetadata = await initialize_conversation(  # type: ignore[assignment]
+            user_id=self.user_info.keycloak_user_id,
+            conversation_id=None,
+            selected_repository=self.full_repo_name,
+            selected_branch=self.branch_name,
+            conversation_trigger=ConversationTrigger.RESOLVER,
+            git_provider=ProviderType.GITHUB,
+        )
+
+        self.conversation_id = conversation_metadata.conversation_id
+        return conversation_metadata
+
 
 @dataclass
 class GithubInlinePRComment(GithubPRComment):
@@ -703,13 +729,13 @@ class GithubFactory:
 
         def _interact_with_github() -> Issue | None:
             with GithubIntegration(
-                auth=Auth.AppAuth(GITHUB_APP_CLIENT_ID, GITHUB_APP_PRIVATE_KEY)
+                GITHUB_APP_CLIENT_ID, GITHUB_APP_PRIVATE_KEY
             ) as integration:
                 access_token = integration.get_access_token(
                     payload['installation']['id']
                 ).token
 
-            with Github(auth=Auth.Token(access_token)) as gh:
+            with Github(access_token) as gh:
                 repo = gh.get_repo(selected_repo)
                 login = (
                     payload['organization']['login']
@@ -804,7 +830,7 @@ class GithubFactory:
                 title='',
                 description='',
                 previous_comments=[],
-                v1_enabled=False,
+                v1=False,
             )
 
         elif GithubFactory.is_issue_comment(message):
@@ -830,7 +856,7 @@ class GithubFactory:
                 title='',
                 description='',
                 previous_comments=[],
-                v1_enabled=False,
+                v1=False,
             )
 
         elif GithubFactory.is_pr_comment(message):
@@ -841,12 +867,12 @@ class GithubFactory:
 
             access_token = ''
             with GithubIntegration(
-                auth=Auth.AppAuth(GITHUB_APP_CLIENT_ID, GITHUB_APP_PRIVATE_KEY)
+                GITHUB_APP_CLIENT_ID, GITHUB_APP_PRIVATE_KEY
             ) as integration:
                 access_token = integration.get_access_token(installation_id).token
 
             head_ref = None
-            with Github(auth=Auth.Token(access_token)) as gh:
+            with Github(access_token) as gh:
                 repo = gh.get_repo(selected_repo)
                 pull_request = repo.get_pull(issue_number)
                 head_ref = pull_request.head.ref
@@ -872,7 +898,7 @@ class GithubFactory:
                 title='',
                 description='',
                 previous_comments=[],
-                v1_enabled=False,
+                v1=False,
             )
 
         elif GithubFactory.is_inline_pr_comment(message):
@@ -906,7 +932,7 @@ class GithubFactory:
                 title='',
                 description='',
                 previous_comments=[],
-                v1_enabled=False,
+                v1=False,
             )
 
         else:

enterprise/integrations/gitlab/gitlab_manager.py

@@ -15,7 +15,6 @@ from integrations.utils import (
     CONVERSATION_URL,
     HOST_URL,
     OPENHANDS_RESOLVER_TEMPLATES_DIR,
-    get_session_expired_message,
 )
 from jinja2 import Environment, FileSystemLoader
 from pydantic import SecretStr
@@ -25,11 +24,7 @@ from server.utils.conversation_callback_utils import register_callback_processor
 from openhands.core.logger import openhands_logger as logger
 from openhands.integrations.gitlab.gitlab_service import GitLabServiceImpl
 from openhands.integrations.provider import ProviderToken, ProviderType
-from openhands.server.types import (
-    LLMAuthenticationError,
-    MissingSettingsError,
-    SessionExpiredError,
-)
+from openhands.server.types import LLMAuthenticationError, MissingSettingsError
 from openhands.storage.data_models.secrets import Secrets
 
 
@@ -254,13 +249,6 @@ class GitlabManager(Manager):
 
                 msg_info = f'@{user_info.username} please set a valid LLM API key in [OpenHands Cloud]({HOST_URL}) before starting a job.'
 
-            except SessionExpiredError as e:
-                logger.warning(
-                    f'[GitLab] Session expired for user {user_info.username}: {str(e)}'
-                )
-
-                msg_info = get_session_expired_message(user_info.username)
-
             # Send the acknowledgment message
             msg = self.create_outgoing_message(msg_info)
             await self.send_message(msg, gitlab_view)

enterprise/integrations/gitlab/gitlab_service.py

@@ -80,52 +80,22 @@ class SaaSGitLabService(GitLabService):
             logger.warning('external_auth_token and user_id not set!')
         return gitlab_token
 
-    async def get_owned_groups(self, min_access_level: int = 40) -> list[dict]:
+    async def get_owned_groups(self) -> list[dict]:
         """
-        Get all top-level groups where the current user has admin access.
-
-        This method supports pagination and fetches all groups where the user has
-        at least the specified access level.
-
-        Args:
-            min_access_level: Minimum access level required (default: 40 for Maintainer or Owner)
-                             - 40: Maintainer or Owner
-                             - 50: Owner only
+        Get all groups for which the current user is the owner.
 
         Returns:
-            list[dict]: A list of groups where user has the specified access level or higher.
+            list[dict]: A list of groups owned by the current user.
         """
-        groups_with_admin_access = []
-        page = 1
-        per_page = 100
+        url = f'{self.BASE_URL}/groups'
+        params = {'owned': 'true', 'per_page': 100, 'top_level_only': 'true'}
 
-        while True:
-            try:
-                url = f'{self.BASE_URL}/groups'
-                params = {
-                    'page': str(page),
-                    'per_page': str(per_page),
-                    'min_access_level': min_access_level,
-                    'top_level_only': 'true',
-                }
-                response, headers = await self._make_request(url, params)
-
-                if not response:
-                    break
-
-                groups_with_admin_access.extend(response)
-                page += 1
-
-                # Check if we've reached the last page
-                link_header = headers.get('Link', '')
-                if 'rel="next"' not in link_header:
-                    break
-
-            except Exception:
-                logger.warning(f'Error fetching groups on page {page}', exc_info=True)
-                break
-
-        return groups_with_admin_access
+        try:
+            response, headers = await self._make_request(url, params)
+            return response
+        except Exception:
+            logger.warning('Error fetching owned groups', exc_info=True)
+            return []
 
     async def add_owned_projects_and_groups_to_db(self, owned_personal_projects):
         """
@@ -557,55 +527,3 @@ class SaaSGitLabService(GitLabService):
             await self._make_request(url=url, params=params, method=RequestMethod.POST)
         except Exception as e:
             logger.exception(f'[GitLab]: Reply to MR failed {e}')
-
-    async def get_user_resources_with_admin_access(
-        self,
-    ) -> tuple[list[dict], list[dict]]:
-        """
-        Get all projects and groups where the current user has admin access (maintainer or owner).
-
-        Returns:
-            tuple[list[dict], list[dict]]: A tuple containing:
-                - list of projects where user has admin access
-                - list of groups where user has admin access
-        """
-        projects_with_admin_access = []
-        groups_with_admin_access = []
-
-        # Fetch all projects the user is a member of
-        page = 1
-        per_page = 100
-        while True:
-            try:
-                url = f'{self.BASE_URL}/projects'
-                params = {
-                    'page': str(page),
-                    'per_page': str(per_page),
-                    'membership': 1,
-                    'min_access_level': 40,  # Maintainer or Owner
-                }
-                response, headers = await self._make_request(url, params)
-
-                if not response:
-                    break
-
-                projects_with_admin_access.extend(response)
-                page += 1
-
-                # Check if we've reached the last page
-                link_header = headers.get('Link', '')
-                if 'rel="next"' not in link_header:
-                    break
-
-            except Exception:
-                logger.warning(f'Error fetching projects on page {page}', exc_info=True)
-                break
-
-        # Fetch all groups where user is owner or maintainer
-        groups_with_admin_access = await self.get_owned_groups(min_access_level=40)
-
-        logger.info(
-            f'Found {len(projects_with_admin_access)} projects and {len(groups_with_admin_access)} groups with admin access'
-        )
-
-        return projects_with_admin_access, groups_with_admin_access

enterprise/integrations/gitlab/webhook_installation.py

@@ -1,199 +0,0 @@
-"""Shared utilities for GitLab webhook installation.
-
-This module contains reusable functions and classes for installing GitLab webhooks
-that can be used by both the cron job and API routes.
-"""
-
-from typing import cast
-from uuid import uuid4
-
-from integrations.types import GitLabResourceType
-from integrations.utils import GITLAB_WEBHOOK_URL
-from storage.gitlab_webhook import GitlabWebhook, WebhookStatus
-from storage.gitlab_webhook_store import GitlabWebhookStore
-
-from openhands.core.logger import openhands_logger as logger
-from openhands.integrations.service_types import GitService
-
-# Webhook configuration constants
-WEBHOOK_NAME = 'OpenHands Resolver'
-SCOPES: list[str] = [
-    'note_events',
-    'merge_requests_events',
-    'confidential_issues_events',
-    'issues_events',
-    'confidential_note_events',
-    'job_events',
-    'pipeline_events',
-]
-
-
-class BreakLoopException(Exception):
-    """Exception raised when webhook installation conditions are not met or rate limited."""
-
-    pass
-
-
-async def verify_webhook_conditions(
-    gitlab_service: type[GitService],
-    resource_type: GitLabResourceType,
-    resource_id: str,
-    webhook_store: GitlabWebhookStore,
-    webhook: GitlabWebhook,
-) -> None:
-    """
-    Verify all conditions are met for webhook installation.
-    Raises BreakLoopException if any condition fails or rate limited.
-
-    Args:
-        gitlab_service: GitLab service instance
-        resource_type: Type of resource (PROJECT or GROUP)
-        resource_id: ID of the resource
-        webhook_store: Webhook store instance
-        webhook: Webhook object to verify
-    """
-    from integrations.gitlab.gitlab_service import SaaSGitLabService
-
-    gitlab_service = cast(type[SaaSGitLabService], gitlab_service)
-
-    # Check if resource exists
-    does_resource_exist, status = await gitlab_service.check_resource_exists(
-        resource_type, resource_id
-    )
-
-    logger.info(
-        'Does resource exists',
-        extra={
-            'does_resource_exist': does_resource_exist,
-            'status': status,
-            'resource_id': resource_id,
-            'resource_type': resource_type,
-        },
-    )
-
-    if status == WebhookStatus.RATE_LIMITED:
-        raise BreakLoopException()
-    if not does_resource_exist and status != WebhookStatus.RATE_LIMITED:
-        await webhook_store.delete_webhook(webhook)
-        raise BreakLoopException()
-
-    # Check if user has admin access
-    (
-        is_user_admin_of_resource,
-        status,
-    ) = await gitlab_service.check_user_has_admin_access_to_resource(
-        resource_type, resource_id
-    )
-
-    logger.info(
-        'Is user admin',
-        extra={
-            'is_user_admin': is_user_admin_of_resource,
-            'status': status,
-            'resource_id': resource_id,
-            'resource_type': resource_type,
-        },
-    )
-
-    if status == WebhookStatus.RATE_LIMITED:
-        raise BreakLoopException()
-    if not is_user_admin_of_resource:
-        await webhook_store.delete_webhook(webhook)
-        raise BreakLoopException()
-
-    # Check if webhook already exists
-    (
-        does_webhook_exist_on_resource,
-        status,
-    ) = await gitlab_service.check_webhook_exists_on_resource(
-        resource_type, resource_id, GITLAB_WEBHOOK_URL
-    )
-
-    logger.info(
-        'Does webhook already exist',
-        extra={
-            'does_webhook_exist_on_resource': does_webhook_exist_on_resource,
-            'status': status,
-            'resource_id': resource_id,
-            'resource_type': resource_type,
-        },
-    )
-
-    if status == WebhookStatus.RATE_LIMITED:
-        raise BreakLoopException()
-    if does_webhook_exist_on_resource != webhook.webhook_exists:
-        await webhook_store.update_webhook(
-            webhook, {'webhook_exists': does_webhook_exist_on_resource}
-        )
-
-    if does_webhook_exist_on_resource:
-        raise BreakLoopException()
-
-
-async def install_webhook_on_resource(
-    gitlab_service: type[GitService],
-    resource_type: GitLabResourceType,
-    resource_id: str,
-    webhook_store: GitlabWebhookStore,
-    webhook: GitlabWebhook,
-) -> tuple[str | None, WebhookStatus | None]:
-    """
-    Install webhook on a GitLab resource.
-
-    Args:
-        gitlab_service: GitLab service instance
-        resource_type: Type of resource (PROJECT or GROUP)
-        resource_id: ID of the resource
-        webhook_store: Webhook store instance
-        webhook: Webhook object to install
-
-    Returns:
-        Tuple of (webhook_id, status)
-    """
-    from integrations.gitlab.gitlab_service import SaaSGitLabService
-
-    gitlab_service = cast(type[SaaSGitLabService], gitlab_service)
-
-    webhook_secret = f'{webhook.user_id}-{str(uuid4())}'
-    webhook_uuid = f'{str(uuid4())}'
-
-    webhook_id, status = await gitlab_service.install_webhook(
-        resource_type=resource_type,
-        resource_id=resource_id,
-        webhook_name=WEBHOOK_NAME,
-        webhook_url=GITLAB_WEBHOOK_URL,
-        webhook_secret=webhook_secret,
-        webhook_uuid=webhook_uuid,
-        scopes=SCOPES,
-    )
-
-    logger.info(
-        'Creating new webhook',
-        extra={
-            'webhook_id': webhook_id,
-            'status': status,
-            'resource_id': resource_id,
-            'resource_type': resource_type,
-        },
-    )
-
-    if status == WebhookStatus.RATE_LIMITED:
-        raise BreakLoopException()
-
-    if webhook_id:
-        await webhook_store.update_webhook(
-            webhook=webhook,
-            update_fields={
-                'webhook_secret': webhook_secret,
-                'webhook_exists': True,  # webhook was created
-                'webhook_url': GITLAB_WEBHOOK_URL,
-                'scopes': SCOPES,
-                'webhook_uuid': webhook_uuid,  # required to identify which webhook installation is sending payload
-            },
-        )
-
-        logger.info(
-            f'Installed webhook for {webhook.user_id} on {resource_type}:{resource_id}'
-        )
-
-    return webhook_id, status

enterprise/integrations/jira/jira_manager.py

@@ -17,7 +17,6 @@ from integrations.utils import (
     HOST_URL,
     OPENHANDS_RESOLVER_TEMPLATES_DIR,
     filter_potential_repos_by_user_msg,
-    get_session_expired_message,
 )
 from jinja2 import Environment, FileSystemLoader
 from server.auth.saas_user_auth import get_user_auth_from_keycloak_id
@@ -31,11 +30,7 @@ from openhands.core.logger import openhands_logger as logger
 from openhands.integrations.provider import ProviderHandler
 from openhands.integrations.service_types import Repository
 from openhands.server.shared import server_config
-from openhands.server.types import (
-    LLMAuthenticationError,
-    MissingSettingsError,
-    SessionExpiredError,
-)
+from openhands.server.types import LLMAuthenticationError, MissingSettingsError
 from openhands.server.user_auth.user_auth import UserAuth
 from openhands.utils.http_session import httpx_verify_option
 
@@ -385,10 +380,6 @@ class JiraManager(Manager):
             logger.warning(f'[Jira] LLM authentication error: {str(e)}')
             msg_info = f'Please set a valid LLM API key in [OpenHands Cloud]({HOST_URL}) before starting a job.'
 
-        except SessionExpiredError as e:
-            logger.warning(f'[Jira] Session expired: {str(e)}')
-            msg_info = get_session_expired_message()
-
         except Exception as e:
             logger.error(
                 f'[Jira] Unexpected error starting job: {str(e)}', exc_info=True

enterprise/integrations/jira_dc/jira_dc_manager.py

@@ -19,7 +19,6 @@ from integrations.utils import (
     HOST_URL,
     OPENHANDS_RESOLVER_TEMPLATES_DIR,
     filter_potential_repos_by_user_msg,
-    get_session_expired_message,
 )
 from jinja2 import Environment, FileSystemLoader
 from server.auth.saas_user_auth import get_user_auth_from_keycloak_id
@@ -33,11 +32,7 @@ from openhands.core.logger import openhands_logger as logger
 from openhands.integrations.provider import ProviderHandler
 from openhands.integrations.service_types import Repository
 from openhands.server.shared import server_config
-from openhands.server.types import (
-    LLMAuthenticationError,
-    MissingSettingsError,
-    SessionExpiredError,
-)
+from openhands.server.types import LLMAuthenticationError, MissingSettingsError
 from openhands.server.user_auth.user_auth import UserAuth
 from openhands.utils.http_session import httpx_verify_option
 
@@ -402,10 +397,6 @@ class JiraDcManager(Manager):
             logger.warning(f'[Jira DC] LLM authentication error: {str(e)}')
             msg_info = f'Please set a valid LLM API key in [OpenHands Cloud]({HOST_URL}) before starting a job.'
 
-        except SessionExpiredError as e:
-            logger.warning(f'[Jira DC] Session expired: {str(e)}')
-            msg_info = get_session_expired_message()
-
         except Exception as e:
             logger.error(
                 f'[Jira DC] Unexpected error starting job: {str(e)}', exc_info=True

enterprise/integrations/linear/linear_manager.py

@@ -16,7 +16,6 @@ from integrations.utils import (
     HOST_URL,
     OPENHANDS_RESOLVER_TEMPLATES_DIR,
     filter_potential_repos_by_user_msg,
-    get_session_expired_message,
 )
 from jinja2 import Environment, FileSystemLoader
 from server.auth.saas_user_auth import get_user_auth_from_keycloak_id
@@ -30,11 +29,7 @@ from openhands.core.logger import openhands_logger as logger
 from openhands.integrations.provider import ProviderHandler
 from openhands.integrations.service_types import Repository
 from openhands.server.shared import server_config
-from openhands.server.types import (
-    LLMAuthenticationError,
-    MissingSettingsError,
-    SessionExpiredError,
-)
+from openhands.server.types import LLMAuthenticationError, MissingSettingsError
 from openhands.server.user_auth.user_auth import UserAuth
 from openhands.utils.http_session import httpx_verify_option
 
@@ -392,10 +387,6 @@ class LinearManager(Manager):
             logger.warning(f'[Linear] LLM authentication error: {str(e)}')
             msg_info = f'Please set a valid LLM API key in [OpenHands Cloud]({HOST_URL}) before starting a job.'
 
-        except SessionExpiredError as e:
-            logger.warning(f'[Linear] Session expired: {str(e)}')
-            msg_info = get_session_expired_message()
-
         except Exception as e:
             logger.error(
                 f'[Linear] Unexpected error starting job: {str(e)}', exc_info=True

enterprise/integrations/slack/slack_manager.py

@@ -14,7 +14,6 @@ from integrations.slack.slack_view import (
 from integrations.utils import (
     HOST_URL,
     OPENHANDS_RESOLVER_TEMPLATES_DIR,
-    get_session_expired_message,
 )
 from jinja2 import Environment, FileSystemLoader
 from pydantic import SecretStr
@@ -30,11 +29,7 @@ from openhands.core.logger import openhands_logger as logger
 from openhands.integrations.provider import ProviderHandler
 from openhands.integrations.service_types import Repository
 from openhands.server.shared import config, server_config
-from openhands.server.types import (
-    LLMAuthenticationError,
-    MissingSettingsError,
-    SessionExpiredError,
-)
+from openhands.server.types import LLMAuthenticationError, MissingSettingsError
 from openhands.server.user_auth.user_auth import UserAuth
 
 authorize_url_generator = AuthorizeUrlGenerator(
@@ -357,13 +352,6 @@ class SlackManager(Manager):
 
                 msg_info = f'@{user_info.slack_display_name} please set a valid LLM API key in [OpenHands Cloud]({HOST_URL}) before starting a job.'
 
-            except SessionExpiredError as e:
-                logger.warning(
-                    f'[Slack] Session expired for user {user_info.slack_display_name}: {str(e)}'
-                )
-
-                msg_info = get_session_expired_message(user_info.slack_display_name)
-
             except StartingConvoException as e:
                 msg_info = str(e)
 

enterprise/integrations/utils.py

@@ -20,7 +20,6 @@ from openhands.events.action import (
     AgentFinishAction,
     MessageAction,
 )
-from openhands.events.event_filter import EventFilter
 from openhands.events.event_store_abc import EventStoreABC
 from openhands.events.observation.agent import AgentStateChangedObservation
 from openhands.integrations.service_types import Repository
@@ -47,27 +46,6 @@ ENABLE_PROACTIVE_CONVERSATION_STARTERS = (
     os.getenv('ENABLE_PROACTIVE_CONVERSATION_STARTERS', 'false').lower() == 'true'
 )
 
-
-def get_session_expired_message(username: str | None = None) -> str:
-    """Get a user-friendly session expired message.
-
-    Used by integrations to notify users when their Keycloak offline session
-    has expired.
-
-    Args:
-        username: Optional username to mention in the message. If provided,
-                  the message will include @username prefix (used by Git providers
-                  like GitHub, GitLab, Slack). If None, returns a generic message
-                  (used by Jira, Jira DC, Linear).
-
-    Returns:
-        A formatted session expired message
-    """
-    if username:
-        return f'@{username} your session has expired. Please login again at [OpenHands Cloud]({HOST_URL}) and try again.'
-    return f'Your session has expired. Please login again at [OpenHands Cloud]({HOST_URL}) and try again.'
-
-
 # Toggle for solvability report feature
 ENABLE_SOLVABILITY_ANALYSIS = (
     os.getenv('ENABLE_SOLVABILITY_ANALYSIS', 'false').lower() == 'true'
@@ -79,10 +57,7 @@ ENABLE_V1_GITHUB_RESOLVER = (
 )
 
 
-OPENHANDS_RESOLVER_TEMPLATES_DIR = (
-    os.getenv('OPENHANDS_RESOLVER_TEMPLATES_DIR')
-    or 'openhands/integrations/templates/resolver/'
-)
+OPENHANDS_RESOLVER_TEMPLATES_DIR = 'openhands/integrations/templates/resolver/'
 jinja_env = Environment(loader=FileSystemLoader(OPENHANDS_RESOLVER_TEMPLATES_DIR))
 
 
@@ -228,35 +203,18 @@ def get_summary_for_agent_state(
 def get_final_agent_observation(
     event_store: EventStoreABC,
 ) -> list[AgentStateChangedObservation]:
-    events = list(
-        event_store.search_events(
-            filter=EventFilter(
-                source=EventSource.ENVIRONMENT,
-                include_types=(AgentStateChangedObservation,),
-            ),
-            limit=1,
-            reverse=True,
-        )
+    return event_store.get_matching_events(
+        source=EventSource.ENVIRONMENT,
+        event_types=(AgentStateChangedObservation,),
+        limit=1,
+        reverse=True,
     )
-    result = [e for e in events if isinstance(e, AgentStateChangedObservation)]
-    assert len(result) == len(events)
-    return result
 
 
 def get_last_user_msg(event_store: EventStoreABC) -> list[MessageAction]:
-    events = list(
-        event_store.search_events(
-            filter=EventFilter(
-                source=EventSource.USER,
-                include_types=(MessageAction,),
-            ),
-            limit=1,
-            reverse=True,
-        )
+    return event_store.get_matching_events(
+        source=EventSource.USER, event_types=(MessageAction,), limit=1, reverse='true'
     )
-    result = [e for e in events if isinstance(e, MessageAction)]
-    assert len(result) == len(events)
-    return result
 
 
 def extract_summary_from_event_store(
@@ -268,22 +226,18 @@ def extract_summary_from_event_store(
     conversation_link = CONVERSATION_URL.format(conversation_id)
     summary_instruction = get_summary_instruction()
 
-    instruction_events = list(
-        event_store.search_events(
-            filter=EventFilter(
-                query=json.dumps(summary_instruction),
-                source=EventSource.USER,
-                include_types=(MessageAction,),
-            ),
-            limit=1,
-            reverse=True,
-        )
+    instruction_event: list[MessageAction] = event_store.get_matching_events(
+        query=json.dumps(summary_instruction),
+        source=EventSource.USER,
+        event_types=(MessageAction,),
+        limit=1,
+        reverse=True,
     )
 
     final_agent_observation = get_final_agent_observation(event_store)
 
     # Find summary instruction event ID
-    if not instruction_events:
+    if len(instruction_event) == 0:
         logger.warning(
             'no_instruction_event_found', extra={'conversation_id': conversation_id}
         )
@@ -291,19 +245,19 @@ def extract_summary_from_event_store(
             final_agent_observation, conversation_link
         )  # Agent did not receive summary instruction
 
-    summary_events = list(
-        event_store.search_events(
-            filter=EventFilter(
-                source=EventSource.AGENT,
-                include_types=(MessageAction, AgentFinishAction),
-            ),
-            limit=1,
+    event_id: int = instruction_event[0].id
+
+    agent_messages: list[MessageAction | AgentFinishAction] = (
+        event_store.get_matching_events(
+            start_id=event_id,
+            source=EventSource.AGENT,
+            event_types=(MessageAction, AgentFinishAction),
             reverse=True,
-            start_id=instruction_events[0].id,
+            limit=1,
         )
     )
 
-    if not summary_events:
+    if len(agent_messages) == 0:
         logger.warning(
             'no_agent_messages_found', extra={'conversation_id': conversation_id}
         )
@@ -311,11 +265,10 @@ def extract_summary_from_event_store(
             final_agent_observation, conversation_link
         )  # Agent failed to generate summary
 
-    summary_event = summary_events[0]
+    summary_event: MessageAction | AgentFinishAction = agent_messages[0]
     if isinstance(summary_event, MessageAction):
         return summary_event.content
 
-    assert isinstance(summary_event, AgentFinishAction)
     return summary_event.final_thought
 
 
@@ -368,7 +321,7 @@ def append_conversation_footer(message: str, conversation_id: str) -> str:
         The message with the conversation footer appended
     """
     conversation_link = CONVERSATION_URL.format(conversation_id)
-    footer = f'\n\n[View full conversation]({conversation_link})'
+    footer = f'\n\n<sub>[View full conversation]({conversation_link})</sub>'
     return message + footer
 
 

enterprise/migrations/versions/085_add_public_column_to_conversation_metadata.py

@@ -1,41 +0,0 @@
-"""add public column to conversation_metadata
-
-Revision ID: 085
-Revises: 084
-Create Date: 2025-01-27 00:00:00.000000
-
-"""
-
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision: str = '085'
-down_revision: Union[str, None] = '084'
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    """Upgrade schema."""
-    op.add_column(
-        'conversation_metadata',
-        sa.Column('public', sa.Boolean(), nullable=True),
-    )
-    op.create_index(
-        op.f('ix_conversation_metadata_public'),
-        'conversation_metadata',
-        ['public'],
-        unique=False,
-    )
-
-
-def downgrade() -> None:
-    """Downgrade schema."""
-    op.drop_index(
-        op.f('ix_conversation_metadata_public'),
-        table_name='conversation_metadata',
-    )
-    op.drop_column('conversation_metadata', 'public')

enterprise/migrations/versions/086_bump_condenser_defaults.py

@@ -1,61 +0,0 @@
-"""bump condenser defaults: max_size 120->240
-
-Revision ID: 086
-Revises: 085
-Create Date: 2026-01-05
-
-"""
-
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-from sqlalchemy.sql import column, table
-
-# revision identifiers, used by Alembic.
-revision: str = '086'
-down_revision: Union[str, None] = '085'
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    """Upgrade schema.
-
-    Update existing users with condenser_max_size=120 or NULL to 240.
-    This covers both users who had the old default (120) explicitly set
-    and users who had NULL (which defaulted to 120 in the application code).
-    The SDK default for keep_first will be used automatically.
-    """
-    user_settings_table = table(
-        'user_settings',
-        column('condenser_max_size', sa.Integer),
-    )
-    # Update users with explicit 120 value
-    op.execute(
-        user_settings_table.update()
-        .where(user_settings_table.c.condenser_max_size == 120)
-        .values(condenser_max_size=240)
-    )
-    # Update users with NULL value (which defaulted to 120 in application code)
-    op.execute(
-        user_settings_table.update()
-        .where(user_settings_table.c.condenser_max_size.is_(None))
-        .values(condenser_max_size=240)
-    )
-
-
-def downgrade() -> None:
-    """Downgrade schema.
-
-    Note: This sets all 240 values back to NULL (not 120) since we can't
-    distinguish between users who had 120 vs NULL before the upgrade.
-    """
-    user_settings_table = table(
-        'user_settings', column('condenser_max_size', sa.Integer)
-    )
-    op.execute(
-        user_settings_table.update()
-        .where(user_settings_table.c.condenser_max_size == 240)
-        .values(condenser_max_size=None)
-    )

enterprise/migrations/versions/087_create_blocked_email_domains_table.py

@@ -1,54 +0,0 @@
-"""create blocked_email_domains table
-
-Revision ID: 087
-Revises: 086
-Create Date: 2025-01-27 00:00:00.000000
-
-"""
-
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision: str = '087'
-down_revision: Union[str, None] = '086'
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    """Create blocked_email_domains table for storing blocked email domain patterns."""
-    op.create_table(
-        'blocked_email_domains',
-        sa.Column('id', sa.Integer(), sa.Identity(), nullable=False, primary_key=True),
-        sa.Column('domain', sa.String(), nullable=False),
-        sa.Column(
-            'created_at',
-            sa.DateTime(timezone=True),
-            nullable=False,
-            server_default=sa.text('CURRENT_TIMESTAMP'),
-        ),
-        sa.Column(
-            'updated_at',
-            sa.DateTime(timezone=True),
-            nullable=False,
-            server_default=sa.text('CURRENT_TIMESTAMP'),
-        ),
-        sa.PrimaryKeyConstraint('id'),
-    )
-
-    # Create unique index on domain column
-    op.create_index(
-        'ix_blocked_email_domains_domain',
-        'blocked_email_domains',
-        ['domain'],
-        unique=True,
-    )
-
-
-def downgrade() -> None:
-    """Drop blocked_email_domains table."""
-    op.drop_index('ix_blocked_email_domains_domain', table_name='blocked_email_domains')
-    op.drop_table('blocked_email_domains')

enterprise/poetry.lock

@@ -4517,14 +4517,14 @@ dev = ["Sphinx (>=5.1.1)", "black (==24.8.0)", "build (>=0.10.0)", "coverage[tom
 
 [[package]]
 name = "libtmux"
-version = "0.53.0"
+version = "0.46.2"
 description = "Typed library that provides an ORM wrapper for tmux, a terminal multiplexer."
 optional = false
-python-versions = "<4.0,>=3.10"
+python-versions = "<4.0,>=3.9"
 groups = ["main"]
 files = [
-    {file = "libtmux-0.53.0-py3-none-any.whl", hash = "sha256:024b7ae6a12aae55358e8feb914c8632b3ab9bd61c0987c53559643c6a58ee4f"},
-    {file = "libtmux-0.53.0.tar.gz", hash = "sha256:1d19af4cea0c19543954d7e7317c7025c0739b029cccbe3b843212fae238f1bd"},
+    {file = "libtmux-0.46.2-py3-none-any.whl", hash = "sha256:6c32dbf22bde8e5e33b2714a4295f6e838dc640f337cd4c085a044f6828c7793"},
+    {file = "libtmux-0.46.2.tar.gz", hash = "sha256:9a398fec5d714129c8344555d466e1a903dfc0f741ba07aabe75a8ceb25c5dda"},
 ]
 
 [[package]]
@@ -4558,25 +4558,25 @@ valkey = ["valkey (>=6)"]
 
 [[package]]
 name = "litellm"
-version = "1.80.11"
+version = "1.80.7"
 description = "Library to easily interface with LLM API providers"
 optional = false
 python-versions = "<4.0,>=3.9"
 groups = ["main"]
 files = [
-    {file = "litellm-1.80.11-py3-none-any.whl", hash = "sha256:406283d66ead77dc7ff0e0b2559c80e9e497d8e7c2257efb1cb9210a20d09d54"},
-    {file = "litellm-1.80.11.tar.gz", hash = "sha256:c9fc63e7acb6360363238fe291bcff1488c59ff66020416d8376c0ee56414a19"},
+    {file = "litellm-1.80.7-py3-none-any.whl", hash = "sha256:f7d993f78c1e0e4e1202b2a925cc6540b55b6e5fb055dd342d88b145ab3102ed"},
+    {file = "litellm-1.80.7.tar.gz", hash = "sha256:3977a8d195aef842d01c18bf9e22984829363c6a4b54daf9a43c9dd9f190b42c"},
 ]
 
 [package.dependencies]
 aiohttp = ">=3.10"
 click = "*"
 fastuuid = ">=0.13.0"
-grpcio = {version = ">=1.62.3,<1.68.0", markers = "python_version < \"3.14\""}
+grpcio = ">=1.62.3,<1.68.0"
 httpx = ">=0.23.0"
 importlib-metadata = ">=6.8.0"
 jinja2 = ">=3.1.2,<4.0.0"
-jsonschema = ">=4.23.0,<5.0.0"
+jsonschema = ">=4.22.0,<5.0.0"
 openai = ">=2.8.0"
 pydantic = ">=2.5.0,<3.0.0"
 python-dotenv = ">=0.2.0"
@@ -4587,7 +4587,7 @@ tokenizers = "*"
 caching = ["diskcache (>=5.6.1,<6.0.0)"]
 extra-proxy = ["azure-identity (>=1.15.0,<2.0.0) ; python_version >= \"3.9\"", "azure-keyvault-secrets (>=4.8.0,<5.0.0)", "google-cloud-iam (>=2.19.1,<3.0.0)", "google-cloud-kms (>=2.21.3,<3.0.0)", "prisma (==0.11.0)", "redisvl (>=0.4.1,<0.5.0) ; python_version >= \"3.9\" and python_version < \"3.14\"", "resend (>=0.8.0)"]
 mlflow = ["mlflow (>3.1.4) ; python_version >= \"3.10\""]
-proxy = ["PyJWT (>=2.10.1,<3.0.0) ; python_version >= \"3.9\"", "apscheduler (>=3.10.4,<4.0.0)", "azure-identity (>=1.15.0,<2.0.0) ; python_version >= \"3.9\"", "azure-storage-blob (>=12.25.1,<13.0.0)", "backoff", "boto3 (==1.36.0)", "cryptography", "fastapi (>=0.120.1)", "fastapi-sso (>=0.16.0,<0.17.0)", "gunicorn (>=23.0.0,<24.0.0)", "litellm-enterprise (==0.1.27)", "litellm-proxy-extras (==0.4.16)", "mcp (>=1.21.2,<2.0.0) ; python_version >= \"3.10\"", "orjson (>=3.9.7,<4.0.0)", "polars (>=1.31.0,<2.0.0) ; python_version >= \"3.10\"", "pynacl (>=1.5.0,<2.0.0)", "python-multipart (>=0.0.18,<0.0.19)", "pyyaml (>=6.0.1,<7.0.0)", "rich (==13.7.1)", "rq", "soundfile (>=0.12.1,<0.13.0)", "uvicorn (>=0.31.1,<0.32.0)", "uvloop (>=0.21.0,<0.22.0) ; sys_platform != \"win32\"", "websockets (>=15.0.1,<16.0.0)"]
+proxy = ["PyJWT (>=2.10.1,<3.0.0) ; python_version >= \"3.9\"", "apscheduler (>=3.10.4,<4.0.0)", "azure-identity (>=1.15.0,<2.0.0) ; python_version >= \"3.9\"", "azure-storage-blob (>=12.25.1,<13.0.0)", "backoff", "boto3 (==1.36.0)", "cryptography", "fastapi (>=0.120.1)", "fastapi-sso (>=0.16.0,<0.17.0)", "gunicorn (>=23.0.0,<24.0.0)", "litellm-enterprise (==0.1.22)", "litellm-proxy-extras (==0.4.9)", "mcp (>=1.21.2,<2.0.0) ; python_version >= \"3.10\"", "orjson (>=3.9.7,<4.0.0)", "polars (>=1.31.0,<2.0.0) ; python_version >= \"3.10\"", "pynacl (>=1.5.0,<2.0.0)", "python-multipart (>=0.0.18,<0.0.19)", "pyyaml (>=6.0.1,<7.0.0)", "rich (==13.7.1)", "rq", "soundfile (>=0.12.1,<0.13.0)", "uvicorn (>=0.31.1,<0.32.0)", "uvloop (>=0.21.0,<0.22.0) ; sys_platform != \"win32\"", "websockets (>=15.0.1,<16.0.0)"]
 semantic-router = ["semantic-router (>=0.1.12) ; python_version >= \"3.9\" and python_version < \"3.14\""]
 utils = ["numpydoc"]
 
@@ -5836,14 +5836,14 @@ llama = ["llama-index (>=0.12.29,<0.13.0)", "llama-index-core (>=0.12.29,<0.13.0
 
 [[package]]
 name = "openhands-agent-server"
-version = "1.7.4"
+version = "1.6.0"
 description = "OpenHands Agent Server - REST/WebSocket interface for OpenHands AI Agent"
 optional = false
 python-versions = ">=3.12"
 groups = ["main"]
 files = [
-    {file = "openhands_agent_server-1.7.4-py3-none-any.whl", hash = "sha256:997b3dc5243a1ba105f5bd9b0b5bc0cd590c5aa79cd609f23f841218e5f77393"},
-    {file = "openhands_agent_server-1.7.4.tar.gz", hash = "sha256:0491cf2a5d596610364cbbe9360412bc10a66ae71c0466ab64fd264826e6f1d8"},
+    {file = "openhands_agent_server-1.6.0-py3-none-any.whl", hash = "sha256:e6ae865ac3e7a96b234e10a0faad23f6210e025bbf7721cb66bc7a71d160848c"},
+    {file = "openhands_agent_server-1.6.0.tar.gz", hash = "sha256:44ce7694ae2d4bb0666d318ef13e6618bd4dc73022c60354839fe6130e67d02a"},
 ]
 
 [package.dependencies]
@@ -5860,7 +5860,7 @@ wsproto = ">=1.2.0"
 
 [[package]]
 name = "openhands-ai"
-version = "0.0.0-post.5803+a8098505c"
+version = "0.0.0-post.5687+7853b41ad"
 description = "OpenHands: Code Less, Make More"
 optional = false
 python-versions = "^3.12,<3.14"
@@ -5896,15 +5896,15 @@ json-repair = "*"
 jupyter_kernel_gateway = "*"
 kubernetes = "^33.1.0"
 libtmux = ">=0.46.2"
-litellm = ">=1.74.3, !=1.64.4, !=1.67.*"
+litellm = ">=1.74.3, <=1.80.7, !=1.64.4, !=1.67.*"
 lmnr = "^0.7.20"
 memory-profiler = "^0.61.0"
 numpy = "*"
 openai = "2.8.0"
 openhands-aci = "0.3.2"
-openhands-agent-server = "1.7.4"
-openhands-sdk = "1.7.4"
-openhands-tools = "1.7.4"
+openhands-agent-server = "1.6.0"
+openhands-sdk = "1.6.0"
+openhands-tools = "1.6.0"
 opentelemetry-api = "^1.33.1"
 opentelemetry-exporter-otlp-proto-grpc = "^1.33.1"
 pathspec = "^0.12.1"
@@ -5921,6 +5921,7 @@ pygithub = "^2.5.0"
 pyjwt = "^2.9.0"
 pylatexenc = "*"
 pypdf = "^6.0.0"
+PyPDF2 = "*"
 python-docx = "*"
 python-dotenv = "*"
 python-frontmatter = "^1.1.0"
@@ -5959,23 +5960,23 @@ url = ".."
 
 [[package]]
 name = "openhands-sdk"
-version = "1.7.4"
+version = "1.6.0"
 description = "OpenHands SDK - Core functionality for building AI agents"
 optional = false
 python-versions = ">=3.12"
 groups = ["main"]
 files = [
-    {file = "openhands_sdk-1.7.4-py3-none-any.whl", hash = "sha256:b57511a0467bd3fa64e8cccb7e8026f95e10ee7c5b148335eaa762a32aad8369"},
-    {file = "openhands_sdk-1.7.4.tar.gz", hash = "sha256:f8e63f996a13d2ea41447384b77a4ffebeb9e85aa54fafcf584f97f7cdc2cd9b"},
+    {file = "openhands_sdk-1.6.0-py3-none-any.whl", hash = "sha256:94d2f87fb35406373da6728ae2d88584137f9e9b67fa0e940444c72f2e44e7d3"},
+    {file = "openhands_sdk-1.6.0.tar.gz", hash = "sha256:f45742350e3874a7f5b08befc4a9d5adc7e4454f7ab5f8391c519eee3116090f"},
 ]
 
 [package.dependencies]
 deprecation = ">=2.1.0"
 fastmcp = ">=2.11.3"
 httpx = ">=0.27.0"
-litellm = ">=1.80.10"
+litellm = ">=1.80.7"
 lmnr = ">=0.7.24"
-pydantic = ">=2.12.5"
+pydantic = ">=2.11.7"
 python-frontmatter = ">=1.1.0"
 python-json-logger = ">=3.3.0"
 tenacity = ">=9.1.2"
@@ -5986,14 +5987,14 @@ boto3 = ["boto3 (>=1.35.0)"]
 
 [[package]]
 name = "openhands-tools"
-version = "1.7.4"
+version = "1.6.0"
 description = "OpenHands Tools - Runtime tools for AI agents"
 optional = false
 python-versions = ">=3.12"
 groups = ["main"]
 files = [
-    {file = "openhands_tools-1.7.4-py3-none-any.whl", hash = "sha256:b6a9b04bc59610087d6df789054c966df176c16371fc9c0b0f333ba09f5710d1"},
-    {file = "openhands_tools-1.7.4.tar.gz", hash = "sha256:776b570da0e86ae48c7815e9adb3839e953e2f4cab7295184ce15849348c52e7"},
+    {file = "openhands_tools-1.6.0-py3-none-any.whl", hash = "sha256:176556d44186536751b23fe052d3505492cc2afb8d52db20fb7a2cc0169cd57a"},
+    {file = "openhands_tools-1.6.0.tar.gz", hash = "sha256:d07ba31050fd4a7891a4c48388aa53ce9f703e17064ddbd59146d6c77e5980b3"},
 ]
 
 [package.dependencies]
@@ -6002,7 +6003,7 @@ binaryornot = ">=0.4.4"
 browser-use = ">=0.8.0"
 cachetools = "*"
 func-timeout = ">=4.3.5"
-libtmux = ">=0.53.0"
+libtmux = ">=0.46.2"
 openhands-sdk = "*"
 pydantic = ">=2.11.7"
 tom-swe = ">=1.0.3"
@@ -7254,22 +7255,22 @@ markers = {test = "platform_python_implementation == \"CPython\" and sys_platfor
 
 [[package]]
 name = "pydantic"
-version = "2.12.5"
+version = "2.11.7"
 description = "Data validation using Python type hints"
 optional = false
 python-versions = ">=3.9"
 groups = ["main", "test"]
 files = [
-    {file = "pydantic-2.12.5-py3-none-any.whl", hash = "sha256:e561593fccf61e8a20fc46dfc2dfe075b8be7d0188df33f221ad1f0139180f9d"},
-    {file = "pydantic-2.12.5.tar.gz", hash = "sha256:4d351024c75c0f085a9febbb665ce8c0c6ec5d30e903bdb6394b7ede26aebb49"},
+    {file = "pydantic-2.11.7-py3-none-any.whl", hash = "sha256:dde5df002701f6de26248661f6835bbe296a47bf73990135c7d07ce741b9623b"},
+    {file = "pydantic-2.11.7.tar.gz", hash = "sha256:d989c3c6cb79469287b1569f7447a17848c998458d49ebe294e975b9baf0f0db"},
 ]
 
 [package.dependencies]
 annotated-types = ">=0.6.0"
 email-validator = {version = ">=2.0.0", optional = true, markers = "extra == \"email\""}
-pydantic-core = "2.41.5"
-typing-extensions = ">=4.14.1"
-typing-inspection = ">=0.4.2"
+pydantic-core = "2.33.2"
+typing-extensions = ">=4.12.2"
+typing-inspection = ">=0.4.0"
 
 [package.extras]
 email = ["email-validator (>=2.0.0)"]
@@ -7277,137 +7278,115 @@ timezone = ["tzdata ; python_version >= \"3.9\" and platform_system == \"Windows
 
 [[package]]
 name = "pydantic-core"
-version = "2.41.5"
+version = "2.33.2"
 description = "Core functionality for Pydantic validation and serialization"
 optional = false
 python-versions = ">=3.9"
 groups = ["main", "test"]
 files = [
-    {file = "pydantic_core-2.41.5-cp310-cp310-macosx_10_12_x86_64.whl", hash = "sha256:77b63866ca88d804225eaa4af3e664c5faf3568cea95360d21f4725ab6e07146"},
-    {file = "pydantic_core-2.41.5-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:dfa8a0c812ac681395907e71e1274819dec685fec28273a28905df579ef137e2"},
-    {file = "pydantic_core-2.41.5-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5921a4d3ca3aee735d9fd163808f5e8dd6c6972101e4adbda9a4667908849b97"},
-    {file = "pydantic_core-2.41.5-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:e25c479382d26a2a41b7ebea1043564a937db462816ea07afa8a44c0866d52f9"},
-    {file = "pydantic_core-2.41.5-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f547144f2966e1e16ae626d8ce72b4cfa0caedc7fa28052001c94fb2fcaa1c52"},
-    {file = "pydantic_core-2.41.5-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:6f52298fbd394f9ed112d56f3d11aabd0d5bd27beb3084cc3d8ad069483b8941"},
-    {file = "pydantic_core-2.41.5-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:100baa204bb412b74fe285fb0f3a385256dad1d1879f0a5cb1499ed2e83d132a"},
-    {file = "pydantic_core-2.41.5-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:05a2c8852530ad2812cb7914dc61a1125dc4e06252ee98e5638a12da6cc6fb6c"},
-    {file = "pydantic_core-2.41.5-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:29452c56df2ed968d18d7e21f4ab0ac55e71dc59524872f6fc57dcf4a3249ed2"},
-    {file = "pydantic_core-2.41.5-cp310-cp310-musllinux_1_1_armv7l.whl", hash = "sha256:d5160812ea7a8a2ffbe233d8da666880cad0cbaf5d4de74ae15c313213d62556"},
-    {file = "pydantic_core-2.41.5-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:df3959765b553b9440adfd3c795617c352154e497a4eaf3752555cfb5da8fc49"},
-    {file = "pydantic_core-2.41.5-cp310-cp310-win32.whl", hash = "sha256:1f8d33a7f4d5a7889e60dc39856d76d09333d8a6ed0f5f1190635cbec70ec4ba"},
-    {file = "pydantic_core-2.41.5-cp310-cp310-win_amd64.whl", hash = "sha256:62de39db01b8d593e45871af2af9e497295db8d73b085f6bfd0b18c83c70a8f9"},
-    {file = "pydantic_core-2.41.5-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:a3a52f6156e73e7ccb0f8cced536adccb7042be67cb45f9562e12b319c119da6"},
-    {file = "pydantic_core-2.41.5-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:7f3bf998340c6d4b0c9a2f02d6a400e51f123b59565d74dc60d252ce888c260b"},
-    {file = "pydantic_core-2.41.5-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:378bec5c66998815d224c9ca994f1e14c0c21cb95d2f52b6021cc0b2a58f2a5a"},
-    {file = "pydantic_core-2.41.5-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:e7b576130c69225432866fe2f4a469a85a54ade141d96fd396dffcf607b558f8"},
-    {file = "pydantic_core-2.41.5-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:6cb58b9c66f7e4179a2d5e0f849c48eff5c1fca560994d6eb6543abf955a149e"},
-    {file = "pydantic_core-2.41.5-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:88942d3a3dff3afc8288c21e565e476fc278902ae4d6d134f1eeda118cc830b1"},
-    {file = "pydantic_core-2.41.5-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f31d95a179f8d64d90f6831d71fa93290893a33148d890ba15de25642c5d075b"},
-    {file = "pydantic_core-2.41.5-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:c1df3d34aced70add6f867a8cf413e299177e0c22660cc767218373d0779487b"},
-    {file = "pydantic_core-2.41.5-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:4009935984bd36bd2c774e13f9a09563ce8de4abaa7226f5108262fa3e637284"},
-    {file = "pydantic_core-2.41.5-cp311-cp311-musllinux_1_1_armv7l.whl", hash = "sha256:34a64bc3441dc1213096a20fe27e8e128bd3ff89921706e83c0b1ac971276594"},
-    {file = "pydantic_core-2.41.5-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:c9e19dd6e28fdcaa5a1de679aec4141f691023916427ef9bae8584f9c2fb3b0e"},
-    {file = "pydantic_core-2.41.5-cp311-cp311-win32.whl", hash = "sha256:2c010c6ded393148374c0f6f0bf89d206bf3217f201faa0635dcd56bd1520f6b"},
-    {file = "pydantic_core-2.41.5-cp311-cp311-win_amd64.whl", hash = "sha256:76ee27c6e9c7f16f47db7a94157112a2f3a00e958bc626e2f4ee8bec5c328fbe"},
-    {file = "pydantic_core-2.41.5-cp311-cp311-win_arm64.whl", hash = "sha256:4bc36bbc0b7584de96561184ad7f012478987882ebf9f9c389b23f432ea3d90f"},
-    {file = "pydantic_core-2.41.5-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:f41a7489d32336dbf2199c8c0a215390a751c5b014c2c1c5366e817202e9cdf7"},
-    {file = "pydantic_core-2.41.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:070259a8818988b9a84a449a2a7337c7f430a22acc0859c6b110aa7212a6d9c0"},
-    {file = "pydantic_core-2.41.5-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e96cea19e34778f8d59fe40775a7a574d95816eb150850a85a7a4c8f4b94ac69"},
-    {file = "pydantic_core-2.41.5-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:ed2e99c456e3fadd05c991f8f437ef902e00eedf34320ba2b0842bd1c3ca3a75"},
-    {file = "pydantic_core-2.41.5-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:65840751b72fbfd82c3c640cff9284545342a4f1eb1586ad0636955b261b0b05"},
-    {file = "pydantic_core-2.41.5-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e536c98a7626a98feb2d3eaf75944ef6f3dbee447e1f841eae16f2f0a72d8ddc"},
-    {file = "pydantic_core-2.41.5-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:eceb81a8d74f9267ef4081e246ffd6d129da5d87e37a77c9bde550cb04870c1c"},
-    {file = "pydantic_core-2.41.5-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:d38548150c39b74aeeb0ce8ee1d8e82696f4a4e16ddc6de7b1d8823f7de4b9b5"},
-    {file = "pydantic_core-2.41.5-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:c23e27686783f60290e36827f9c626e63154b82b116d7fe9adba1fda36da706c"},
-    {file = "pydantic_core-2.41.5-cp312-cp312-musllinux_1_1_armv7l.whl", hash = "sha256:482c982f814460eabe1d3bb0adfdc583387bd4691ef00b90575ca0d2b6fe2294"},
-    {file = "pydantic_core-2.41.5-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:bfea2a5f0b4d8d43adf9d7b8bf019fb46fdd10a2e5cde477fbcb9d1fa08c68e1"},
-    {file = "pydantic_core-2.41.5-cp312-cp312-win32.whl", hash = "sha256:b74557b16e390ec12dca509bce9264c3bbd128f8a2c376eaa68003d7f327276d"},
-    {file = "pydantic_core-2.41.5-cp312-cp312-win_amd64.whl", hash = "sha256:1962293292865bca8e54702b08a4f26da73adc83dd1fcf26fbc875b35d81c815"},
-    {file = "pydantic_core-2.41.5-cp312-cp312-win_arm64.whl", hash = "sha256:1746d4a3d9a794cacae06a5eaaccb4b8643a131d45fbc9af23e353dc0a5ba5c3"},
-    {file = "pydantic_core-2.41.5-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:941103c9be18ac8daf7b7adca8228f8ed6bb7a1849020f643b3a14d15b1924d9"},
-    {file = "pydantic_core-2.41.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:112e305c3314f40c93998e567879e887a3160bb8689ef3d2c04b6cc62c33ac34"},
-    {file = "pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0cbaad15cb0c90aa221d43c00e77bb33c93e8d36e0bf74760cd00e732d10a6a0"},
-    {file = "pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:03ca43e12fab6023fc79d28ca6b39b05f794ad08ec2feccc59a339b02f2b3d33"},
-    {file = "pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:dc799088c08fa04e43144b164feb0c13f9a0bc40503f8df3e9fde58a3c0c101e"},
-    {file = "pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:97aeba56665b4c3235a0e52b2c2f5ae9cd071b8a8310ad27bddb3f7fb30e9aa2"},
-    {file = "pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:406bf18d345822d6c21366031003612b9c77b3e29ffdb0f612367352aab7d586"},
-    {file = "pydantic_core-2.41.5-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:b93590ae81f7010dbe380cdeab6f515902ebcbefe0b9327cc4804d74e93ae69d"},
-    {file = "pydantic_core-2.41.5-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:01a3d0ab748ee531f4ea6c3e48ad9dac84ddba4b0d82291f87248f2f9de8d740"},
-    {file = "pydantic_core-2.41.5-cp313-cp313-musllinux_1_1_armv7l.whl", hash = "sha256:6561e94ba9dacc9c61bce40e2d6bdc3bfaa0259d3ff36ace3b1e6901936d2e3e"},
-    {file = "pydantic_core-2.41.5-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:915c3d10f81bec3a74fbd4faebe8391013ba61e5a1a8d48c4455b923bdda7858"},
-    {file = "pydantic_core-2.41.5-cp313-cp313-win32.whl", hash = "sha256:650ae77860b45cfa6e2cdafc42618ceafab3a2d9a3811fcfbd3bbf8ac3c40d36"},
-    {file = "pydantic_core-2.41.5-cp313-cp313-win_amd64.whl", hash = "sha256:79ec52ec461e99e13791ec6508c722742ad745571f234ea6255bed38c6480f11"},
-    {file = "pydantic_core-2.41.5-cp313-cp313-win_arm64.whl", hash = "sha256:3f84d5c1b4ab906093bdc1ff10484838aca54ef08de4afa9de0f5f14d69639cd"},
-    {file = "pydantic_core-2.41.5-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:3f37a19d7ebcdd20b96485056ba9e8b304e27d9904d233d7b1015db320e51f0a"},
-    {file = "pydantic_core-2.41.5-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:1d1d9764366c73f996edd17abb6d9d7649a7eb690006ab6adbda117717099b14"},
-    {file = "pydantic_core-2.41.5-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:25e1c2af0fce638d5f1988b686f3b3ea8cd7de5f244ca147c777769e798a9cd1"},
-    {file = "pydantic_core-2.41.5-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:506d766a8727beef16b7adaeb8ee6217c64fc813646b424d0804d67c16eddb66"},
-    {file = "pydantic_core-2.41.5-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4819fa52133c9aa3c387b3328f25c1facc356491e6135b459f1de698ff64d869"},
-    {file = "pydantic_core-2.41.5-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:2b761d210c9ea91feda40d25b4efe82a1707da2ef62901466a42492c028553a2"},
-    {file = "pydantic_core-2.41.5-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:22f0fb8c1c583a3b6f24df2470833b40207e907b90c928cc8d3594b76f874375"},
-    {file = "pydantic_core-2.41.5-cp314-cp314-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:2782c870e99878c634505236d81e5443092fba820f0373997ff75f90f68cd553"},
-    {file = "pydantic_core-2.41.5-cp314-cp314-musllinux_1_1_aarch64.whl", hash = "sha256:0177272f88ab8312479336e1d777f6b124537d47f2123f89cb37e0accea97f90"},
-    {file = "pydantic_core-2.41.5-cp314-cp314-musllinux_1_1_armv7l.whl", hash = "sha256:63510af5e38f8955b8ee5687740d6ebf7c2a0886d15a6d65c32814613681bc07"},
-    {file = "pydantic_core-2.41.5-cp314-cp314-musllinux_1_1_x86_64.whl", hash = "sha256:e56ba91f47764cc14f1daacd723e3e82d1a89d783f0f5afe9c364b8bb491ccdb"},
-    {file = "pydantic_core-2.41.5-cp314-cp314-win32.whl", hash = "sha256:aec5cf2fd867b4ff45b9959f8b20ea3993fc93e63c7363fe6851424c8a7e7c23"},
-    {file = "pydantic_core-2.41.5-cp314-cp314-win_amd64.whl", hash = "sha256:8e7c86f27c585ef37c35e56a96363ab8de4e549a95512445b85c96d3e2f7c1bf"},
-    {file = "pydantic_core-2.41.5-cp314-cp314-win_arm64.whl", hash = "sha256:e672ba74fbc2dc8eea59fb6d4aed6845e6905fc2a8afe93175d94a83ba2a01a0"},
-    {file = "pydantic_core-2.41.5-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:8566def80554c3faa0e65ac30ab0932b9e3a5cd7f8323764303d468e5c37595a"},
-    {file = "pydantic_core-2.41.5-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:b80aa5095cd3109962a298ce14110ae16b8c1aece8b72f9dafe81cf597ad80b3"},
-    {file = "pydantic_core-2.41.5-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3006c3dd9ba34b0c094c544c6006cc79e87d8612999f1a5d43b769b89181f23c"},
-    {file = "pydantic_core-2.41.5-cp314-cp314t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:72f6c8b11857a856bcfa48c86f5368439f74453563f951e473514579d44aa612"},
-    {file = "pydantic_core-2.41.5-cp314-cp314t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:5cb1b2f9742240e4bb26b652a5aeb840aa4b417c7748b6f8387927bc6e45e40d"},
-    {file = "pydantic_core-2.41.5-cp314-cp314t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:bd3d54f38609ff308209bd43acea66061494157703364ae40c951f83ba99a1a9"},
-    {file = "pydantic_core-2.41.5-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2ff4321e56e879ee8d2a879501c8e469414d948f4aba74a2d4593184eb326660"},
-    {file = "pydantic_core-2.41.5-cp314-cp314t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:d0d2568a8c11bf8225044aa94409e21da0cb09dcdafe9ecd10250b2baad531a9"},
-    {file = "pydantic_core-2.41.5-cp314-cp314t-musllinux_1_1_aarch64.whl", hash = "sha256:a39455728aabd58ceabb03c90e12f71fd30fa69615760a075b9fec596456ccc3"},
-    {file = "pydantic_core-2.41.5-cp314-cp314t-musllinux_1_1_armv7l.whl", hash = "sha256:239edca560d05757817c13dc17c50766136d21f7cd0fac50295499ae24f90fdf"},
-    {file = "pydantic_core-2.41.5-cp314-cp314t-musllinux_1_1_x86_64.whl", hash = "sha256:2a5e06546e19f24c6a96a129142a75cee553cc018ffee48a460059b1185f4470"},
-    {file = "pydantic_core-2.41.5-cp314-cp314t-win32.whl", hash = "sha256:b4ececa40ac28afa90871c2cc2b9ffd2ff0bf749380fbdf57d165fd23da353aa"},
-    {file = "pydantic_core-2.41.5-cp314-cp314t-win_amd64.whl", hash = "sha256:80aa89cad80b32a912a65332f64a4450ed00966111b6615ca6816153d3585a8c"},
-    {file = "pydantic_core-2.41.5-cp314-cp314t-win_arm64.whl", hash = "sha256:35b44f37a3199f771c3eaa53051bc8a70cd7b54f333531c59e29fd4db5d15008"},
-    {file = "pydantic_core-2.41.5-cp39-cp39-macosx_10_12_x86_64.whl", hash = "sha256:8bfeaf8735be79f225f3fefab7f941c712aaca36f1128c9d7e2352ee1aa87bdf"},
-    {file = "pydantic_core-2.41.5-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:346285d28e4c8017da95144c7f3acd42740d637ff41946af5ce6e5e420502dd5"},
-    {file = "pydantic_core-2.41.5-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a75dafbf87d6276ddc5b2bf6fae5254e3d0876b626eb24969a574fff9149ee5d"},
-    {file = "pydantic_core-2.41.5-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:7b93a4d08587e2b7e7882de461e82b6ed76d9026ce91ca7915e740ecc7855f60"},
-    {file = "pydantic_core-2.41.5-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:e8465ab91a4bd96d36dde3263f06caa6a8a6019e4113f24dc753d79a8b3a3f82"},
-    {file = "pydantic_core-2.41.5-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:299e0a22e7ae2b85c1a57f104538b2656e8ab1873511fd718a1c1c6f149b77b5"},
-    {file = "pydantic_core-2.41.5-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:707625ef0983fcfb461acfaf14de2067c5942c6bb0f3b4c99158bed6fedd3cf3"},
-    {file = "pydantic_core-2.41.5-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:f41eb9797986d6ebac5e8edff36d5cef9de40def462311b3eb3eeded1431e425"},
-    {file = "pydantic_core-2.41.5-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:0384e2e1021894b1ff5a786dbf94771e2986ebe2869533874d7e43bc79c6f504"},
-    {file = "pydantic_core-2.41.5-cp39-cp39-musllinux_1_1_armv7l.whl", hash = "sha256:f0cd744688278965817fd0839c4a4116add48d23890d468bc436f78beb28abf5"},
-    {file = "pydantic_core-2.41.5-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:753e230374206729bf0a807954bcc6c150d3743928a73faffee51ac6557a03c3"},
-    {file = "pydantic_core-2.41.5-cp39-cp39-win32.whl", hash = "sha256:873e0d5b4fb9b89ef7c2d2a963ea7d02879d9da0da8d9d4933dee8ee86a8b460"},
-    {file = "pydantic_core-2.41.5-cp39-cp39-win_amd64.whl", hash = "sha256:e4f4a984405e91527a0d62649ee21138f8e3d0ef103be488c1dc11a80d7f184b"},
-    {file = "pydantic_core-2.41.5-graalpy311-graalpy242_311_native-macosx_10_12_x86_64.whl", hash = "sha256:b96d5f26b05d03cc60f11a7761a5ded1741da411e7fe0909e27a5e6a0cb7b034"},
-    {file = "pydantic_core-2.41.5-graalpy311-graalpy242_311_native-macosx_11_0_arm64.whl", hash = "sha256:634e8609e89ceecea15e2d61bc9ac3718caaaa71963717bf3c8f38bfde64242c"},
-    {file = "pydantic_core-2.41.5-graalpy311-graalpy242_311_native-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:93e8740d7503eb008aa2df04d3b9735f845d43ae845e6dcd2be0b55a2da43cd2"},
-    {file = "pydantic_core-2.41.5-graalpy311-graalpy242_311_native-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f15489ba13d61f670dcc96772e733aad1a6f9c429cc27574c6cdaed82d0146ad"},
-    {file = "pydantic_core-2.41.5-graalpy312-graalpy250_312_native-macosx_10_12_x86_64.whl", hash = "sha256:7da7087d756b19037bc2c06edc6c170eeef3c3bafcb8f532ff17d64dc427adfd"},
-    {file = "pydantic_core-2.41.5-graalpy312-graalpy250_312_native-macosx_11_0_arm64.whl", hash = "sha256:aabf5777b5c8ca26f7824cb4a120a740c9588ed58df9b2d196ce92fba42ff8dc"},
-    {file = "pydantic_core-2.41.5-graalpy312-graalpy250_312_native-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c007fe8a43d43b3969e8469004e9845944f1a80e6acd47c150856bb87f230c56"},
-    {file = "pydantic_core-2.41.5-graalpy312-graalpy250_312_native-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:76d0819de158cd855d1cbb8fcafdf6f5cf1eb8e470abe056d5d161106e38062b"},
-    {file = "pydantic_core-2.41.5-pp310-pypy310_pp73-macosx_10_12_x86_64.whl", hash = "sha256:b5819cd790dbf0c5eb9f82c73c16b39a65dd6dd4d1439dcdea7816ec9adddab8"},
-    {file = "pydantic_core-2.41.5-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:5a4e67afbc95fa5c34cf27d9089bca7fcab4e51e57278d710320a70b956d1b9a"},
-    {file = "pydantic_core-2.41.5-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ece5c59f0ce7d001e017643d8d24da587ea1f74f6993467d85ae8a5ef9d4f42b"},
-    {file = "pydantic_core-2.41.5-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:16f80f7abe3351f8ea6858914ddc8c77e02578544a0ebc15b4c2e1a0e813b0b2"},
-    {file = "pydantic_core-2.41.5-pp310-pypy310_pp73-musllinux_1_1_aarch64.whl", hash = "sha256:33cb885e759a705b426baada1fe68cbb0a2e68e34c5d0d0289a364cf01709093"},
-    {file = "pydantic_core-2.41.5-pp310-pypy310_pp73-musllinux_1_1_armv7l.whl", hash = "sha256:c8d8b4eb992936023be7dee581270af5c6e0697a8559895f527f5b7105ecd36a"},
-    {file = "pydantic_core-2.41.5-pp310-pypy310_pp73-musllinux_1_1_x86_64.whl", hash = "sha256:242a206cd0318f95cd21bdacff3fcc3aab23e79bba5cac3db5a841c9ef9c6963"},
-    {file = "pydantic_core-2.41.5-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:d3a978c4f57a597908b7e697229d996d77a6d3c94901e9edee593adada95ce1a"},
-    {file = "pydantic_core-2.41.5-pp311-pypy311_pp73-macosx_10_12_x86_64.whl", hash = "sha256:b2379fa7ed44ddecb5bfe4e48577d752db9fc10be00a6b7446e9663ba143de26"},
-    {file = "pydantic_core-2.41.5-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:266fb4cbf5e3cbd0b53669a6d1b039c45e3ce651fd5442eff4d07c2cc8d66808"},
-    {file = "pydantic_core-2.41.5-pp311-pypy311_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:58133647260ea01e4d0500089a8c4f07bd7aa6ce109682b1426394988d8aaacc"},
-    {file = "pydantic_core-2.41.5-pp311-pypy311_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:287dad91cfb551c363dc62899a80e9e14da1f0e2b6ebde82c806612ca2a13ef1"},
-    {file = "pydantic_core-2.41.5-pp311-pypy311_pp73-musllinux_1_1_aarch64.whl", hash = "sha256:03b77d184b9eb40240ae9fd676ca364ce1085f203e1b1256f8ab9984dca80a84"},
-    {file = "pydantic_core-2.41.5-pp311-pypy311_pp73-musllinux_1_1_armv7l.whl", hash = "sha256:a668ce24de96165bb239160b3d854943128f4334822900534f2fe947930e5770"},
-    {file = "pydantic_core-2.41.5-pp311-pypy311_pp73-musllinux_1_1_x86_64.whl", hash = "sha256:f14f8f046c14563f8eb3f45f499cc658ab8d10072961e07225e507adb700e93f"},
-    {file = "pydantic_core-2.41.5-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:56121965f7a4dc965bff783d70b907ddf3d57f6eba29b6d2e5dabfaf07799c51"},
-    {file = "pydantic_core-2.41.5.tar.gz", hash = "sha256:08daa51ea16ad373ffd5e7606252cc32f07bc72b28284b6bc9c6df804816476e"},
+    {file = "pydantic_core-2.33.2-cp310-cp310-macosx_10_12_x86_64.whl", hash = "sha256:2b3d326aaef0c0399d9afffeb6367d5e26ddc24d351dbc9c636840ac355dc5d8"},
+    {file = "pydantic_core-2.33.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:0e5b2671f05ba48b94cb90ce55d8bdcaaedb8ba00cc5359f6810fc918713983d"},
+    {file = "pydantic_core-2.33.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0069c9acc3f3981b9ff4cdfaf088e98d83440a4c7ea1bc07460af3d4dc22e72d"},
+    {file = "pydantic_core-2.33.2-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:d53b22f2032c42eaaf025f7c40c2e3b94568ae077a606f006d206a463bc69572"},
+    {file = "pydantic_core-2.33.2-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0405262705a123b7ce9f0b92f123334d67b70fd1f20a9372b907ce1080c7ba02"},
+    {file = "pydantic_core-2.33.2-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4b25d91e288e2c4e0662b8038a28c6a07eaac3e196cfc4ff69de4ea3db992a1b"},
+    {file = "pydantic_core-2.33.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6bdfe4b3789761f3bcb4b1ddf33355a71079858958e3a552f16d5af19768fef2"},
+    {file = "pydantic_core-2.33.2-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:efec8db3266b76ef9607c2c4c419bdb06bf335ae433b80816089ea7585816f6a"},
+    {file = "pydantic_core-2.33.2-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:031c57d67ca86902726e0fae2214ce6770bbe2f710dc33063187a68744a5ecac"},
+    {file = "pydantic_core-2.33.2-cp310-cp310-musllinux_1_1_armv7l.whl", hash = "sha256:f8de619080e944347f5f20de29a975c2d815d9ddd8be9b9b7268e2e3ef68605a"},
+    {file = "pydantic_core-2.33.2-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:73662edf539e72a9440129f231ed3757faab89630d291b784ca99237fb94db2b"},
+    {file = "pydantic_core-2.33.2-cp310-cp310-win32.whl", hash = "sha256:0a39979dcbb70998b0e505fb1556a1d550a0781463ce84ebf915ba293ccb7e22"},
+    {file = "pydantic_core-2.33.2-cp310-cp310-win_amd64.whl", hash = "sha256:b0379a2b24882fef529ec3b4987cb5d003b9cda32256024e6fe1586ac45fc640"},
+    {file = "pydantic_core-2.33.2-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:4c5b0a576fb381edd6d27f0a85915c6daf2f8138dc5c267a57c08a62900758c7"},
+    {file = "pydantic_core-2.33.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:e799c050df38a639db758c617ec771fd8fb7a5f8eaaa4b27b101f266b216a246"},
+    {file = "pydantic_core-2.33.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:dc46a01bf8d62f227d5ecee74178ffc448ff4e5197c756331f71efcc66dc980f"},
+    {file = "pydantic_core-2.33.2-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:a144d4f717285c6d9234a66778059f33a89096dfb9b39117663fd8413d582dcc"},
+    {file = "pydantic_core-2.33.2-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:73cf6373c21bc80b2e0dc88444f41ae60b2f070ed02095754eb5a01df12256de"},
+    {file = "pydantic_core-2.33.2-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:3dc625f4aa79713512d1976fe9f0bc99f706a9dee21dfd1810b4bbbf228d0e8a"},
+    {file = "pydantic_core-2.33.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:881b21b5549499972441da4758d662aeea93f1923f953e9cbaff14b8b9565aef"},
+    {file = "pydantic_core-2.33.2-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:bdc25f3681f7b78572699569514036afe3c243bc3059d3942624e936ec93450e"},
+    {file = "pydantic_core-2.33.2-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:fe5b32187cbc0c862ee201ad66c30cf218e5ed468ec8dc1cf49dec66e160cc4d"},
+    {file = "pydantic_core-2.33.2-cp311-cp311-musllinux_1_1_armv7l.whl", hash = "sha256:bc7aee6f634a6f4a95676fcb5d6559a2c2a390330098dba5e5a5f28a2e4ada30"},
+    {file = "pydantic_core-2.33.2-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:235f45e5dbcccf6bd99f9f472858849f73d11120d76ea8707115415f8e5ebebf"},
+    {file = "pydantic_core-2.33.2-cp311-cp311-win32.whl", hash = "sha256:6368900c2d3ef09b69cb0b913f9f8263b03786e5b2a387706c5afb66800efd51"},
+    {file = "pydantic_core-2.33.2-cp311-cp311-win_amd64.whl", hash = "sha256:1e063337ef9e9820c77acc768546325ebe04ee38b08703244c1309cccc4f1bab"},
+    {file = "pydantic_core-2.33.2-cp311-cp311-win_arm64.whl", hash = "sha256:6b99022f1d19bc32a4c2a0d544fc9a76e3be90f0b3f4af413f87d38749300e65"},
+    {file = "pydantic_core-2.33.2-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:a7ec89dc587667f22b6a0b6579c249fca9026ce7c333fc142ba42411fa243cdc"},
+    {file = "pydantic_core-2.33.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:3c6db6e52c6d70aa0d00d45cdb9b40f0433b96380071ea80b09277dba021ddf7"},
+    {file = "pydantic_core-2.33.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4e61206137cbc65e6d5256e1166f88331d3b6238e082d9f74613b9b765fb9025"},
+    {file = "pydantic_core-2.33.2-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:eb8c529b2819c37140eb51b914153063d27ed88e3bdc31b71198a198e921e011"},
+    {file = "pydantic_core-2.33.2-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:c52b02ad8b4e2cf14ca7b3d918f3eb0ee91e63b3167c32591e57c4317e134f8f"},
+    {file = "pydantic_core-2.33.2-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:96081f1605125ba0855dfda83f6f3df5ec90c61195421ba72223de35ccfb2f88"},
+    {file = "pydantic_core-2.33.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8f57a69461af2a5fa6e6bbd7a5f60d3b7e6cebb687f55106933188e79ad155c1"},
+    {file = "pydantic_core-2.33.2-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:572c7e6c8bb4774d2ac88929e3d1f12bc45714ae5ee6d9a788a9fb35e60bb04b"},
+    {file = "pydantic_core-2.33.2-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:db4b41f9bd95fbe5acd76d89920336ba96f03e149097365afe1cb092fceb89a1"},
+    {file = "pydantic_core-2.33.2-cp312-cp312-musllinux_1_1_armv7l.whl", hash = "sha256:fa854f5cf7e33842a892e5c73f45327760bc7bc516339fda888c75ae60edaeb6"},
+    {file = "pydantic_core-2.33.2-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:5f483cfb75ff703095c59e365360cb73e00185e01aaea067cd19acffd2ab20ea"},
+    {file = "pydantic_core-2.33.2-cp312-cp312-win32.whl", hash = "sha256:9cb1da0f5a471435a7bc7e439b8a728e8b61e59784b2af70d7c169f8dd8ae290"},
+    {file = "pydantic_core-2.33.2-cp312-cp312-win_amd64.whl", hash = "sha256:f941635f2a3d96b2973e867144fde513665c87f13fe0e193c158ac51bfaaa7b2"},
+    {file = "pydantic_core-2.33.2-cp312-cp312-win_arm64.whl", hash = "sha256:cca3868ddfaccfbc4bfb1d608e2ccaaebe0ae628e1416aeb9c4d88c001bb45ab"},
+    {file = "pydantic_core-2.33.2-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:1082dd3e2d7109ad8b7da48e1d4710c8d06c253cbc4a27c1cff4fbcaa97a9e3f"},
+    {file = "pydantic_core-2.33.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:f517ca031dfc037a9c07e748cefd8d96235088b83b4f4ba8939105d20fa1dcd6"},
+    {file = "pydantic_core-2.33.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0a9f2c9dd19656823cb8250b0724ee9c60a82f3cdf68a080979d13092a3b0fef"},
+    {file = "pydantic_core-2.33.2-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:2b0a451c263b01acebe51895bfb0e1cc842a5c666efe06cdf13846c7418caa9a"},
+    {file = "pydantic_core-2.33.2-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1ea40a64d23faa25e62a70ad163571c0b342b8bf66d5fa612ac0dec4f069d916"},
+    {file = "pydantic_core-2.33.2-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:0fb2d542b4d66f9470e8065c5469ec676978d625a8b7a363f07d9a501a9cb36a"},
+    {file = "pydantic_core-2.33.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9fdac5d6ffa1b5a83bca06ffe7583f5576555e6c8b3a91fbd25ea7780f825f7d"},
+    {file = "pydantic_core-2.33.2-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:04a1a413977ab517154eebb2d326da71638271477d6ad87a769102f7c2488c56"},
+    {file = "pydantic_core-2.33.2-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:c8e7af2f4e0194c22b5b37205bfb293d166a7344a5b0d0eaccebc376546d77d5"},
+    {file = "pydantic_core-2.33.2-cp313-cp313-musllinux_1_1_armv7l.whl", hash = "sha256:5c92edd15cd58b3c2d34873597a1e20f13094f59cf88068adb18947df5455b4e"},
+    {file = "pydantic_core-2.33.2-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:65132b7b4a1c0beded5e057324b7e16e10910c106d43675d9bd87d4f38dde162"},
+    {file = "pydantic_core-2.33.2-cp313-cp313-win32.whl", hash = "sha256:52fb90784e0a242bb96ec53f42196a17278855b0f31ac7c3cc6f5c1ec4811849"},
+    {file = "pydantic_core-2.33.2-cp313-cp313-win_amd64.whl", hash = "sha256:c083a3bdd5a93dfe480f1125926afcdbf2917ae714bdb80b36d34318b2bec5d9"},
+    {file = "pydantic_core-2.33.2-cp313-cp313-win_arm64.whl", hash = "sha256:e80b087132752f6b3d714f041ccf74403799d3b23a72722ea2e6ba2e892555b9"},
+    {file = "pydantic_core-2.33.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:61c18fba8e5e9db3ab908620af374db0ac1baa69f0f32df4f61ae23f15e586ac"},
+    {file = "pydantic_core-2.33.2-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:95237e53bb015f67b63c91af7518a62a8660376a6a0db19b89acc77a4d6199f5"},
+    {file = "pydantic_core-2.33.2-cp313-cp313t-win_amd64.whl", hash = "sha256:c2fc0a768ef76c15ab9238afa6da7f69895bb5d1ee83aeea2e3509af4472d0b9"},
+    {file = "pydantic_core-2.33.2-cp39-cp39-macosx_10_12_x86_64.whl", hash = "sha256:a2b911a5b90e0374d03813674bf0a5fbbb7741570dcd4b4e85a2e48d17def29d"},
+    {file = "pydantic_core-2.33.2-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:6fa6dfc3e4d1f734a34710f391ae822e0a8eb8559a85c6979e14e65ee6ba2954"},
+    {file = "pydantic_core-2.33.2-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c54c939ee22dc8e2d545da79fc5381f1c020d6d3141d3bd747eab59164dc89fb"},
+    {file = "pydantic_core-2.33.2-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:53a57d2ed685940a504248187d5685e49eb5eef0f696853647bf37c418c538f7"},
+    {file = "pydantic_core-2.33.2-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:09fb9dd6571aacd023fe6aaca316bd01cf60ab27240d7eb39ebd66a3a15293b4"},
+    {file = "pydantic_core-2.33.2-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:0e6116757f7959a712db11f3e9c0a99ade00a5bbedae83cb801985aa154f071b"},
+    {file = "pydantic_core-2.33.2-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8d55ab81c57b8ff8548c3e4947f119551253f4e3787a7bbc0b6b3ca47498a9d3"},
+    {file = "pydantic_core-2.33.2-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:c20c462aa4434b33a2661701b861604913f912254e441ab8d78d30485736115a"},
+    {file = "pydantic_core-2.33.2-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:44857c3227d3fb5e753d5fe4a3420d6376fa594b07b621e220cd93703fe21782"},
+    {file = "pydantic_core-2.33.2-cp39-cp39-musllinux_1_1_armv7l.whl", hash = "sha256:eb9b459ca4df0e5c87deb59d37377461a538852765293f9e6ee834f0435a93b9"},
+    {file = "pydantic_core-2.33.2-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:9fcd347d2cc5c23b06de6d3b7b8275be558a0c90549495c699e379a80bf8379e"},
+    {file = "pydantic_core-2.33.2-cp39-cp39-win32.whl", hash = "sha256:83aa99b1285bc8f038941ddf598501a86f1536789740991d7d8756e34f1e74d9"},
+    {file = "pydantic_core-2.33.2-cp39-cp39-win_amd64.whl", hash = "sha256:f481959862f57f29601ccced557cc2e817bce7533ab8e01a797a48b49c9692b3"},
+    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-macosx_10_12_x86_64.whl", hash = "sha256:5c4aa4e82353f65e548c476b37e64189783aa5384903bfea4f41580f255fddfa"},
+    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:d946c8bf0d5c24bf4fe333af284c59a19358aa3ec18cb3dc4370080da1e8ad29"},
+    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:87b31b6846e361ef83fedb187bb5b4372d0da3f7e28d85415efa92d6125d6e6d"},
+    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:aa9d91b338f2df0508606f7009fde642391425189bba6d8c653afd80fd6bb64e"},
+    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:2058a32994f1fde4ca0480ab9d1e75a0e8c87c22b53a3ae66554f9af78f2fe8c"},
+    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-musllinux_1_1_aarch64.whl", hash = "sha256:0e03262ab796d986f978f79c943fc5f620381be7287148b8010b4097f79a39ec"},
+    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-musllinux_1_1_armv7l.whl", hash = "sha256:1a8695a8d00c73e50bff9dfda4d540b7dee29ff9b8053e38380426a85ef10052"},
+    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-musllinux_1_1_x86_64.whl", hash = "sha256:fa754d1850735a0b0e03bcffd9d4b4343eb417e47196e4485d9cca326073a42c"},
+    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:a11c8d26a50bfab49002947d3d237abe4d9e4b5bdc8846a63537b6488e197808"},
+    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-macosx_10_12_x86_64.whl", hash = "sha256:dd14041875d09cc0f9308e37a6f8b65f5585cf2598a53aa0123df8b129d481f8"},
+    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:d87c561733f66531dced0da6e864f44ebf89a8fba55f31407b00c2f7f9449593"},
+    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2f82865531efd18d6e07a04a17331af02cb7a651583c418df8266f17a63c6612"},
+    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2bfb5112df54209d820d7bf9317c7a6c9025ea52e49f46b6a2060104bba37de7"},
+    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:64632ff9d614e5eecfb495796ad51b0ed98c453e447a76bcbeeb69615079fc7e"},
+    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-musllinux_1_1_aarch64.whl", hash = "sha256:f889f7a40498cc077332c7ab6b4608d296d852182211787d4f3ee377aaae66e8"},
+    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-musllinux_1_1_armv7l.whl", hash = "sha256:de4b83bb311557e439b9e186f733f6c645b9417c84e2eb8203f3f820a4b988bf"},
+    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-musllinux_1_1_x86_64.whl", hash = "sha256:82f68293f055f51b51ea42fafc74b6aad03e70e191799430b90c13d643059ebb"},
+    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:329467cecfb529c925cf2bbd4d60d2c509bc2fb52a20c1045bf09bb70971a9c1"},
+    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-macosx_10_12_x86_64.whl", hash = "sha256:87acbfcf8e90ca885206e98359d7dca4bcbb35abdc0ff66672a293e1d7a19101"},
+    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-macosx_11_0_arm64.whl", hash = "sha256:7f92c15cd1e97d4b12acd1cc9004fa092578acfa57b67ad5e43a197175d01a64"},
+    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d3f26877a748dc4251cfcfda9dfb5f13fcb034f5308388066bcfe9031b63ae7d"},
+    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:dac89aea9af8cd672fa7b510e7b8c33b0bba9a43186680550ccf23020f32d535"},
+    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:970919794d126ba8645f3837ab6046fb4e72bbc057b3709144066204c19a455d"},
+    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-musllinux_1_1_aarch64.whl", hash = "sha256:3eb3fe62804e8f859c49ed20a8451342de53ed764150cb14ca71357c765dc2a6"},
+    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-musllinux_1_1_armv7l.whl", hash = "sha256:3abcd9392a36025e3bd55f9bd38d908bd17962cc49bc6da8e7e96285336e2bca"},
+    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-musllinux_1_1_x86_64.whl", hash = "sha256:3a1c81334778f9e3af2f8aeb7a960736e5cab1dfebfb26aabca09afd2906c039"},
+    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:2807668ba86cb38c6817ad9bc66215ab8584d1d304030ce4f0887336f28a5e27"},
+    {file = "pydantic_core-2.33.2.tar.gz", hash = "sha256:7cb8bc3605c29176e1b105350d2e6474142d7c1bd1d9327c4a9bdb46bf827acc"},
 ]
 
 [package.dependencies]
-typing-extensions = ">=4.14.1"
+typing-extensions = ">=4.6.0,<4.7.0 || >4.7.0"
 
 [[package]]
 name = "pydantic-settings"
@@ -13646,14 +13625,14 @@ files = [
 
 [[package]]
 name = "typing-inspection"
-version = "0.4.2"
+version = "0.4.1"
 description = "Runtime typing introspection tools"
 optional = false
 python-versions = ">=3.9"
 groups = ["main", "test"]
 files = [
-    {file = "typing_inspection-0.4.2-py3-none-any.whl", hash = "sha256:4ed1cacbdc298c220f1bd249ed5287caa16f34d44ef4e9c3d0cbad5b521545e7"},
-    {file = "typing_inspection-0.4.2.tar.gz", hash = "sha256:ba561c48a67c5958007083d386c3295464928b01faa735ab8547c5692e87f464"},
+    {file = "typing_inspection-0.4.1-py3-none-any.whl", hash = "sha256:389055682238f53b04f7badcb49b989835495a96700ced5dab2d8feae4b26f51"},
+    {file = "typing_inspection-0.4.1.tar.gz", hash = "sha256:6ae134cc0203c33377d43188d4064e9b357dba58cff3185f22924610e70a9d28"},
 ]
 
 [package.dependencies]

enterprise/saas_server.py

@@ -37,12 +37,6 @@ from server.routes.mcp_patch import patch_mcp_server  # noqa: E402
 from server.routes.oauth_device import oauth_device_router  # noqa: E402
 from server.routes.readiness import readiness_router  # noqa: E402
 from server.routes.user import saas_user_router  # noqa: E402
-from server.sharing.shared_conversation_router import (  # noqa: E402
-    router as shared_conversation_router,
-)
-from server.sharing.shared_event_router import (  # noqa: E402
-    router as shared_event_router,
-)
 
 from openhands.server.app import app as base_app  # noqa: E402
 from openhands.server.listen_socket import sio  # noqa: E402
@@ -72,8 +66,6 @@ base_app.include_router(saas_user_router)  # Add additional route SAAS user call
 base_app.include_router(
     billing_router
 )  # Add routes for credit management and Stripe payment integration
-base_app.include_router(shared_conversation_router)
-base_app.include_router(shared_event_router)
 
 # Add GitHub integration router only if GITHUB_APP_CLIENT_ID is set
 if GITHUB_APP_CLIENT_ID:
@@ -107,7 +99,6 @@ base_app.include_router(
     event_webhook_router
 )  # Add routes for Events in nested runtimes
 
-
 base_app.add_middleware(
     CORSMiddleware,
     allow_origins=PERMITTED_CORS_ORIGINS,

enterprise/server/auth/domain_blocker.py

@@ -1,67 +0,0 @@
-from storage.blocked_email_domain_store import BlockedEmailDomainStore
-from storage.database import session_maker
-
-from openhands.core.logger import openhands_logger as logger
-
-
-class DomainBlocker:
-    def __init__(self, store: BlockedEmailDomainStore) -> None:
-        logger.debug('Initializing DomainBlocker')
-        self.store = store
-
-    def _extract_domain(self, email: str) -> str | None:
-        """Extract and normalize email domain from email address"""
-        if not email:
-            return None
-        try:
-            # Extract domain part after @
-            if '@' not in email:
-                return None
-            domain = email.split('@')[1].strip().lower()
-            return domain if domain else None
-        except Exception:
-            logger.debug(f'Error extracting domain from email: {email}', exc_info=True)
-            return None
-
-    def is_domain_blocked(self, email: str) -> bool:
-        """Check if email domain is blocked by querying the database directly via SQL.
-
-        Supports blocking:
-        - Exact domains: 'example.com' blocks 'user@example.com'
-        - Subdomains: 'example.com' blocks 'user@subdomain.example.com'
-        - TLDs: '.us' blocks 'user@company.us' and 'user@subdomain.company.us'
-
-        The blocking logic is handled efficiently in SQL, avoiding the need to load
-        all blocked domains into memory.
-        """
-        if not email:
-            logger.debug('No email provided for domain check')
-            return False
-
-        domain = self._extract_domain(email)
-        if not domain:
-            logger.debug(f'Could not extract domain from email: {email}')
-            return False
-
-        try:
-            # Query database directly via SQL to check if domain is blocked
-            is_blocked = self.store.is_domain_blocked(domain)
-
-            if is_blocked:
-                logger.warning(f'Email domain {domain} is blocked for email: {email}')
-            else:
-                logger.debug(f'Email domain {domain} is not blocked')
-
-            return is_blocked
-        except Exception as e:
-            logger.error(
-                f'Error checking if domain is blocked for email {email}: {e}',
-                exc_info=True,
-            )
-            # Fail-safe: if database query fails, don't block (allow auth to proceed)
-            return False
-
-
-# Initialize store and domain blocker
-_store = BlockedEmailDomainStore(session_maker=session_maker)
-domain_blocker = DomainBlocker(store=_store)

enterprise/server/auth/email_validation.py

@@ -1,109 +0,0 @@
-"""Email validation utilities for preventing duplicate signups with + modifier."""
-
-import re
-
-
-def extract_base_email(email: str) -> str | None:
-    """Extract base email from an email address.
-
-    For emails with + modifier, extracts the base email (local part before + and @, plus domain).
-    For emails without + modifier, returns the email as-is.
-
-    Examples:
-        extract_base_email("joe+test@example.com") -> "joe@example.com"
-        extract_base_email("joe@example.com") -> "joe@example.com"
-        extract_base_email("joe+openhands+test@example.com") -> "joe@example.com"
-
-    Args:
-        email: The email address to process
-
-    Returns:
-        The base email address, or None if email format is invalid
-    """
-    if not email or '@' not in email:
-        return None
-
-    try:
-        local_part, domain = email.rsplit('@', 1)
-        # Extract the part before + if it exists
-        base_local = local_part.split('+', 1)[0]
-        return f'{base_local}@{domain}'
-    except (ValueError, AttributeError):
-        return None
-
-
-def has_plus_modifier(email: str) -> bool:
-    """Check if an email address contains a + modifier.
-
-    Args:
-        email: The email address to check
-
-    Returns:
-        True if email contains + before @, False otherwise
-    """
-    if not email or '@' not in email:
-        return False
-
-    try:
-        local_part, _ = email.rsplit('@', 1)
-        return '+' in local_part
-    except (ValueError, AttributeError):
-        return False
-
-
-def matches_base_email(email: str, base_email: str) -> bool:
-    """Check if an email matches a base email pattern.
-
-    An email matches if:
-    - It is exactly the base email (e.g., joe@example.com)
-    - It has the same base local part and domain, with or without + modifier
-      (e.g., joe+test@example.com matches base joe@example.com)
-
-    Args:
-        email: The email address to check
-        base_email: The base email to match against
-
-    Returns:
-        True if email matches the base pattern, False otherwise
-    """
-    if not email or not base_email:
-        return False
-
-    # Extract base from both emails for comparison
-    email_base = extract_base_email(email)
-    base_email_normalized = extract_base_email(base_email)
-
-    if not email_base or not base_email_normalized:
-        return False
-
-    # Emails match if they have the same base
-    return email_base.lower() == base_email_normalized.lower()
-
-
-def get_base_email_regex_pattern(base_email: str) -> re.Pattern | None:
-    """Generate a regex pattern to match emails with the same base.
-
-    For base_email "joe@example.com", the pattern will match:
-    - joe@example.com
-    - joe+anything@example.com
-
-    Args:
-        base_email: The base email address
-
-    Returns:
-        A compiled regex pattern, or None if base_email is invalid
-    """
-    base = extract_base_email(base_email)
-    if not base:
-        return None
-
-    try:
-        local_part, domain = base.rsplit('@', 1)
-        # Escape special regex characters in local part and domain
-        escaped_local = re.escape(local_part)
-        escaped_domain = re.escape(domain)
-        # Pattern: joe@example.com OR joe+anything@example.com
-        pattern = rf'^{escaped_local}(\+[^@\s]+)?@{escaped_domain}$'
-        return re.compile(pattern, re.IGNORECASE)
-    except (ValueError, AttributeError):
-        return None

enterprise/server/auth/saas_user_auth.py

@@ -13,7 +13,6 @@ from server.auth.auth_error import (
     ExpiredError,
     NoCredentialsError,
 )
-from server.auth.domain_blocker import domain_blocker
 from server.auth.token_manager import TokenManager
 from server.config import get_config
 from server.logger import logger
@@ -154,10 +153,8 @@ class SaasUserAuth(UserAuth):
         try:
             # TODO: I think we can do this in a single request if we refactor
             with session_maker() as session:
-                tokens = (
-                    session.query(AuthTokens)
-                    .where(AuthTokens.keycloak_user_id == self.user_id)
-                    .all()
+                tokens = session.query(AuthTokens).where(
+                    AuthTokens.keycloak_user_id == self.user_id
                 )
 
             for token in tokens:
@@ -315,16 +312,6 @@ async def saas_user_auth_from_signed_token(signed_token: str) -> SaasUserAuth:
     user_id = access_token_payload['sub']
     email = access_token_payload['email']
     email_verified = access_token_payload['email_verified']
-
-    # Check if email domain is blocked
-    if email and domain_blocker.is_domain_blocked(email):
-        logger.warning(
-            f'Blocked authentication attempt for existing user with email: {email}'
-        )
-        raise AuthError(
-            'Access denied: Your email domain is not allowed to access this service'
-        )
-
     logger.debug('saas_user_auth_from_signed_token:return')
 
     return SaasUserAuth(

enterprise/server/auth/token_manager.py

@@ -1,4 +1,3 @@
-import asyncio
 import base64
 import hashlib
 import json
@@ -14,7 +13,6 @@ from keycloak.exceptions import (
     KeycloakAuthenticationError,
     KeycloakConnectionError,
     KeycloakError,
-    KeycloakPostError,
 )
 from server.auth.constants import (
     BITBUCKET_APP_CLIENT_ID,
@@ -27,11 +25,6 @@ from server.auth.constants import (
     KEYCLOAK_SERVER_URL,
     KEYCLOAK_SERVER_URL_EXT,
 )
-from server.auth.email_validation import (
-    extract_base_email,
-    get_base_email_regex_pattern,
-    matches_base_email,
-)
 from server.auth.keycloak_manager import get_keycloak_admin, get_keycloak_openid
 from server.config import get_config
 from server.logger import logger
@@ -44,7 +37,6 @@ from storage.offline_token_store import OfflineTokenStore
 from tenacity import RetryCallState, retry, retry_if_exception_type, stop_after_attempt
 
 from openhands.integrations.service_types import ProviderType
-from openhands.server.types import SessionExpiredError
 from openhands.utils.http_session import httpx_verify_option
 
 
@@ -467,14 +459,6 @@ class TokenManager:
         except KeycloakConnectionError:
             logger.exception('KeycloakConnectionError when refreshing token')
             raise
-        except KeycloakPostError as e:
-            error_message = str(e)
-            if 'invalid_grant' in error_message or 'session not found' in error_message:
-                logger.warning(f'User session expired or invalid: {error_message}')
-                raise SessionExpiredError(
-                    'Your session has expired. Please login again.'
-                ) from e
-            raise
 
     @retry(
         stop=stop_after_attempt(2),
@@ -525,183 +509,6 @@ class TokenManager:
         logger.info(f'Got user ID {keycloak_user_id} from email: {email}')
         return keycloak_user_id
 
-    async def _query_users_by_wildcard_pattern(
-        self, local_part: str, domain: str
-    ) -> dict[str, dict]:
-        """Query Keycloak for users matching a wildcard email pattern.
-
-        Tries multiple query methods to find users with emails matching
-        the pattern {local_part}*@{domain}. This catches the base email
-        and all + modifier variants.
-
-        Args:
-            local_part: The local part of the email (before @)
-            domain: The domain part of the email (after @)
-
-        Returns:
-            Dictionary mapping user IDs to user objects
-        """
-        keycloak_admin = get_keycloak_admin(self.external)
-        all_users = {}
-
-        # Query for users with emails matching the base pattern using wildcard
-        # Pattern: {local_part}*@{domain} - catches base email and all + variants
-        # This may also catch unintended matches (e.g., joesmith@example.com), but
-        # they will be filtered out by the regex pattern check later
-        # Use 'search' parameter for Keycloak 26+ (better wildcard support)
-        wildcard_queries = [
-            {'search': f'{local_part}*@{domain}'},  # Try 'search' parameter first
-            {'q': f'email:{local_part}*@{domain}'},  # Fallback to 'q' parameter
-        ]
-
-        for query_params in wildcard_queries:
-            try:
-                users = await keycloak_admin.a_get_users(query_params)
-                for user in users:
-                    all_users[user.get('id')] = user
-                break  # Success, no need to try fallback
-            except Exception as e:
-                logger.debug(
-                    f'Wildcard query failed with {list(query_params.keys())[0]}: {e}'
-                )
-                continue  # Try next query method
-
-        return all_users
-
-    def _find_duplicate_in_users(
-        self, users: dict[str, dict], base_email: str, current_user_id: str
-    ) -> bool:
-        """Check if any user in the provided list matches the base email pattern.
-
-        Filters users to find duplicates that match the base email pattern,
-        excluding the current user.
-
-        Args:
-            users: Dictionary mapping user IDs to user objects
-            base_email: The base email to match against
-            current_user_id: The user ID to exclude from the check
-
-        Returns:
-            True if a duplicate is found, False otherwise
-        """
-        regex_pattern = get_base_email_regex_pattern(base_email)
-        if not regex_pattern:
-            logger.warning(
-                f'Could not generate regex pattern for base email: {base_email}'
-            )
-            # Fallback to simple matching
-            for user in users.values():
-                user_email = user.get('email', '').lower()
-                if (
-                    user_email
-                    and user.get('id') != current_user_id
-                    and matches_base_email(user_email, base_email)
-                ):
-                    logger.info(
-                        f'Found duplicate email: {user_email} matches base {base_email}'
-                    )
-                    return True
-        else:
-            for user in users.values():
-                user_email = user.get('email', '')
-                if (
-                    user_email
-                    and user.get('id') != current_user_id
-                    and regex_pattern.match(user_email)
-                ):
-                    logger.info(
-                        f'Found duplicate email: {user_email} matches base {base_email}'
-                    )
-                    return True
-
-        return False
-
-    @retry(
-        stop=stop_after_attempt(2),
-        retry=retry_if_exception_type(KeycloakConnectionError),
-        before_sleep=_before_sleep_callback,
-    )
-    async def check_duplicate_base_email(
-        self, email: str, current_user_id: str
-    ) -> bool:
-        """Check if a user with the same base email already exists.
-
-        This method checks for duplicate signups using email + modifier.
-        It checks if any user exists with the same base email, regardless of whether
-        the provided email has a + modifier or not.
-
-        Examples:
-            - If email is "joe+test@example.com", it checks for existing users with
-              base email "joe@example.com" (e.g., "joe@example.com", "joe+1@example.com")
-            - If email is "joe@example.com", it checks for existing users with
-              base email "joe@example.com" (e.g., "joe+1@example.com", "joe+test@example.com")
-
-        Args:
-            email: The email address to check (may or may not contain + modifier)
-            current_user_id: The user ID of the current user (to exclude from check)
-
-        Returns:
-            True if a duplicate is found (excluding current user), False otherwise
-        """
-        if not email:
-            return False
-
-        base_email = extract_base_email(email)
-        if not base_email:
-            logger.warning(f'Could not extract base email from: {email}')
-            return False
-
-        try:
-            local_part, domain = base_email.rsplit('@', 1)
-            users = await self._query_users_by_wildcard_pattern(local_part, domain)
-            return self._find_duplicate_in_users(users, base_email, current_user_id)
-
-        except KeycloakConnectionError:
-            logger.exception('KeycloakConnectionError when checking duplicate email')
-            raise
-        except Exception as e:
-            logger.exception(f'Unexpected error checking duplicate email: {e}')
-            # On any error, allow signup to proceed (fail open)
-            return False
-
-    @retry(
-        stop=stop_after_attempt(2),
-        retry=retry_if_exception_type(KeycloakConnectionError),
-        before_sleep=_before_sleep_callback,
-    )
-    async def delete_keycloak_user(self, user_id: str) -> bool:
-        """Delete a user from Keycloak.
-
-        This method is used to clean up user accounts that were created
-        but should not exist (e.g., duplicate email signups).
-
-        Args:
-            user_id: The Keycloak user ID to delete
-
-        Returns:
-            True if deletion was successful, False otherwise
-        """
-        try:
-            keycloak_admin = get_keycloak_admin(self.external)
-            # Use the sync method (python-keycloak doesn't have async delete_user)
-            # Run it in a thread executor to avoid blocking the event loop
-            await asyncio.to_thread(keycloak_admin.delete_user, user_id)
-            logger.info(f'Successfully deleted Keycloak user {user_id}')
-            return True
-        except KeycloakConnectionError:
-            logger.exception(f'KeycloakConnectionError when deleting user {user_id}')
-            raise
-        except KeycloakError as e:
-            # User might not exist or already deleted
-            logger.warning(
-                f'KeycloakError when deleting user {user_id}: {e}',
-                extra={'user_id': user_id, 'error': str(e)},
-            )
-            return False
-        except Exception as e:
-            logger.exception(f'Unexpected error deleting Keycloak user {user_id}: {e}')
-            return False
-
     async def get_user_info_from_user_id(self, user_id: str) -> dict | None:
         keycloak_admin = get_keycloak_admin(self.external)
         user = await keycloak_admin.a_get_user(user_id)
@@ -720,49 +527,6 @@ class TokenManager:
         github_id = github_ids[0]
         return github_id
 
-    async def disable_keycloak_user(
-        self, user_id: str, email: str | None = None
-    ) -> None:
-        """Disable a Keycloak user account.
-
-        Args:
-            user_id: The Keycloak user ID to disable
-            email: Optional email address for logging purposes
-
-        This method attempts to disable the user account but will not raise exceptions.
-        Errors are logged but do not prevent the operation from completing.
-        """
-        try:
-            keycloak_admin = get_keycloak_admin(self.external)
-            # Get current user to preserve other fields
-            user = await keycloak_admin.a_get_user(user_id)
-            if user:
-                # Update user with enabled=False to disable the account
-                await keycloak_admin.a_update_user(
-                    user_id=user_id,
-                    payload={
-                        'enabled': False,
-                        'username': user.get('username', ''),
-                        'email': user.get('email', ''),
-                        'emailVerified': user.get('emailVerified', False),
-                    },
-                )
-                email_str = f', email: {email}' if email else ''
-                logger.info(
-                    f'Disabled Keycloak account for user_id: {user_id}{email_str}'
-                )
-            else:
-                logger.warning(
-                    f'User not found in Keycloak when attempting to disable: {user_id}'
-                )
-        except Exception as e:
-            # Log error but don't raise - the caller should handle the blocking regardless
-            email_str = f', email: {email}' if email else ''
-            logger.error(
-                f'Failed to disable Keycloak account for user_id: {user_id}{email_str}: {str(e)}',
-                exc_info=True,
-            )
-
     def store_org_token(self, installation_id: int, installation_token: str):
         """Store a GitHub App installation token.
 

enterprise/server/clustered_conversation_manager.py

@@ -8,8 +8,8 @@ import socketio
 from server.logger import logger
 from server.utils.conversation_callback_utils import invoke_conversation_callbacks
 from storage.database import session_maker
+from storage.minimal_conversation_metadata import StoredConversationMetadata
 from storage.saas_settings_store import SaasSettingsStore
-from storage.stored_conversation_metadata import StoredConversationMetadata
 
 from openhands.core.config import LLMConfig
 from openhands.core.config.openhands_config import OpenHandsConfig

enterprise/server/constants.py

@@ -25,7 +25,6 @@ USER_SETTINGS_VERSION_TO_MODEL = {
     2: 'claude-3-7-sonnet-20250219',
     3: 'claude-sonnet-4-20250514',
     4: 'claude-sonnet-4-20250514',
-    5: 'claude-opus-4-5-20251101',
 }
 
 LITELLM_DEFAULT_MODEL = os.getenv('LITELLM_DEFAULT_MODEL')
@@ -38,8 +37,6 @@ LITE_LLM_API_URL = os.environ.get(
 )
 LITE_LLM_TEAM_ID = os.environ.get('LITE_LLM_TEAM_ID', None)
 LITE_LLM_API_KEY = os.environ.get('LITE_LLM_API_KEY', None)
-# Timeout in seconds for BYOR key verification requests to LiteLLM
-BYOR_KEY_VERIFICATION_TIMEOUT = 5.0
 SUBSCRIPTION_PRICE_DATA = {
     'MONTHLY_SUBSCRIPTION': {
         'unit_amount': 2000,

enterprise/server/middleware.py

@@ -159,7 +159,6 @@ class SetAuthCookieMiddleware:
             '/api/billing/cancel',
             '/api/billing/customer-setup-success',
             '/api/billing/stripe-webhook',
-            '/api/email/resend',
             '/oauth/device/authorize',
             '/oauth/device/token',
         )

enterprise/server/routes/api_keys.py

@@ -4,11 +4,7 @@ import httpx
 from fastapi import APIRouter, Depends, HTTPException, status
 from pydantic import BaseModel, field_validator
 from server.config import get_config
-from server.constants import (
-    BYOR_KEY_VERIFICATION_TIMEOUT,
-    LITE_LLM_API_KEY,
-    LITE_LLM_API_URL,
-)
+from server.constants import LITE_LLM_API_KEY, LITE_LLM_API_URL
 from storage.api_key_store import ApiKeyStore
 from storage.database import session_maker
 from storage.saas_settings_store import SaasSettingsStore
@@ -116,70 +112,6 @@ async def generate_byor_key(user_id: str) -> str | None:
         return None
 
 
-async def verify_byor_key_in_litellm(byor_key: str, user_id: str) -> bool:
-    """Verify that a BYOR key is valid in LiteLLM by making a lightweight API call.
-
-    Args:
-        byor_key: The BYOR key to verify
-        user_id: The user ID for logging purposes
-
-    Returns:
-        True if the key is verified as valid, False if verification fails or key is invalid.
-        Returns False on network errors/timeouts to ensure we don't return potentially invalid keys.
-    """
-    if not (LITE_LLM_API_URL and byor_key):
-        return False
-
-    try:
-        async with httpx.AsyncClient(
-            verify=httpx_verify_option(),
-            timeout=BYOR_KEY_VERIFICATION_TIMEOUT,
-        ) as client:
-            # Make a lightweight request to verify the key
-            # Using /v1/models endpoint as it's lightweight and requires authentication
-            response = await client.get(
-                f'{LITE_LLM_API_URL}/v1/models',
-                headers={
-                    'Authorization': f'Bearer {byor_key}',
-                },
-            )
-
-            # Only 200 status code indicates valid key
-            if response.status_code == 200:
-                logger.debug(
-                    'BYOR key verification successful',
-                    extra={'user_id': user_id},
-                )
-                return True
-
-            # All other status codes (401, 403, 500, etc.) are treated as invalid
-            # This includes authentication errors and server errors
-            logger.warning(
-                'BYOR key verification failed - treating as invalid',
-                extra={
-                    'user_id': user_id,
-                    'status_code': response.status_code,
-                    'key_prefix': byor_key[:10] + '...'
-                    if len(byor_key) > 10
-                    else byor_key,
-                },
-            )
-            return False
-
-    except (httpx.TimeoutException, Exception) as e:
-        # Any exception (timeout, network error, etc.) means we can't verify
-        # Return False to trigger regeneration rather than returning potentially invalid key
-        logger.warning(
-            'BYOR key verification error - treating as invalid to ensure key validity',
-            extra={
-                'user_id': user_id,
-                'error': str(e),
-                'error_type': type(e).__name__,
-            },
-        )
-        return False
-
-
 async def delete_byor_key_from_litellm(user_id: str, byor_key: str) -> bool:
     """Delete the BYOR key from LiteLLM using the key directly."""
     if not (LITE_LLM_API_KEY and LITE_LLM_API_URL):
@@ -346,44 +278,18 @@ async def delete_api_key(key_id: int, user_id: str = Depends(get_user_id)):
 
 @api_router.get('/llm/byor', response_model=LlmApiKeyResponse)
 async def get_llm_api_key_for_byor(user_id: str = Depends(get_user_id)):
-    """Get the LLM API key for BYOR (Bring Your Own Runtime) for the authenticated user.
-
-    This endpoint validates that the key exists in LiteLLM before returning it.
-    If validation fails, it automatically generates a new key to ensure users
-    always receive a working key.
-    """
+    """Get the LLM API key for BYOR (Bring Your Own Runtime) for the authenticated user."""
     try:
         # Check if the BYOR key exists in the database
         byor_key = await get_byor_key_from_db(user_id)
         if byor_key:
-            # Validate that the key is actually registered in LiteLLM
-            is_valid = await verify_byor_key_in_litellm(byor_key, user_id)
-            if is_valid:
-                return {'key': byor_key}
-            else:
-                # Key exists in DB but is invalid in LiteLLM - regenerate it
-                logger.warning(
-                    'BYOR key found in database but invalid in LiteLLM - regenerating',
-                    extra={
-                        'user_id': user_id,
-                        'key_prefix': byor_key[:10] + '...'
-                        if len(byor_key) > 10
-                        else byor_key,
-                    },
-                )
-                # Delete the invalid key from LiteLLM (best effort, don't fail if it doesn't exist)
-                await delete_byor_key_from_litellm(user_id, byor_key)
-                # Fall through to generate a new key
+            return {'key': byor_key}
 
-        # Generate a new key for BYOR (either no key exists or validation failed)
+        # If not, generate a new key for BYOR
         key = await generate_byor_key(user_id)
         if key:
             # Store the key in the database
             await store_byor_key_in_db(user_id, key)
-            logger.info(
-                'Successfully generated and stored new BYOR key',
-                extra={'user_id': user_id},
-            )
             return {'key': key}
         else:
             logger.error(
@@ -395,9 +301,6 @@ async def get_llm_api_key_for_byor(user_id: str = Depends(get_user_id)):
                 detail='Failed to generate new BYOR LLM API key',
             )
 
-    except HTTPException:
-        # Re-raise HTTP exceptions as-is
-        raise
     except Exception as e:
         logger.exception('Error retrieving BYOR LLM API key', extra={'error': str(e)})
         raise HTTPException(

enterprise/server/routes/auth.py

@@ -14,7 +14,6 @@ from server.auth.constants import (
     KEYCLOAK_SERVER_URL_EXT,
     ROLE_CHECK_ENABLED,
 )
-from server.auth.domain_blocker import domain_blocker
 from server.auth.gitlab_sync import schedule_gitlab_repo_sync
 from server.auth.saas_user_auth import SaasUserAuth
 from server.auth.token_manager import TokenManager
@@ -146,76 +145,7 @@ async def keycloak_callback(
             content={'error': 'Missing user ID or username in response'},
         )
 
-    email = user_info.get('email')
     user_id = user_info['sub']
-
-    # Check if email domain is blocked
-    email = user_info.get('email')
-    if email and domain_blocker.is_domain_blocked(email):
-        logger.warning(
-            f'Blocked authentication attempt for email: {email}, user_id: {user_id}'
-        )
-
-        # Disable the Keycloak account
-        await token_manager.disable_keycloak_user(user_id, email)
-
-        return JSONResponse(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            content={
-                'error': 'Access denied: Your email domain is not allowed to access this service'
-            },
-        )
-
-    # Check for duplicate email with + modifier
-    if email:
-        try:
-            has_duplicate = await token_manager.check_duplicate_base_email(
-                email, user_id
-            )
-            if has_duplicate:
-                logger.warning(
-                    f'Blocked signup attempt for email {email} - duplicate base email found',
-                    extra={'user_id': user_id, 'email': email},
-                )
-
-                # Delete the Keycloak user that was automatically created during OAuth
-                # This prevents orphaned accounts in Keycloak
-                # The delete_keycloak_user method already handles all errors internally
-                deletion_success = await token_manager.delete_keycloak_user(user_id)
-                if deletion_success:
-                    logger.info(
-                        f'Deleted Keycloak user {user_id} after detecting duplicate email {email}'
-                    )
-                else:
-                    logger.warning(
-                        f'Failed to delete Keycloak user {user_id} after detecting duplicate email {email}. '
-                        f'User may need to be manually cleaned up.'
-                    )
-
-                # Redirect to home page with query parameter indicating the issue
-                home_url = f'{request.base_url}?duplicated_email=true'
-                return RedirectResponse(home_url, status_code=302)
-        except Exception as e:
-            # Log error but allow signup to proceed (fail open)
-            logger.error(
-                f'Error checking duplicate email for {email}: {e}',
-                extra={'user_id': user_id, 'email': email},
-            )
-
-    # Check email verification status
-    email_verified = user_info.get('email_verified', False)
-    if not email_verified:
-        # Send verification email
-        # Import locally to avoid circular import with email.py
-        from server.routes.email import verify_email
-
-        await verify_email(request=request, user_id=user_id, is_auth_flow=True)
-        redirect_url = (
-            f'{request.base_url}?email_verification_required=true&user_id={user_id}'
-        )
-        response = RedirectResponse(redirect_url, status_code=302)
-        return response
-
     # default to github IDP for now.
     # TODO: remove default once Keycloak is updated universally with the new attribute.
     idp: str = user_info.get('identity_provider', ProviderType.GITHUB.value)

enterprise/server/routes/billing.py

@@ -111,24 +111,10 @@ def calculate_credits(user_info: LiteLlmUserInfo) -> float:
 async def get_credits(user_id: str = Depends(get_user_id)) -> GetCreditsResponse:
     if not stripe_service.STRIPE_API_KEY:
         return GetCreditsResponse()
-    try:
-        async with httpx.AsyncClient(verify=httpx_verify_option()) as client:
-            user_json = await _get_litellm_user(client, user_id)
-            credits = calculate_credits(user_json['user_info'])
-        return GetCreditsResponse(credits=Decimal('{:.2f}'.format(credits)))
-    except httpx.HTTPStatusError as e:
-        logger.error(
-            f'litellm_get_user_failed: {type(e).__name__}: {e}',
-            extra={
-                'user_id': user_id,
-                'status_code': e.response.status_code,
-            },
-            exc_info=True,
-        )
-        raise HTTPException(
-            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail='Failed to retrieve credit balance from billing service',
-        )
+    async with httpx.AsyncClient(verify=httpx_verify_option()) as client:
+        user_json = await _get_litellm_user(client, user_id)
+        credits = calculate_credits(user_json['user_info'])
+    return GetCreditsResponse(credits=Decimal('{:.2f}'.format(credits)))
 
 
 # Endpoint to retrieve user's current subscription access

enterprise/server/routes/email.py

@@ -7,7 +7,6 @@ from server.auth.constants import KEYCLOAK_CLIENT_ID
 from server.auth.keycloak_manager import get_keycloak_admin
 from server.auth.saas_user_auth import SaasUserAuth
 from server.routes.auth import set_response_cookie
-from server.utils.rate_limit_utils import check_rate_limit_by_user_id
 
 from openhands.core.logger import openhands_logger as logger
 from openhands.server.user_auth import get_user_id
@@ -29,11 +28,6 @@ class EmailUpdate(BaseModel):
         return v
 
 
-class ResendEmailVerificationRequest(BaseModel):
-    user_id: str | None = None
-    is_auth_flow: bool = False
-
-
 @api_router.post('')
 async def update_email(
     email_data: EmailUpdate, request: Request, user_id: str = Depends(get_user_id)
@@ -80,7 +74,7 @@ async def update_email(
             accepted_tos=user_auth.accepted_tos,
         )
 
-        await verify_email(request=request, user_id=user_id)
+        await _verify_email(request=request, user_id=user_id)
 
         logger.info(f'Updating email address for {user_id} to {email}')
         return response
@@ -96,41 +90,9 @@ async def update_email(
         )
 
 
-@api_router.put('/resend')
-async def resend_email_verification(
-    request: Request,
-    body: ResendEmailVerificationRequest | None = None,
-):
-    # Get user_id from body if provided, otherwise from auth
-    user_id: str | None = None
-    if body and body.user_id:
-        user_id = body.user_id
-    else:
-        try:
-            user_id = await get_user_id(request)
-        except Exception:
-            pass
-
-    if not user_id:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail='user_id is required in request body or user must be authenticated',
-        )
-
-    # Check rate limit (uses user_id if available, otherwise falls back to IP)
-    # Use 30 seconds for user-based rate limiting to match frontend cooldown
-    await check_rate_limit_by_user_id(
-        request=request,
-        key_prefix='email_resend',
-        user_id=user_id,
-        user_rate_limit_seconds=30,
-        ip_rate_limit_seconds=60,  # 1 minute for IP-based limiting (more lenient)
-    )
-
-    # Get is_auth_flow from body if provided, default to False
-    is_auth_flow = body.is_auth_flow if body else False
-
-    await verify_email(request=request, user_id=user_id, is_auth_flow=is_auth_flow)
+@api_router.put('/verify')
+async def verify_email(request: Request, user_id: str = Depends(get_user_id)):
+    await _verify_email(request=request, user_id=user_id)
 
     logger.info(f'Resending verification email for {user_id}')
     return JSONResponse(
@@ -162,13 +124,10 @@ async def verified_email(request: Request):
     return response
 
 
-async def verify_email(request: Request, user_id: str, is_auth_flow: bool = False):
+async def _verify_email(request: Request, user_id: str):
     keycloak_admin = get_keycloak_admin()
     scheme = 'http' if request.url.hostname == 'localhost' else 'https'
-    if is_auth_flow:
-        redirect_uri = f'{scheme}://{request.url.netloc}?email_verified=true'
-    else:
-        redirect_uri = f'{scheme}://{request.url.netloc}/api/email/verified'
+    redirect_uri = f'{scheme}://{request.url.netloc}/api/email/verified'
     logger.info(f'Redirect URI: {redirect_uri}')
     await keycloak_admin.a_send_verify_email(
         user_id=user_id,

enterprise/server/routes/event_webhook.py

@@ -21,7 +21,7 @@ from server.utils.conversation_callback_utils import (
     update_conversation_stats,
 )
 from storage.database import session_maker
-from storage.stored_conversation_metadata import StoredConversationMetadata
+from storage.minimal_conversation_metadata import StoredConversationMetadata
 
 from openhands.server.shared import conversation_manager
 
@@ -134,12 +134,12 @@ async def _process_batch_operations_background(
             )
         except Exception as e:
             logger.error(
-                f'error_processing_batch_operation: {type(e).__name__}: {e}',
+                'error_processing_batch_operation',
                 extra={
                     'path': batch_op.path,
                     'method': str(batch_op.method),
+                    'error': str(e),
                 },
-                exc_info=True,
             )
 
 

enterprise/server/routes/feedback.py

@@ -5,7 +5,7 @@ from pydantic import BaseModel, Field
 from sqlalchemy.future import select
 from storage.database import session_maker
 from storage.feedback import ConversationFeedback
-from storage.stored_conversation_metadata import StoredConversationMetadata
+from storage.minimal_conversation_metadata import StoredConversationMetadata
 
 from openhands.events.event_store import EventStore
 from openhands.server.shared import file_store

enterprise/server/routes/integration/gitlab.py

@@ -1,28 +1,15 @@
-import asyncio
 import hashlib
 import json
 
-from fastapi import APIRouter, Depends, Header, HTTPException, Request, status
+from fastapi import APIRouter, Header, HTTPException, Request
 from fastapi.responses import JSONResponse
 from integrations.gitlab.gitlab_manager import GitlabManager
-from integrations.gitlab.gitlab_service import SaaSGitLabService
-from integrations.gitlab.webhook_installation import (
-    BreakLoopException,
-    install_webhook_on_resource,
-    verify_webhook_conditions,
-)
 from integrations.models import Message, SourceType
-from integrations.types import GitLabResourceType
-from integrations.utils import GITLAB_WEBHOOK_URL
-from pydantic import BaseModel
 from server.auth.token_manager import TokenManager
-from storage.gitlab_webhook import GitlabWebhook
 from storage.gitlab_webhook_store import GitlabWebhookStore
 
 from openhands.core.logger import openhands_logger as logger
-from openhands.integrations.gitlab.gitlab_service import GitLabServiceImpl
 from openhands.server.shared import sio
-from openhands.server.user_auth import get_user_id
 
 gitlab_integration_router = APIRouter(prefix='/integration')
 webhook_store = GitlabWebhookStore()
@@ -31,37 +18,6 @@ token_manager = TokenManager()
 gitlab_manager = GitlabManager(token_manager)
 
 
-# Request/Response models
-class ResourceIdentifier(BaseModel):
-    type: GitLabResourceType
-    id: str
-
-
-class ReinstallWebhookRequest(BaseModel):
-    resource: ResourceIdentifier
-
-
-class ResourceWithWebhookStatus(BaseModel):
-    id: str
-    name: str
-    full_path: str
-    type: str
-    webhook_installed: bool
-    webhook_uuid: str | None
-    last_synced: str | None
-
-
-class GitLabResourcesResponse(BaseModel):
-    resources: list[ResourceWithWebhookStatus]
-
-
-class ResourceInstallationResult(BaseModel):
-    resource_id: str
-    resource_type: str
-    success: bool
-    error: str | None
-
-
 async def verify_gitlab_signature(
     header_webhook_secret: str, webhook_uuid: str, user_id: str
 ):
@@ -127,260 +83,3 @@ async def gitlab_events(
     except Exception as e:
         logger.exception(f'Error processing GitLab event: {e}')
         return JSONResponse(status_code=400, content={'error': 'Invalid payload.'})
-
-
-@gitlab_integration_router.get('/gitlab/resources')
-async def get_gitlab_resources(
-    user_id: str = Depends(get_user_id),
-) -> GitLabResourcesResponse:
-    """Get all GitLab projects and groups where the user has admin access.
-
-    Returns a list of resources with their webhook installation status.
-    """
-    try:
-        # Get GitLab service for the user
-        gitlab_service = GitLabServiceImpl(external_auth_id=user_id)
-
-        if not isinstance(gitlab_service, SaaSGitLabService):
-            raise HTTPException(
-                status_code=status.HTTP_400_BAD_REQUEST,
-                detail='Only SaaS GitLab service is supported',
-            )
-
-        # Fetch projects and groups with admin access
-        projects, groups = await gitlab_service.get_user_resources_with_admin_access()
-
-        # Filter out projects that belong to a group (nested projects)
-        # We only want top-level personal projects since group webhooks cover nested projects
-        filtered_projects = [
-            project
-            for project in projects
-            if project.get('namespace', {}).get('kind') != 'group'
-        ]
-
-        # Extract IDs for bulk fetching
-        project_ids = [str(project['id']) for project in filtered_projects]
-        group_ids = [str(group['id']) for group in groups]
-
-        # Bulk fetch webhook records from database (organization-wide)
-        (
-            project_webhook_map,
-            group_webhook_map,
-        ) = await webhook_store.get_webhooks_by_resources(project_ids, group_ids)
-
-        # Parallelize GitLab API calls to check webhook status for all resources
-        async def check_project_webhook(project):
-            project_id = str(project['id'])
-            webhook_exists, _ = await gitlab_service.check_webhook_exists_on_resource(
-                GitLabResourceType.PROJECT, project_id, GITLAB_WEBHOOK_URL
-            )
-            return project_id, webhook_exists
-
-        async def check_group_webhook(group):
-            group_id = str(group['id'])
-            webhook_exists, _ = await gitlab_service.check_webhook_exists_on_resource(
-                GitLabResourceType.GROUP, group_id, GITLAB_WEBHOOK_URL
-            )
-            return group_id, webhook_exists
-
-        # Gather all API calls in parallel
-        project_checks = [
-            check_project_webhook(project) for project in filtered_projects
-        ]
-        group_checks = [check_group_webhook(group) for group in groups]
-
-        # Execute all checks concurrently
-        all_results = await asyncio.gather(*(project_checks + group_checks))
-
-        # Split results back into projects and groups
-        num_projects = len(filtered_projects)
-        project_results = all_results[:num_projects]
-        group_results = all_results[num_projects:]
-
-        # Build response
-        resources = []
-
-        # Add projects with their webhook status
-        for project, (project_id, webhook_exists) in zip(
-            filtered_projects, project_results
-        ):
-            webhook = project_webhook_map.get(project_id)
-
-            resources.append(
-                ResourceWithWebhookStatus(
-                    id=project_id,
-                    name=project.get('name', ''),
-                    full_path=project.get('path_with_namespace', ''),
-                    type='project',
-                    webhook_installed=webhook_exists,
-                    webhook_uuid=webhook.webhook_uuid if webhook else None,
-                    last_synced=(
-                        webhook.last_synced.isoformat()
-                        if webhook and webhook.last_synced
-                        else None
-                    ),
-                )
-            )
-
-        # Add groups with their webhook status
-        for group, (group_id, webhook_exists) in zip(groups, group_results):
-            webhook = group_webhook_map.get(group_id)
-
-            resources.append(
-                ResourceWithWebhookStatus(
-                    id=group_id,
-                    name=group.get('name', ''),
-                    full_path=group.get('full_path', ''),
-                    type='group',
-                    webhook_installed=webhook_exists,
-                    webhook_uuid=webhook.webhook_uuid if webhook else None,
-                    last_synced=(
-                        webhook.last_synced.isoformat()
-                        if webhook and webhook.last_synced
-                        else None
-                    ),
-                )
-            )
-
-        logger.info(
-            'Retrieved GitLab resources',
-            extra={
-                'user_id': user_id,
-                'project_count': len(projects),
-                'group_count': len(groups),
-            },
-        )
-
-        return GitLabResourcesResponse(resources=resources)
-
-    except HTTPException:
-        raise
-    except Exception as e:
-        logger.exception(f'Error retrieving GitLab resources: {e}')
-        raise HTTPException(
-            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail='Failed to retrieve GitLab resources',
-        )
-
-
-@gitlab_integration_router.post('/gitlab/reinstall-webhook')
-async def reinstall_gitlab_webhook(
-    body: ReinstallWebhookRequest,
-    user_id: str = Depends(get_user_id),
-) -> ResourceInstallationResult:
-    """Reinstall GitLab webhook for a specific resource immediately.
-
-    This endpoint validates permissions, resets webhook status in the database,
-    and immediately installs the webhook on the specified resource.
-    """
-    try:
-        # Get GitLab service for the user
-        gitlab_service = GitLabServiceImpl(external_auth_id=user_id)
-
-        if not isinstance(gitlab_service, SaaSGitLabService):
-            raise HTTPException(
-                status_code=status.HTTP_400_BAD_REQUEST,
-                detail='Only SaaS GitLab service is supported',
-            )
-
-        resource_id = body.resource.id
-        resource_type = body.resource.type
-
-        # Check if user has admin access to this resource
-        (
-            has_admin_access,
-            check_status,
-        ) = await gitlab_service.check_user_has_admin_access_to_resource(
-            resource_type, resource_id
-        )
-
-        if not has_admin_access:
-            raise HTTPException(
-                status_code=status.HTTP_403_FORBIDDEN,
-                detail='User does not have admin access to this resource',
-            )
-
-        # Reset webhook in database (organization-wide, not user-specific)
-        # This allows any admin user to reinstall webhooks
-        await webhook_store.reset_webhook_for_reinstallation_by_resource(
-            resource_type, resource_id, user_id
-        )
-
-        # Get or create webhook record (without user_id filter)
-        webhook = await webhook_store.get_webhook_by_resource_only(
-            resource_type, resource_id
-        )
-
-        if not webhook:
-            # Create new webhook record
-            webhook = GitlabWebhook(
-                user_id=user_id,  # Track who created it
-                project_id=resource_id
-                if resource_type == GitLabResourceType.PROJECT
-                else None,
-                group_id=resource_id
-                if resource_type == GitLabResourceType.GROUP
-                else None,
-                webhook_exists=False,
-            )
-            await webhook_store.store_webhooks([webhook])
-            # Fetch it again to get the ID (without user_id filter)
-            webhook = await webhook_store.get_webhook_by_resource_only(
-                resource_type, resource_id
-            )
-
-        # Verify conditions and install webhook
-        try:
-            await verify_webhook_conditions(
-                gitlab_service=gitlab_service,
-                resource_type=resource_type,
-                resource_id=resource_id,
-                webhook_store=webhook_store,
-                webhook=webhook,
-            )
-
-            # Install the webhook
-            webhook_id, install_status = await install_webhook_on_resource(
-                gitlab_service=gitlab_service,
-                resource_type=resource_type,
-                resource_id=resource_id,
-                webhook_store=webhook_store,
-                webhook=webhook,
-            )
-
-            if webhook_id:
-                logger.info(
-                    'GitLab webhook reinstalled successfully',
-                    extra={
-                        'user_id': user_id,
-                        'resource_type': resource_type.value,
-                        'resource_id': resource_id,
-                    },
-                )
-                return ResourceInstallationResult(
-                    resource_id=resource_id,
-                    resource_type=resource_type.value,
-                    success=True,
-                    error=None,
-                )
-            else:
-                raise HTTPException(
-                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-                    detail='Failed to install webhook',
-                )
-
-        except BreakLoopException:
-            # Conditions not met or webhook already exists
-            raise HTTPException(
-                status_code=status.HTTP_400_BAD_REQUEST,
-                detail='Webhook installation conditions not met or webhook already exists',
-            )
-
-    except HTTPException:
-        raise
-    except Exception as e:
-        logger.exception(f'Error reinstalling GitLab webhook: {e}')
-        raise HTTPException(
-            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail='Failed to reinstall webhook',
-        )

enterprise/server/saas_nested_conversation_manager.py

@@ -12,8 +12,6 @@ from typing import Any, cast
 
 import httpx
 import socketio
-from pydantic import SecretStr
-from server.auth.token_manager import TokenManager
 from server.constants import PERMITTED_CORS_ORIGINS, WEB_HOST
 from server.utils.conversation_callback_utils import (
     process_event,
@@ -22,7 +20,7 @@ from server.utils.conversation_callback_utils import (
 from sqlalchemy import orm
 from storage.api_key_store import ApiKeyStore
 from storage.database import session_maker
-from storage.stored_conversation_metadata import StoredConversationMetadata
+from storage.minimal_conversation_metadata import StoredConversationMetadata
 
 from openhands.controller.agent import Agent
 from openhands.core.config import LLMConfig, OpenHandsConfig
@@ -31,11 +29,7 @@ from openhands.core.logger import openhands_logger as logger
 from openhands.events.action import MessageAction
 from openhands.events.event_store import EventStore
 from openhands.events.serialization.event import event_to_dict
-from openhands.integrations.provider import (
-    PROVIDER_TOKEN_TYPE,
-    ProviderHandler,
-    ProviderToken,
-)
+from openhands.integrations.provider import PROVIDER_TOKEN_TYPE, ProviderHandler
 from openhands.runtime.impl.remote.remote_runtime import RemoteRuntime
 from openhands.runtime.plugins.vscode import VSCodeRequirement
 from openhands.runtime.runtime_status import RuntimeStatus
@@ -234,102 +228,6 @@ class SaasNestedConversationManager(ConversationManager):
             status=status,
         )
 
-    async def _refresh_provider_tokens_after_runtime_init(
-        self, settings: Settings, sid: str, user_id: str | None = None
-    ) -> Settings:
-        """Refresh provider tokens after runtime initialization.
-
-        During runtime initialization, tokens may be refreshed by Runtime.__init__().
-        This method retrieves the fresh tokens from the database and creates a new
-        settings object with updated tokens to avoid sending stale tokens to the
-        nested runtime.
-
-        The method handles two scenarios:
-        1. ProviderToken has user_id (IDP user ID, e.g., GitLab user ID)
-           → Uses get_idp_token_from_idp_user_id()
-        2. ProviderToken has no user_id but Keycloak user_id is available
-           → Uses load_offline_token() + get_idp_token_from_offline_token()
-
-        Args:
-            settings: The conversation settings that may contain provider tokens
-            sid: The session ID for logging purposes
-            user_id: The Keycloak user ID (optional, used as fallback when
-                     ProviderToken.user_id is not available)
-
-        Returns:
-            Updated settings with fresh provider tokens, or original settings
-            if no update is needed
-        """
-        if not isinstance(settings, ConversationInitData):
-            return settings
-
-        if not settings.git_provider_tokens:
-            return settings
-
-        token_manager = TokenManager()
-        updated_tokens = {}
-        tokens_refreshed = 0
-        tokens_failed = 0
-
-        for provider_type, provider_token in settings.git_provider_tokens.items():
-            fresh_token = None
-
-            try:
-                if provider_token.user_id:
-                    # Case 1: We have IDP user ID (e.g., GitLab user ID '32546706')
-                    # Get the token that was just refreshed during runtime initialization
-                    fresh_token = await token_manager.get_idp_token_from_idp_user_id(
-                        provider_token.user_id, provider_type
-                    )
-                elif user_id:
-                    # Case 2: We have Keycloak user ID but no IDP user ID
-                    # This happens in web UI flow where ProviderToken.user_id is None
-                    offline_token = await token_manager.load_offline_token(user_id)
-                    if offline_token:
-                        fresh_token = (
-                            await token_manager.get_idp_token_from_offline_token(
-                                offline_token, provider_type
-                            )
-                        )
-
-                if fresh_token:
-                    updated_tokens[provider_type] = ProviderToken(
-                        token=SecretStr(fresh_token),
-                        user_id=provider_token.user_id,
-                        host=provider_token.host,
-                    )
-                    tokens_refreshed += 1
-                else:
-                    # Keep original token if we couldn't get a fresh one
-                    updated_tokens[provider_type] = provider_token
-
-            except Exception as e:
-                # If refresh fails, use original token to prevent conversation startup failure
-                logger.warning(
-                    f'Failed to refresh {provider_type.value} token: {e}',
-                    extra={'session_id': sid, 'provider': provider_type.value},
-                    exc_info=True,
-                )
-                updated_tokens[provider_type] = provider_token
-                tokens_failed += 1
-
-        # Create new ConversationInitData with updated tokens
-        # We cannot modify the frozen field directly, so we create a new object
-        updated_settings = settings.model_copy(
-            update={'git_provider_tokens': MappingProxyType(updated_tokens)}
-        )
-
-        logger.info(
-            'Updated provider tokens after runtime creation',
-            extra={
-                'session_id': sid,
-                'providers': [p.value for p in updated_tokens.keys()],
-                'refreshed': tokens_refreshed,
-                'failed': tokens_failed,
-            },
-        )
-        return updated_settings
-
     async def _start_agent_loop(
         self, sid, settings, user_id, initial_user_msg=None, replay_json=None
     ):
@@ -351,11 +249,6 @@ class SaasNestedConversationManager(ConversationManager):
 
             session_api_key = runtime.session.headers['X-Session-API-Key']
 
-            # Update provider tokens with fresh ones after runtime creation
-            settings = await self._refresh_provider_tokens_after_runtime_init(
-                settings, sid, user_id
-            )
-
             await self._start_conversation(
                 sid,
                 user_id,
@@ -440,12 +333,7 @@ class SaasNestedConversationManager(ConversationManager):
     async def _setup_provider_tokens(
         self, client: httpx.AsyncClient, api_url: str, settings: Settings
     ):
-        """Setup provider tokens for the nested conversation.
-
-        Note: Token validation happens in the nested runtime. If tokens are revoked,
-        the nested runtime will return 401. The caller should handle token refresh
-        and retry if needed.
-        """
+        """Setup provider tokens for the nested conversation."""
         provider_handler = self._get_provider_handler(settings)
         provider_tokens = provider_handler.provider_tokens
         if provider_tokens:
@@ -916,8 +804,6 @@ class SaasNestedConversationManager(ConversationManager):
         env_vars['ENABLE_V1'] = '0'
         env_vars['SU_TO_USER'] = SU_TO_USER
         env_vars['DISABLE_VSCODE_PLUGIN'] = str(DISABLE_VSCODE_PLUGIN).lower()
-        env_vars['BROWSERGYM_DOWNLOAD_DIR'] = '/workspace/.downloads/'
-        env_vars['PLAYWRIGHT_BROWSERS_PATH'] = '/opt/playwright-browsers'
 
         # We need this for LLM traces tracking to identify the source of the LLM calls
         env_vars['WEB_HOST'] = WEB_HOST

enterprise/server/sharing/README.md

@@ -1,20 +0,0 @@
-# Sharing Package
-
-This package contains functionality for sharing conversations.
-
-## Components
-
-- **shared.py**: Data models for shared conversations
-- **shared_conversation_info_service.py**: Service interface for accessing shared conversation info
-- **sql_shared_conversation_info_service.py**: SQL implementation of the shared conversation info service
-- **shared_event_service.py**: Service interface for accessing shared events
-- **shared_event_service_impl.py**: Implementation of the shared event service
-- **shared_conversation_router.py**: REST API endpoints for shared conversations
-- **shared_event_router.py**: REST API endpoints for shared events
-
-## Features
-
-- Read-only access to shared conversations
-- Event access for shared conversations
-- Search and filtering capabilities
-- Pagination support

enterprise/server/sharing/google_cloud_shared_event_service.py

@@ -1,159 +0,0 @@
-"""Implementation of SharedEventService.
-
-This implementation provides read-only access to events from shared conversations:
-- Validates that the conversation is shared before returning events
-- Uses existing EventService for actual event retrieval
-- Uses SharedConversationInfoService for shared conversation validation
-"""
-
-from __future__ import annotations
-
-import logging
-import os
-from dataclasses import dataclass
-from datetime import datetime
-from pathlib import Path
-from typing import AsyncGenerator
-from uuid import UUID
-
-from fastapi import Request
-from google.cloud import storage
-from google.cloud.storage.bucket import Bucket
-from google.cloud.storage.client import Client
-from more_itertools import bucket
-from pydantic import Field
-from server.sharing.shared_conversation_info_service import (
-    SharedConversationInfoService,
-)
-from server.sharing.shared_event_service import (
-    SharedEventService,
-    SharedEventServiceInjector,
-)
-from server.sharing.sql_shared_conversation_info_service import (
-    SQLSharedConversationInfoService,
-)
-
-from openhands.agent_server.models import EventPage, EventSortOrder
-from openhands.app_server.event.event_service import EventService
-from openhands.app_server.event.google_cloud_event_service import (
-    GoogleCloudEventService,
-)
-from openhands.app_server.event_callback.event_callback_models import EventKind
-from openhands.app_server.services.injector import InjectorState
-from openhands.sdk import Event
-
-logger = logging.getLogger(__name__)
-
-
-@dataclass
-class GoogleCloudSharedEventService(SharedEventService):
-    """Implementation of SharedEventService that validates shared access."""
-
-    shared_conversation_info_service: SharedConversationInfoService
-    bucket: Bucket
-
-    async def get_event_service(self, conversation_id: UUID) -> EventService | None:
-        shared_conversation_info = (
-            await self.shared_conversation_info_service.get_shared_conversation_info(
-                conversation_id
-            )
-        )
-        if shared_conversation_info is None:
-            return None
-
-        return GoogleCloudEventService(
-            bucket=bucket,
-            prefix=Path('users'),
-            user_id=shared_conversation_info.created_by_user_id,
-            app_conversation_info_service=None,
-            app_conversation_info_load_tasks={},
-        )
-
-    async def get_shared_event(
-        self, conversation_id: UUID, event_id: UUID
-    ) -> Event | None:
-        """Given a conversation_id and event_id, retrieve an event if the conversation is shared."""
-        # First check if the conversation is shared
-        event_service = await self.get_event_service(conversation_id)
-        if event_service is None:
-            return None
-
-        # If conversation is shared, get the event
-        return await event_service.get_event(conversation_id, event_id)
-
-    async def search_shared_events(
-        self,
-        conversation_id: UUID,
-        kind__eq: EventKind | None = None,
-        timestamp__gte: datetime | None = None,
-        timestamp__lt: datetime | None = None,
-        sort_order: EventSortOrder = EventSortOrder.TIMESTAMP,
-        page_id: str | None = None,
-        limit: int = 100,
-    ) -> EventPage:
-        """Search events for a specific shared conversation."""
-        # First check if the conversation is shared
-        event_service = await self.get_event_service(conversation_id)
-        if event_service is None:
-            # Return empty page if conversation is not shared
-            return EventPage(items=[], next_page_id=None)
-
-        # If conversation is shared, search events for this conversation
-        return await event_service.search_events(
-            conversation_id=conversation_id,
-            kind__eq=kind__eq,
-            timestamp__gte=timestamp__gte,
-            timestamp__lt=timestamp__lt,
-            sort_order=sort_order,
-            page_id=page_id,
-            limit=limit,
-        )
-
-    async def count_shared_events(
-        self,
-        conversation_id: UUID,
-        kind__eq: EventKind | None = None,
-        timestamp__gte: datetime | None = None,
-        timestamp__lt: datetime | None = None,
-    ) -> int:
-        """Count events for a specific shared conversation."""
-        # First check if the conversation is shared
-        event_service = await self.get_event_service(conversation_id)
-        if event_service is None:
-            # Return empty page if conversation is not shared
-            return 0
-
-        # If conversation is shared, count events for this conversation
-        return await event_service.count_events(
-            conversation_id=conversation_id,
-            kind__eq=kind__eq,
-            timestamp__gte=timestamp__gte,
-            timestamp__lt=timestamp__lt,
-        )
-
-
-class GoogleCloudSharedEventServiceInjector(SharedEventServiceInjector):
-    bucket_name: str | None = Field(
-        default_factory=lambda: os.environ.get('FILE_STORE_PATH')
-    )
-
-    async def inject(
-        self, state: InjectorState, request: Request | None = None
-    ) -> AsyncGenerator[SharedEventService, None]:
-        # Define inline to prevent circular lookup
-        from openhands.app_server.config import get_db_session
-
-        async with get_db_session(state, request) as db_session:
-            shared_conversation_info_service = SQLSharedConversationInfoService(
-                db_session=db_session
-            )
-
-            bucket_name = self.bucket_name
-            storage_client: Client = storage.Client()
-            bucket: Bucket = storage_client.bucket(bucket_name)
-
-            service = GoogleCloudSharedEventService(
-                shared_conversation_info_service=shared_conversation_info_service,
-                bucket=bucket,
-            )
-            yield service

enterprise/server/sharing/shared_conversation_info_service.py

@@ -1,66 +0,0 @@
-import asyncio
-from abc import ABC, abstractmethod
-from datetime import datetime
-from uuid import UUID
-
-from server.sharing.shared_conversation_models import (
-    SharedConversation,
-    SharedConversationPage,
-    SharedConversationSortOrder,
-)
-
-from openhands.app_server.services.injector import Injector
-from openhands.sdk.utils.models import DiscriminatedUnionMixin
-
-
-class SharedConversationInfoService(ABC):
-    """Service for accessing shared conversation info without user restrictions."""
-
-    @abstractmethod
-    async def search_shared_conversation_info(
-        self,
-        title__contains: str | None = None,
-        created_at__gte: datetime | None = None,
-        created_at__lt: datetime | None = None,
-        updated_at__gte: datetime | None = None,
-        updated_at__lt: datetime | None = None,
-        sort_order: SharedConversationSortOrder = SharedConversationSortOrder.CREATED_AT_DESC,
-        page_id: str | None = None,
-        limit: int = 100,
-        include_sub_conversations: bool = False,
-    ) -> SharedConversationPage:
-        """Search for shared conversations."""
-
-    @abstractmethod
-    async def count_shared_conversation_info(
-        self,
-        title__contains: str | None = None,
-        created_at__gte: datetime | None = None,
-        created_at__lt: datetime | None = None,
-        updated_at__gte: datetime | None = None,
-        updated_at__lt: datetime | None = None,
-    ) -> int:
-        """Count shared conversations."""
-
-    @abstractmethod
-    async def get_shared_conversation_info(
-        self, conversation_id: UUID
-    ) -> SharedConversation | None:
-        """Get a single shared conversation info, returning None if missing or not shared."""
-
-    async def batch_get_shared_conversation_info(
-        self, conversation_ids: list[UUID]
-    ) -> list[SharedConversation | None]:
-        """Get a batch of shared conversation info, return None for any missing or non-shared."""
-        return await asyncio.gather(
-            *[
-                self.get_shared_conversation_info(conversation_id)
-                for conversation_id in conversation_ids
-            ]
-        )
-
-
-class SharedConversationInfoServiceInjector(
-    DiscriminatedUnionMixin, Injector[SharedConversationInfoService], ABC
-):
-    pass

enterprise/server/sharing/shared_conversation_models.py

@@ -1,56 +0,0 @@
-from datetime import datetime
-from enum import Enum
-
-# Simplified imports to avoid dependency chain issues
-# from openhands.integrations.service_types import ProviderType
-# from openhands.sdk.llm import MetricsSnapshot
-# from openhands.storage.data_models.conversation_metadata import ConversationTrigger
-# For now, use Any to avoid import issues
-from typing import Any
-from uuid import uuid4
-
-from pydantic import BaseModel, Field
-
-from openhands.agent_server.utils import OpenHandsUUID, utc_now
-
-ProviderType = Any
-MetricsSnapshot = Any
-ConversationTrigger = Any
-
-
-class SharedConversation(BaseModel):
-    """Shared conversation info model with all fields from AppConversationInfo."""
-
-    id: OpenHandsUUID = Field(default_factory=uuid4)
-
-    created_by_user_id: str | None
-    sandbox_id: str
-
-    selected_repository: str | None = None
-    selected_branch: str | None = None
-    git_provider: ProviderType | None = None
-    title: str | None = None
-    pr_number: list[int] = Field(default_factory=list)
-    llm_model: str | None = None
-
-    metrics: MetricsSnapshot | None = None
-
-    parent_conversation_id: OpenHandsUUID | None = None
-    sub_conversation_ids: list[OpenHandsUUID] = Field(default_factory=list)
-
-    created_at: datetime = Field(default_factory=utc_now)
-    updated_at: datetime = Field(default_factory=utc_now)
-
-
-class SharedConversationSortOrder(Enum):
-    CREATED_AT = 'CREATED_AT'
-    CREATED_AT_DESC = 'CREATED_AT_DESC'
-    UPDATED_AT = 'UPDATED_AT'
-    UPDATED_AT_DESC = 'UPDATED_AT_DESC'
-    TITLE = 'TITLE'
-    TITLE_DESC = 'TITLE_DESC'
-
-
-class SharedConversationPage(BaseModel):
-    items: list[SharedConversation]
-    next_page_id: str | None = None

enterprise/server/sharing/shared_conversation_router.py

@@ -1,135 +0,0 @@
-"""Shared Conversation router for OpenHands Server."""
-
-from datetime import datetime
-from typing import Annotated
-from uuid import UUID
-
-from fastapi import APIRouter, Depends, Query
-from server.sharing.shared_conversation_info_service import (
-    SharedConversationInfoService,
-)
-from server.sharing.shared_conversation_models import (
-    SharedConversation,
-    SharedConversationPage,
-    SharedConversationSortOrder,
-)
-from server.sharing.sql_shared_conversation_info_service import (
-    SQLSharedConversationInfoServiceInjector,
-)
-
-router = APIRouter(prefix='/api/shared-conversations', tags=['Sharing'])
-shared_conversation_info_service_dependency = Depends(
-    SQLSharedConversationInfoServiceInjector().depends
-)
-
-# Read methods
-
-
-@router.get('/search')
-async def search_shared_conversations(
-    title__contains: Annotated[
-        str | None,
-        Query(title='Filter by title containing this string'),
-    ] = None,
-    created_at__gte: Annotated[
-        datetime | None,
-        Query(title='Filter by created_at greater than or equal to this datetime'),
-    ] = None,
-    created_at__lt: Annotated[
-        datetime | None,
-        Query(title='Filter by created_at less than this datetime'),
-    ] = None,
-    updated_at__gte: Annotated[
-        datetime | None,
-        Query(title='Filter by updated_at greater than or equal to this datetime'),
-    ] = None,
-    updated_at__lt: Annotated[
-        datetime | None,
-        Query(title='Filter by updated_at less than this datetime'),
-    ] = None,
-    sort_order: Annotated[
-        SharedConversationSortOrder,
-        Query(title='Sort order for results'),
-    ] = SharedConversationSortOrder.CREATED_AT_DESC,
-    page_id: Annotated[
-        str | None,
-        Query(title='Optional next_page_id from the previously returned page'),
-    ] = None,
-    limit: Annotated[
-        int,
-        Query(
-            title='The max number of results in the page',
-            gt=0,
-            lte=100,
-        ),
-    ] = 100,
-    include_sub_conversations: Annotated[
-        bool,
-        Query(
-            title='If True, include sub-conversations in the results. If False (default), exclude all sub-conversations.'
-        ),
-    ] = False,
-    shared_conversation_service: SharedConversationInfoService = shared_conversation_info_service_dependency,
-) -> SharedConversationPage:
-    """Search / List shared conversations."""
-    assert limit > 0
-    assert limit <= 100
-    return await shared_conversation_service.search_shared_conversation_info(
-        title__contains=title__contains,
-        created_at__gte=created_at__gte,
-        created_at__lt=created_at__lt,
-        updated_at__gte=updated_at__gte,
-        updated_at__lt=updated_at__lt,
-        sort_order=sort_order,
-        page_id=page_id,
-        limit=limit,
-        include_sub_conversations=include_sub_conversations,
-    )
-
-
-@router.get('/count')
-async def count_shared_conversations(
-    title__contains: Annotated[
-        str | None,
-        Query(title='Filter by title containing this string'),
-    ] = None,
-    created_at__gte: Annotated[
-        datetime | None,
-        Query(title='Filter by created_at greater than or equal to this datetime'),
-    ] = None,
-    created_at__lt: Annotated[
-        datetime | None,
-        Query(title='Filter by created_at less than this datetime'),
-    ] = None,
-    updated_at__gte: Annotated[
-        datetime | None,
-        Query(title='Filter by updated_at greater than or equal to this datetime'),
-    ] = None,
-    updated_at__lt: Annotated[
-        datetime | None,
-        Query(title='Filter by updated_at less than this datetime'),
-    ] = None,
-    shared_conversation_service: SharedConversationInfoService = shared_conversation_info_service_dependency,
-) -> int:
-    """Count shared conversations matching the given filters."""
-    return await shared_conversation_service.count_shared_conversation_info(
-        title__contains=title__contains,
-        created_at__gte=created_at__gte,
-        created_at__lt=created_at__lt,
-        updated_at__gte=updated_at__gte,
-        updated_at__lt=updated_at__lt,
-    )
-
-
-@router.get('')
-async def batch_get_shared_conversations(
-    ids: Annotated[list[str], Query()],
-    shared_conversation_service: SharedConversationInfoService = shared_conversation_info_service_dependency,
-) -> list[SharedConversation | None]:
-    """Get a batch of shared conversations given their ids. Return None for any missing or non-shared."""
-    assert len(ids) <= 100
-    uuids = [UUID(id_) for id_ in ids]
-    shared_conversation_info = (
-        await shared_conversation_service.batch_get_shared_conversation_info(uuids)
-    )
-    return shared_conversation_info

enterprise/server/sharing/shared_event_router.py

@@ -1,128 +0,0 @@
-"""Shared Event router for OpenHands Server."""
-
-from datetime import datetime
-from typing import Annotated
-from uuid import UUID
-
-from fastapi import APIRouter, Depends, Query
-from server.sharing.google_cloud_shared_event_service import (
-    GoogleCloudSharedEventServiceInjector,
-)
-from server.sharing.shared_event_service import SharedEventService
-
-from openhands.agent_server.models import EventPage, EventSortOrder
-from openhands.app_server.event_callback.event_callback_models import EventKind
-from openhands.sdk import Event
-
-router = APIRouter(prefix='/api/shared-events', tags=['Sharing'])
-shared_event_service_dependency = Depends(
-    GoogleCloudSharedEventServiceInjector().depends
-)
-
-
-# Read methods
-
-
-@router.get('/search')
-async def search_shared_events(
-    conversation_id: Annotated[
-        str,
-        Query(title='Conversation ID to search events for'),
-    ],
-    kind__eq: Annotated[
-        EventKind | None,
-        Query(title='Optional filter by event kind'),
-    ] = None,
-    timestamp__gte: Annotated[
-        datetime | None,
-        Query(title='Optional filter by timestamp greater than or equal to'),
-    ] = None,
-    timestamp__lt: Annotated[
-        datetime | None,
-        Query(title='Optional filter by timestamp less than'),
-    ] = None,
-    sort_order: Annotated[
-        EventSortOrder,
-        Query(title='Sort order for results'),
-    ] = EventSortOrder.TIMESTAMP,
-    page_id: Annotated[
-        str | None,
-        Query(title='Optional next_page_id from the previously returned page'),
-    ] = None,
-    limit: Annotated[
-        int,
-        Query(title='The max number of results in the page', gt=0, lte=100),
-    ] = 100,
-    shared_event_service: SharedEventService = shared_event_service_dependency,
-) -> EventPage:
-    """Search / List events for a shared conversation."""
-    assert limit > 0
-    assert limit <= 100
-    return await shared_event_service.search_shared_events(
-        conversation_id=UUID(conversation_id),
-        kind__eq=kind__eq,
-        timestamp__gte=timestamp__gte,
-        timestamp__lt=timestamp__lt,
-        sort_order=sort_order,
-        page_id=page_id,
-        limit=limit,
-    )
-
-
-@router.get('/count')
-async def count_shared_events(
-    conversation_id: Annotated[
-        str,
-        Query(title='Conversation ID to count events for'),
-    ],
-    kind__eq: Annotated[
-        EventKind | None,
-        Query(title='Optional filter by event kind'),
-    ] = None,
-    timestamp__gte: Annotated[
-        datetime | None,
-        Query(title='Optional filter by timestamp greater than or equal to'),
-    ] = None,
-    timestamp__lt: Annotated[
-        datetime | None,
-        Query(title='Optional filter by timestamp less than'),
-    ] = None,
-    shared_event_service: SharedEventService = shared_event_service_dependency,
-) -> int:
-    """Count events for a shared conversation matching the given filters."""
-    return await shared_event_service.count_shared_events(
-        conversation_id=UUID(conversation_id),
-        kind__eq=kind__eq,
-        timestamp__gte=timestamp__gte,
-        timestamp__lt=timestamp__lt,
-    )
-
-
-@router.get('')
-async def batch_get_shared_events(
-    conversation_id: Annotated[
-        str,
-        Query(title='Conversation ID to get events for'),
-    ],
-    id: Annotated[list[str], Query()],
-    shared_event_service: SharedEventService = shared_event_service_dependency,
-) -> list[Event | None]:
-    """Get a batch of events for a shared conversation given their ids, returning null for any missing event."""
-    assert len(id) <= 100
-    event_ids = [UUID(id_) for id_ in id]
-    events = await shared_event_service.batch_get_shared_events(
-        UUID(conversation_id), event_ids
-    )
-    return events
-
-
-@router.get('/{conversation_id}/{event_id}')
-async def get_shared_event(
-    conversation_id: str,
-    event_id: str,
-    shared_event_service: SharedEventService = shared_event_service_dependency,
-) -> Event | None:
-    """Get a single event from a shared conversation by conversation_id and event_id."""
-    return await shared_event_service.get_shared_event(
-        UUID(conversation_id), UUID(event_id)
-    )

enterprise/server/sharing/shared_event_service.py

@@ -1,63 +0,0 @@
-import asyncio
-import logging
-from abc import ABC, abstractmethod
-from datetime import datetime
-from uuid import UUID
-
-from openhands.agent_server.models import EventPage, EventSortOrder
-from openhands.app_server.event_callback.event_callback_models import EventKind
-from openhands.app_server.services.injector import Injector
-from openhands.sdk import Event
-from openhands.sdk.utils.models import DiscriminatedUnionMixin
-
-_logger = logging.getLogger(__name__)
-
-
-class SharedEventService(ABC):
-    """Event Service for getting events from shared conversations only."""
-
-    @abstractmethod
-    async def get_shared_event(
-        self, conversation_id: UUID, event_id: UUID
-    ) -> Event | None:
-        """Given a conversation_id and event_id, retrieve an event if the conversation is shared."""
-
-    @abstractmethod
-    async def search_shared_events(
-        self,
-        conversation_id: UUID,
-        kind__eq: EventKind | None = None,
-        timestamp__gte: datetime | None = None,
-        timestamp__lt: datetime | None = None,
-        sort_order: EventSortOrder = EventSortOrder.TIMESTAMP,
-        page_id: str | None = None,
-        limit: int = 100,
-    ) -> EventPage:
-        """Search events for a specific shared conversation."""
-
-    @abstractmethod
-    async def count_shared_events(
-        self,
-        conversation_id: UUID,
-        kind__eq: EventKind | None = None,
-        timestamp__gte: datetime | None = None,
-        timestamp__lt: datetime | None = None,
-    ) -> int:
-        """Count events for a specific shared conversation."""
-
-    async def batch_get_shared_events(
-        self, conversation_id: UUID, event_ids: list[UUID]
-    ) -> list[Event | None]:
-        """Given a conversation_id and list of event_ids, get events if the conversation is shared."""
-        return await asyncio.gather(
-            *[
-                self.get_shared_event(conversation_id, event_id)
-                for event_id in event_ids
-            ]
-        )
-
-
-class SharedEventServiceInjector(
-    DiscriminatedUnionMixin, Injector[SharedEventService], ABC
-):
-    pass

enterprise/server/sharing/sql_shared_conversation_info_service.py

@@ -1,282 +0,0 @@
-"""SQL implementation of SharedConversationInfoService.
-
-This implementation provides read-only access to shared conversations:
-- Direct database access without user permission checks
-- Filters only conversations marked as shared (currently public)
-- Full async/await support using SQL async db_sessions
-"""
-
-from __future__ import annotations
-
-import logging
-from dataclasses import dataclass
-from datetime import UTC, datetime
-from typing import AsyncGenerator
-from uuid import UUID
-
-from fastapi import Request
-from server.sharing.shared_conversation_info_service import (
-    SharedConversationInfoService,
-    SharedConversationInfoServiceInjector,
-)
-from server.sharing.shared_conversation_models import (
-    SharedConversation,
-    SharedConversationPage,
-    SharedConversationSortOrder,
-)
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from openhands.app_server.app_conversation.sql_app_conversation_info_service import (
-    StoredConversationMetadata,
-)
-from openhands.app_server.services.injector import InjectorState
-from openhands.integrations.provider import ProviderType
-from openhands.sdk.llm import MetricsSnapshot
-from openhands.sdk.llm.utils.metrics import TokenUsage
-
-logger = logging.getLogger(__name__)
-
-
-@dataclass
-class SQLSharedConversationInfoService(SharedConversationInfoService):
-    """SQL implementation of SharedConversationInfoService for shared conversations only."""
-
-    db_session: AsyncSession
-
-    async def search_shared_conversation_info(
-        self,
-        title__contains: str | None = None,
-        created_at__gte: datetime | None = None,
-        created_at__lt: datetime | None = None,
-        updated_at__gte: datetime | None = None,
-        updated_at__lt: datetime | None = None,
-        sort_order: SharedConversationSortOrder = SharedConversationSortOrder.CREATED_AT_DESC,
-        page_id: str | None = None,
-        limit: int = 100,
-        include_sub_conversations: bool = False,
-    ) -> SharedConversationPage:
-        """Search for shared conversations."""
-        query = self._public_select()
-
-        # Conditionally exclude sub-conversations based on the parameter
-        if not include_sub_conversations:
-            # Exclude sub-conversations (only include top-level conversations)
-            query = query.where(
-                StoredConversationMetadata.parent_conversation_id.is_(None)
-            )
-
-        query = self._apply_filters(
-            query=query,
-            title__contains=title__contains,
-            created_at__gte=created_at__gte,
-            created_at__lt=created_at__lt,
-            updated_at__gte=updated_at__gte,
-            updated_at__lt=updated_at__lt,
-        )
-
-        # Add sort order
-        if sort_order == SharedConversationSortOrder.CREATED_AT:
-            query = query.order_by(StoredConversationMetadata.created_at)
-        elif sort_order == SharedConversationSortOrder.CREATED_AT_DESC:
-            query = query.order_by(StoredConversationMetadata.created_at.desc())
-        elif sort_order == SharedConversationSortOrder.UPDATED_AT:
-            query = query.order_by(StoredConversationMetadata.last_updated_at)
-        elif sort_order == SharedConversationSortOrder.UPDATED_AT_DESC:
-            query = query.order_by(StoredConversationMetadata.last_updated_at.desc())
-        elif sort_order == SharedConversationSortOrder.TITLE:
-            query = query.order_by(StoredConversationMetadata.title)
-        elif sort_order == SharedConversationSortOrder.TITLE_DESC:
-            query = query.order_by(StoredConversationMetadata.title.desc())
-
-        # Apply pagination
-        if page_id is not None:
-            try:
-                offset = int(page_id)
-                query = query.offset(offset)
-            except ValueError:
-                # If page_id is not a valid integer, start from beginning
-                offset = 0
-        else:
-            offset = 0
-
-        # Apply limit and get one extra to check if there are more results
-        query = query.limit(limit + 1)
-
-        result = await self.db_session.execute(query)
-        rows = result.scalars().all()
-
-        # Check if there are more results
-        has_more = len(rows) > limit
-        if has_more:
-            rows = rows[:limit]
-
-        items = [self._to_shared_conversation(row) for row in rows]
-
-        # Calculate next page ID
-        next_page_id = None
-        if has_more:
-            next_page_id = str(offset + limit)
-
-        return SharedConversationPage(items=items, next_page_id=next_page_id)
-
-    async def count_shared_conversation_info(
-        self,
-        title__contains: str | None = None,
-        created_at__gte: datetime | None = None,
-        created_at__lt: datetime | None = None,
-        updated_at__gte: datetime | None = None,
-        updated_at__lt: datetime | None = None,
-    ) -> int:
-        """Count shared conversations matching the given filters."""
-        from sqlalchemy import func
-
-        query = select(func.count(StoredConversationMetadata.conversation_id))
-        # Only include shared conversations
-        query = query.where(StoredConversationMetadata.public == True)  # noqa: E712
-        query = query.where(StoredConversationMetadata.conversation_version == 'V1')
-
-        query = self._apply_filters(
-            query=query,
-            title__contains=title__contains,
-            created_at__gte=created_at__gte,
-            created_at__lt=created_at__lt,
-            updated_at__gte=updated_at__gte,
-            updated_at__lt=updated_at__lt,
-        )
-
-        result = await self.db_session.execute(query)
-        return result.scalar() or 0
-
-    async def get_shared_conversation_info(
-        self, conversation_id: UUID
-    ) -> SharedConversation | None:
-        """Get a single public conversation info, returning None if missing or not shared."""
-        query = self._public_select().where(
-            StoredConversationMetadata.conversation_id == str(conversation_id)
-        )
-
-        result = await self.db_session.execute(query)
-        stored = result.scalar_one_or_none()
-
-        if stored is None:
-            return None
-
-        return self._to_shared_conversation(stored)
-
-    def _public_select(self):
-        """Create a select query that only returns public conversations."""
-        query = select(StoredConversationMetadata).where(
-            StoredConversationMetadata.conversation_version == 'V1'
-        )
-        # Only include conversations marked as public
-        query = query.where(StoredConversationMetadata.public == True)  # noqa: E712
-        return query
-
-    def _apply_filters(
-        self,
-        query,
-        title__contains: str | None = None,
-        created_at__gte: datetime | None = None,
-        created_at__lt: datetime | None = None,
-        updated_at__gte: datetime | None = None,
-        updated_at__lt: datetime | None = None,
-    ):
-        """Apply common filters to a query."""
-        if title__contains is not None:
-            query = query.where(
-                StoredConversationMetadata.title.contains(title__contains)
-            )
-
-        if created_at__gte is not None:
-            query = query.where(
-                StoredConversationMetadata.created_at >= created_at__gte
-            )
-
-        if created_at__lt is not None:
-            query = query.where(StoredConversationMetadata.created_at < created_at__lt)
-
-        if updated_at__gte is not None:
-            query = query.where(
-                StoredConversationMetadata.last_updated_at >= updated_at__gte
-            )
-
-        if updated_at__lt is not None:
-            query = query.where(
-                StoredConversationMetadata.last_updated_at < updated_at__lt
-            )
-
-        return query
-
-    def _to_shared_conversation(
-        self,
-        stored: StoredConversationMetadata,
-        sub_conversation_ids: list[UUID] | None = None,
-    ) -> SharedConversation:
-        """Convert StoredConversationMetadata to SharedConversation."""
-        # V1 conversations should always have a sandbox_id
-        sandbox_id = stored.sandbox_id
-        assert sandbox_id is not None
-
-        # Rebuild token usage
-        token_usage = TokenUsage(
-            prompt_tokens=stored.prompt_tokens,
-            completion_tokens=stored.completion_tokens,
-            cache_read_tokens=stored.cache_read_tokens,
-            cache_write_tokens=stored.cache_write_tokens,
-            context_window=stored.context_window,
-            per_turn_token=stored.per_turn_token,
-        )
-
-        # Rebuild metrics object
-        metrics = MetricsSnapshot(
-            accumulated_cost=stored.accumulated_cost,
-            max_budget_per_task=stored.max_budget_per_task,
-            accumulated_token_usage=token_usage,
-        )
-
-        # Get timestamps
-        created_at = self._fix_timezone(stored.created_at)
-        updated_at = self._fix_timezone(stored.last_updated_at)
-
-        return SharedConversation(
-            id=UUID(stored.conversation_id),
-            created_by_user_id=stored.user_id if stored.user_id else None,
-            sandbox_id=stored.sandbox_id,
-            selected_repository=stored.selected_repository,
-            selected_branch=stored.selected_branch,
-            git_provider=(
-                ProviderType(stored.git_provider) if stored.git_provider else None
-            ),
-            title=stored.title,
-            pr_number=stored.pr_number,
-            llm_model=stored.llm_model,
-            metrics=metrics,
-            parent_conversation_id=(
-                UUID(stored.parent_conversation_id)
-                if stored.parent_conversation_id
-                else None
-            ),
-            sub_conversation_ids=sub_conversation_ids or [],
-            created_at=created_at,
-            updated_at=updated_at,
-        )
-
-    def _fix_timezone(self, value: datetime) -> datetime:
-        """Sqlite does not store timezones - and since we can't update the existing models
-        we assume UTC if the timezone is missing."""
-        if not value.tzinfo:
-            value = value.replace(tzinfo=UTC)
-        return value
-
-
-class SQLSharedConversationInfoServiceInjector(SharedConversationInfoServiceInjector):
-    async def inject(
-        self, state: InjectorState, request: Request | None = None
-    ) -> AsyncGenerator[SharedConversationInfoService, None]:
-        # Define inline to prevent circular lookup
-        from openhands.app_server.config import get_db_session
-
-        async with get_db_session(state, request) as db_session:
-            service = SQLSharedConversationInfoService(db_session=db_session)
-            yield service

enterprise/server/utils/conversation_callback_utils.py

@@ -11,7 +11,7 @@ from storage.conversation_callback import (
 )
 from storage.conversation_work import ConversationWork
 from storage.database import session_maker
-from storage.stored_conversation_metadata import StoredConversationMetadata
+from storage.minimal_conversation_metadata import StoredConversationMetadata
 
 from openhands.core.config import load_openhands_config
 from openhands.core.schema.agent import AgentState

enterprise/server/utils/rate_limit_utils.py

@@ -1,83 +0,0 @@
-from fastapi import HTTPException, Request, status
-
-from openhands.core.logger import openhands_logger as logger
-from openhands.server.shared import sio
-
-# Rate limiting constants
-RATE_LIMIT_USER_SECONDS = 120  # 2 minutes per user_id
-RATE_LIMIT_IP_SECONDS = 300  # 5 minutes per IP address
-
-
-async def check_rate_limit_by_user_id(
-    request: Request,
-    key_prefix: str,
-    user_id: str | None,
-    user_rate_limit_seconds: int = RATE_LIMIT_USER_SECONDS,
-    ip_rate_limit_seconds: int = RATE_LIMIT_IP_SECONDS,
-) -> None:
-    """
-    Check rate limit for requests, using user_id when available, falling back to IP address.
-
-    Uses Redis to store rate limit keys with expiration. If a key already exists,
-    it means the rate limit is active and the request will be rejected.
-
-    Args:
-        request: FastAPI Request object
-        key_prefix: Prefix for the Redis key (e.g., "email_resend")
-        user_id: User ID if available, None otherwise
-        user_rate_limit_seconds: Rate limit window in seconds for user_id-based limiting (default: 120)
-        ip_rate_limit_seconds: Rate limit window in seconds for IP-based limiting (default: 300)
-
-    Raises:
-        HTTPException: If rate limit is exceeded (429 status code)
-    """
-    try:
-        redis = sio.manager.redis
-        if not redis:
-            # If Redis is unavailable, log warning and allow request (fail open)
-            logger.warning('Redis unavailable for rate limiting, allowing request')
-            return
-
-        if user_id:
-            # Rate limit by user_id (primary method)
-            rate_limit_key = f'{key_prefix}:{user_id}'
-            rate_limit_seconds = user_rate_limit_seconds
-        else:
-            # Fallback to IP address rate limiting
-            client_ip = request.client.host if request.client else 'unknown'
-            rate_limit_key = f'{key_prefix}:ip:{client_ip}'
-            rate_limit_seconds = ip_rate_limit_seconds
-
-        # Try to set the key with expiration. If it already exists (nx=True fails),
-        # it means the rate limit is active
-        created = await redis.set(rate_limit_key, 1, nx=True, ex=rate_limit_seconds)
-
-        if not created:
-            logger.info(
-                f'Rate limit exceeded for {rate_limit_key}',
-                extra={
-                    'user_id': user_id,
-                    'ip': request.client.host if request.client else 'unknown',
-                },
-            )
-            # Format error message based on duration
-            if rate_limit_seconds < 60:
-                wait_message = f'{rate_limit_seconds} seconds'
-            elif rate_limit_seconds % 60 == 0:
-                wait_message = f'{rate_limit_seconds // 60} minute{"s" if rate_limit_seconds // 60 != 1 else ""}'
-            else:
-                minutes = rate_limit_seconds // 60
-                seconds = rate_limit_seconds % 60
-                wait_message = f'{minutes} minute{"s" if minutes != 1 else ""} and {seconds} second{"s" if seconds != 1 else ""}'
-
-            raise HTTPException(
-                status_code=status.HTTP_429_TOO_MANY_REQUESTS,
-                detail=f'Too many requests. Please wait {wait_message} before trying again.',
-            )
-    except HTTPException:
-        # Re-raise HTTPException (rate limit exceeded)
-        raise
-    except Exception as e:
-        # Log error but allow request (fail open) to avoid blocking legitimate users
-        logger.warning(f'Error checking rate limit: {e}', exc_info=True)
-        return

enterprise/storage/api_key_store.py

@@ -17,13 +17,10 @@ from openhands.core.logger import openhands_logger as logger
 class ApiKeyStore:
     session_maker: sessionmaker
 
-    API_KEY_PREFIX = 'sk-oh-'
-
     def generate_api_key(self, length: int = 32) -> str:
-        """Generate a random API key with the sk-oh- prefix."""
+        """Generate a random API key."""
         alphabet = string.ascii_letters + string.digits
-        random_part = ''.join(secrets.choice(alphabet) for _ in range(length))
-        return f'{self.API_KEY_PREFIX}{random_part}'
+        return ''.join(secrets.choice(alphabet) for _ in range(length))
 
     def create_api_key(
         self, user_id: str, name: str | None = None, expires_at: datetime | None = None

enterprise/storage/blocked_email_domain.py

@@ -1,30 +0,0 @@
-from datetime import UTC, datetime
-
-from sqlalchemy import Column, DateTime, Identity, Integer, String
-from storage.base import Base
-
-
-class BlockedEmailDomain(Base):  # type: ignore
-    """Stores blocked email domain patterns.
-
-    Supports blocking:
-    - Exact domains: 'example.com' blocks 'user@example.com'
-    - Subdomains: 'example.com' blocks 'user@subdomain.example.com'
-    - TLDs: '.us' blocks 'user@company.us' and 'user@subdomain.company.us'
-    """
-
-    __tablename__ = 'blocked_email_domains'
-
-    id = Column(Integer, Identity(), primary_key=True)
-    domain = Column(String, nullable=False, unique=True)
-    created_at = Column(
-        DateTime(timezone=True),
-        default=lambda: datetime.now(UTC),
-        nullable=False,
-    )
-    updated_at = Column(
-        DateTime(timezone=True),
-        default=lambda: datetime.now(UTC),
-        onupdate=lambda: datetime.now(UTC),
-        nullable=False,
-    )

enterprise/storage/blocked_email_domain_store.py

@@ -1,45 +0,0 @@
-from dataclasses import dataclass
-
-from sqlalchemy import text
-from sqlalchemy.orm import sessionmaker
-
-
-@dataclass
-class BlockedEmailDomainStore:
-    session_maker: sessionmaker
-
-    def is_domain_blocked(self, domain: str) -> bool:
-        """Check if a domain is blocked by querying the database directly.
-
-        This method uses SQL to efficiently check if the domain matches any blocked pattern:
-        - TLD patterns (e.g., '.us'): checks if domain ends with the pattern
-        - Full domain patterns (e.g., 'example.com'): checks for exact match or subdomain match
-
-        Args:
-            domain: The extracted domain from the email (e.g., 'example.com' or 'subdomain.example.com')
-
-        Returns:
-            True if the domain is blocked, False otherwise
-        """
-        with self.session_maker() as session:
-            # SQL query that handles both TLD patterns and full domain patterns
-            # TLD patterns (starting with '.'): check if domain ends with the pattern
-            # Full domain patterns: check for exact match or subdomain match
-            # All comparisons are case-insensitive using LOWER() to ensure consistent matching
-            query = text("""
-                SELECT EXISTS(
-                    SELECT 1
-                    FROM blocked_email_domains
-                    WHERE
-                        -- TLD pattern (e.g., '.us') - check if domain ends with it (case-insensitive)
-                        (LOWER(domain) LIKE '.%' AND LOWER(:domain) LIKE '%' || LOWER(domain)) OR
-                        -- Full domain pattern (e.g., 'example.com')
-                        -- Block exact match or subdomains (case-insensitive)
-                        (LOWER(domain) NOT LIKE '.%' AND (
-                            LOWER(:domain) = LOWER(domain) OR
-                            LOWER(:domain) LIKE '%.' || LOWER(domain)
-                        ))
-                )
-            """)
-            result = session.execute(query, {'domain': domain}).scalar()
-            return bool(result)

enterprise/storage/database.py

@@ -19,23 +19,17 @@ GCP_REGION = os.environ.get('GCP_REGION')
 
 POOL_SIZE = int(os.environ.get('DB_POOL_SIZE', '25'))
 MAX_OVERFLOW = int(os.environ.get('DB_MAX_OVERFLOW', '10'))
-POOL_RECYCLE = int(os.environ.get('DB_POOL_RECYCLE', '1800'))
-
-# Initialize Cloud SQL Connector once at module level for GCP environments.
-_connector = None
 
 
 def _get_db_engine():
     if GCP_DB_INSTANCE:  # GCP environments
 
         def get_db_connection():
-            global _connector
             from google.cloud.sql.connector import Connector
 
-            if not _connector:
-                _connector = Connector()
+            connector = Connector()
             instance_string = f'{GCP_PROJECT}:{GCP_REGION}:{GCP_DB_INSTANCE}'
-            return _connector.connect(
+            return connector.connect(
                 instance_string, 'pg8000', user=DB_USER, password=DB_PASS, db=DB_NAME
             )
 
@@ -44,7 +38,6 @@ def _get_db_engine():
             creator=get_db_connection,
             pool_size=POOL_SIZE,
             max_overflow=MAX_OVERFLOW,
-            pool_recycle=POOL_RECYCLE,
             pool_pre_ping=True,
         )
     else:
@@ -55,7 +48,6 @@ def _get_db_engine():
             host_string,
             pool_size=POOL_SIZE,
             max_overflow=MAX_OVERFLOW,
-            pool_recycle=POOL_RECYCLE,
             pool_pre_ping=True,
         )
 

enterprise/storage/gitlab_webhook_store.py

@@ -220,127 +220,6 @@ class GitlabWebhookStore:
                 return webhooks[0].webhook_secret
             return None
 
-    async def get_webhook_by_resource_only(
-        self, resource_type: GitLabResourceType, resource_id: str
-    ) -> GitlabWebhook | None:
-        """Get a webhook by resource without filtering by user_id.
-
-        This allows any admin user in the organization to manage webhooks,
-        not just the original installer.
-
-        Args:
-            resource_type: The type of resource (PROJECT or GROUP)
-            resource_id: The ID of the resource
-
-        Returns:
-            GitlabWebhook object if found, None otherwise
-        """
-        async with self.a_session_maker() as session:
-            if resource_type == GitLabResourceType.PROJECT:
-                query = select(GitlabWebhook).where(
-                    GitlabWebhook.project_id == resource_id
-                )
-            else:  # GROUP
-                query = select(GitlabWebhook).where(
-                    GitlabWebhook.group_id == resource_id
-                )
-
-            result = await session.execute(query)
-            webhook = result.scalars().first()
-            return webhook
-
-    async def get_webhooks_by_resources(
-        self, project_ids: list[str], group_ids: list[str]
-    ) -> tuple[dict[str, GitlabWebhook], dict[str, GitlabWebhook]]:
-        """Bulk fetch webhooks for multiple resources.
-
-        This is more efficient than fetching one at a time in a loop.
-
-        Args:
-            project_ids: List of project IDs to fetch
-            group_ids: List of group IDs to fetch
-
-        Returns:
-            Tuple of (project_webhook_map, group_webhook_map)
-        """
-        async with self.a_session_maker() as session:
-            project_webhook_map = {}
-            group_webhook_map = {}
-
-            # Fetch all project webhooks in one query
-            if project_ids:
-                project_query = select(GitlabWebhook).where(
-                    GitlabWebhook.project_id.in_(project_ids)
-                )
-                result = await session.execute(project_query)
-                project_webhooks = result.scalars().all()
-                project_webhook_map = {wh.project_id: wh for wh in project_webhooks}
-
-            # Fetch all group webhooks in one query
-            if group_ids:
-                group_query = select(GitlabWebhook).where(
-                    GitlabWebhook.group_id.in_(group_ids)
-                )
-                result = await session.execute(group_query)
-                group_webhooks = result.scalars().all()
-                group_webhook_map = {wh.group_id: wh for wh in group_webhooks}
-
-            return project_webhook_map, group_webhook_map
-
-    async def reset_webhook_for_reinstallation_by_resource(
-        self, resource_type: GitLabResourceType, resource_id: str, updating_user_id: str
-    ) -> bool:
-        """Reset webhook for reinstallation without filtering by user_id.
-
-        This allows any admin user to reset webhooks, and updates the user_id
-        to track who last modified it.
-
-        Args:
-            resource_type: The type of resource (PROJECT or GROUP)
-            resource_id: The ID of the resource
-            updating_user_id: The user ID performing the update (for audit purposes)
-
-        Returns:
-            True if webhook was reset, False if not found
-        """
-        async with self.a_session_maker() as session:
-            async with session.begin():
-                if resource_type == GitLabResourceType.PROJECT:
-                    update_statement = (
-                        update(GitlabWebhook)
-                        .where(GitlabWebhook.project_id == resource_id)
-                        .values(
-                            webhook_exists=False,
-                            webhook_uuid=None,
-                            user_id=updating_user_id,  # Update to track who modified it
-                        )
-                    )
-                else:  # GROUP
-                    update_statement = (
-                        update(GitlabWebhook)
-                        .where(GitlabWebhook.group_id == resource_id)
-                        .values(
-                            webhook_exists=False,
-                            webhook_uuid=None,
-                            user_id=updating_user_id,  # Update to track who modified it
-                        )
-                    )
-
-                result = await session.execute(update_statement)
-                rows_updated = result.rowcount
-
-                logger.info(
-                    'Reset webhook for reinstallation (organization-wide)',
-                    extra={
-                        'updating_user_id': updating_user_id,
-                        'resource_type': resource_type.value,
-                        'resource_id': resource_id,
-                        'rows_updated': rows_updated,
-                    },
-                )
-
-                return rows_updated > 0
-
     @classmethod
     async def get_instance(cls) -> GitlabWebhookStore:
         """Get an instance of the GitlabWebhookStore.

enterprise/storage/minimal_conversation_metadata.py

@@ -0,0 +1,104 @@
+"""Minimal StoredConversationMetadata for enterprise tests.
+
+This module provides a minimal StoredConversationMetadata class that avoids
+the broken SDK import chain in the main codebase, allowing enterprise tests
+to run successfully.
+"""
+
+from datetime import datetime
+from typing import Optional
+
+from sqlalchemy import JSON, Column, DateTime, Float, Integer, String
+from storage.base import Base
+
+
+class StoredConversationMetadata(Base):
+    """Minimal conversation metadata model for enterprise tests."""
+
+    __tablename__ = 'conversation_metadata'
+    __table_args__ = {'extend_existing': True}
+
+    conversation_id = Column(String, primary_key=True)
+    github_user_id = Column(String, nullable=True)
+    user_id = Column(String, nullable=False)
+    selected_repository = Column(String, nullable=True)
+    selected_branch = Column(String, nullable=True)
+    git_provider = Column(String, nullable=True)
+    title = Column(String, nullable=True)
+    last_updated_at = Column(DateTime, nullable=False, default=datetime.utcnow)
+    created_at = Column(DateTime, nullable=False, default=datetime.utcnow)
+    trigger = Column(String, nullable=True)
+    pr_number = Column(JSON, nullable=True)
+
+    # Cost and token metrics
+    accumulated_cost = Column(Float, default=0.0)
+    prompt_tokens = Column(Integer, default=0)
+    completion_tokens = Column(Integer, default=0)
+    total_tokens = Column(Integer, default=0)
+    max_budget_per_task = Column(Float, nullable=True)
+    cache_read_tokens = Column(Integer, default=0)
+    cache_write_tokens = Column(Integer, default=0)
+    reasoning_tokens = Column(Integer, default=0)
+    context_window = Column(Integer, default=0)
+    per_turn_token = Column(Integer, default=0)
+
+    # LLM model used for the conversation
+    llm_model = Column(String, nullable=True)
+
+    conversation_version = Column(String, nullable=False, default='V0')
+    sandbox_id = Column(String, nullable=True)
+
+    def __init__(
+        self,
+        conversation_id: str,
+        user_id: str,
+        github_user_id: Optional[str] = None,
+        selected_repository: Optional[str] = None,
+        selected_branch: Optional[str] = None,
+        git_provider: Optional[str] = None,
+        title: Optional[str] = None,
+        created_at: Optional[datetime] = None,
+        last_updated_at: Optional[datetime] = None,
+        trigger: Optional[str] = None,
+        pr_number: Optional[list] = None,
+        accumulated_cost: Optional[float] = None,
+        prompt_tokens: Optional[int] = None,
+        completion_tokens: Optional[int] = None,
+        total_tokens: Optional[int] = None,
+        max_budget_per_task: Optional[float] = None,
+        cache_read_tokens: Optional[int] = None,
+        cache_write_tokens: Optional[int] = None,
+        reasoning_tokens: Optional[int] = None,
+        context_window: Optional[int] = None,
+        per_turn_token: Optional[int] = None,
+        llm_model: Optional[str] = None,
+        conversation_version: str = 'V0',
+        sandbox_id: Optional[str] = None,
+    ):
+        self.conversation_id = conversation_id
+        self.github_user_id = github_user_id
+        self.user_id = user_id
+        self.selected_repository = selected_repository
+        self.selected_branch = selected_branch
+        self.git_provider = git_provider
+        self.title = title
+        self.created_at = created_at or datetime.utcnow()
+        self.last_updated_at = last_updated_at or datetime.utcnow()
+        self.trigger = trigger
+        self.pr_number = pr_number
+        self.accumulated_cost = accumulated_cost or 0.0
+        self.prompt_tokens = prompt_tokens or 0
+        self.completion_tokens = completion_tokens or 0
+        self.total_tokens = total_tokens or 0
+        self.max_budget_per_task = max_budget_per_task
+        self.cache_read_tokens = cache_read_tokens or 0
+        self.cache_write_tokens = cache_write_tokens or 0
+        self.reasoning_tokens = reasoning_tokens or 0
+        self.context_window = context_window or 0
+        self.per_turn_token = per_turn_token or 0
+        self.llm_model = llm_model
+        self.conversation_version = conversation_version
+        self.sandbox_id = sandbox_id
+
+
+__all__ = ['StoredConversationMetadata']

enterprise/storage/saas_conversation_store.py

@@ -7,7 +7,7 @@ from datetime import UTC
 
 from sqlalchemy.orm import sessionmaker
 from storage.database import session_maker
-from storage.stored_conversation_metadata import StoredConversationMetadata
+from storage.minimal_conversation_metadata import StoredConversationMetadata
 
 from openhands.core.config.openhands_config import OpenHandsConfig
 from openhands.integrations.provider import ProviderType
@@ -61,7 +61,6 @@ class SaasConversationStore(ConversationStore):
         kwargs.pop('context_window', None)
         kwargs.pop('per_turn_token', None)
         kwargs.pop('parent_conversation_id', None)
-        kwargs.pop('public')
 
         return ConversationMetadata(**kwargs)
 

enterprise/storage/saas_settings_store.py

@@ -19,7 +19,6 @@ from server.constants import (
     LITE_LLM_API_URL,
     LITE_LLM_TEAM_ID,
     REQUIRE_PAYMENT,
-    USER_SETTINGS_VERSION_TO_MODEL,
     get_default_litellm_model,
 )
 from server.logger import logger
@@ -203,53 +202,6 @@ class SaasSettingsStore(SettingsStore):
             )
             return None
 
-    def _has_custom_settings(
-        self, settings: Settings, old_user_version: int | None
-    ) -> bool:
-        """
-        Check if user has custom LLM settings that should be preserved.
-        Returns True if user customized either model or base_url.
-
-        Args:
-            settings: The user's current settings
-            old_user_version: The user's old settings version, if any
-
-        Returns:
-            True if user has custom settings, False if using old defaults
-        """
-        # Normalize values
-        user_model = (
-            settings.llm_model.strip()
-            if settings.llm_model and settings.llm_model.strip()
-            else None
-        )
-        user_base_url = (
-            settings.llm_base_url.strip()
-            if settings.llm_base_url and settings.llm_base_url.strip()
-            else None
-        )
-
-        # Custom base_url = definitely custom settings (BYOK)
-        if user_base_url and user_base_url != LITE_LLM_API_URL:
-            return True
-
-        # No model set = using defaults
-        if not user_model:
-            return False
-
-        # Check if model matches old version's default
-        if (
-            old_user_version
-            and old_user_version < CURRENT_USER_SETTINGS_VERSION
-            and old_user_version in USER_SETTINGS_VERSION_TO_MODEL
-        ):
-            old_default_base = USER_SETTINGS_VERSION_TO_MODEL[old_user_version]
-            user_model_base = user_model.split('/')[-1]
-            if user_model_base == old_default_base:
-                return False  # Matches old default
-
-        return True  # Custom model
-
     async def update_settings_with_litellm_default(
         self, settings: Settings
     ) -> Settings | None:
@@ -261,17 +213,6 @@ class SaasSettingsStore(SettingsStore):
             return None
         local_deploy = os.environ.get('LOCAL_DEPLOYMENT', None)
         key = LITE_LLM_API_KEY
-
-        # Check if user has custom settings
-        has_custom = self._has_custom_settings(settings, settings.user_version)
-
-        # Determine model to use (needed before LiteLLM user creation)
-        llm_model_to_use = (
-            settings.llm_model
-            if has_custom and settings.llm_model
-            else get_default_litellm_model()
-        )
-
         if not local_deploy:
             # Get user info to add to litellm
             token_manager = TokenManager()
@@ -285,21 +226,14 @@ class SaasSettingsStore(SettingsStore):
                     'x-goog-api-key': LITE_LLM_API_KEY,
                 },
             ) as client:
-                # Get the previous max budget to prevent accidental loss.
-                #
-                # LiteLLM v1.80+ returns 404 for non-existent users (previously returned empty user_info)
+                # Get the previous max budget to prevent accidental loss
+                # In Litellm a get always succeeds, regardless of whether the user actually exists
                 response = await client.get(
                     f'{LITE_LLM_API_URL}/user/info?user_id={self.user_id}'
                 )
-                user_info: dict
-                if response.status_code == 404:
-                    # New user - doesn't exist in LiteLLM yet (v1.80+ behavior)
-                    user_info = {}
-                else:
-                    # For any other status, use standard error handling
-                    response.raise_for_status()
-                    response_json = response.json()
-                    user_info = response_json.get('user_info') or {}
+                response.raise_for_status()
+                response_json = response.json()
+                user_info = response_json.get('user_info') or {}
                 logger.info(
                     f'creating_litellm_user: {self.user_id}; prev_max_budget: {user_info.get("max_budget")}; prev_metadata: {user_info.get("metadata")}'
                 )
@@ -342,7 +276,7 @@ class SaasSettingsStore(SettingsStore):
 
                 # Create the new litellm user
                 response = await self._create_user_in_lite_llm(
-                    client, email, max_budget, spend, llm_model_to_use
+                    client, email, int(max_budget), int(spend)
                 )
                 if not response.is_success:
                     logger.warning(
@@ -351,7 +285,7 @@ class SaasSettingsStore(SettingsStore):
                     )
                     # Litellm insists on unique email addresses - it is possible the email address was registered with a different user.
                     response = await self._create_user_in_lite_llm(
-                        client, None, max_budget, spend, llm_model_to_use
+                        client, None, int(max_budget), int(spend)
                     )
 
                 # User failed to create in litellm - this is an unforseen error state...
@@ -377,17 +311,11 @@ class SaasSettingsStore(SettingsStore):
                     extra={'user_id': self.user_id},
                 )
 
-        if has_custom:
-            settings.llm_model = settings.llm_model or get_default_litellm_model()
-            settings.llm_base_url = settings.llm_base_url or LITE_LLM_API_URL
-            settings.llm_api_key = settings.llm_api_key or SecretStr(key)
-        else:
-            settings.llm_model = get_default_litellm_model()
-            settings.llm_base_url = LITE_LLM_API_URL
-            settings.llm_api_key = SecretStr(key)
-
         settings.agent = 'CodeActAgent'
-
+        # Use the model corresponding to the current user settings version
+        settings.llm_model = get_default_litellm_model()
+        settings.llm_api_key = SecretStr(key)
+        settings.llm_base_url = LITE_LLM_API_URL
         return settings
 
     @classmethod
@@ -470,12 +398,7 @@ class SaasSettingsStore(SettingsStore):
             )
 
     async def _create_user_in_lite_llm(
-        self,
-        client: httpx.AsyncClient,
-        email: str | None,
-        max_budget: int,
-        spend: int,
-        llm_model: str,
+        self, client: httpx.AsyncClient, email: str | None, max_budget: int, spend: int
     ):
         response = await client.post(
             f'{LITE_LLM_API_URL}/user/new',
@@ -490,7 +413,7 @@ class SaasSettingsStore(SettingsStore):
                 'send_invite_email': False,
                 'metadata': {
                     'version': CURRENT_USER_SETTINGS_VERSION,
-                    'model': llm_model,
+                    'model': get_default_litellm_model(),
                 },
                 'key_alias': f'OpenHands Cloud - user {self.user_id}',
             },

enterprise/storage/stored_conversation_metadata.py

@@ -1,3 +1,9 @@
+"""StoredConversationMetadata import for enterprise telemetry framework.
+
+This module provides access to the StoredConversationMetadata class from the
+main OpenHands codebase for use in enterprise telemetry collectors.
+"""
+
 from openhands.app_server.app_conversation.sql_app_conversation_info_service import (
     StoredConversationMetadata as _StoredConversationMetadata,
 )

enterprise/sync/install_gitlab_webhooks.py

@@ -1,15 +1,9 @@
 import asyncio
 from typing import cast
+from uuid import uuid4
 
-from integrations.gitlab.webhook_installation import (
-    BreakLoopException,
-    install_webhook_on_resource,
-    verify_webhook_conditions,
-)
 from integrations.types import GitLabResourceType
 from integrations.utils import GITLAB_WEBHOOK_URL
-from sqlalchemy import text
-from storage.database import a_session_maker
 from storage.gitlab_webhook import GitlabWebhook, WebhookStatus
 from storage.gitlab_webhook_store import GitlabWebhookStore
 
@@ -18,6 +12,20 @@ from openhands.integrations.gitlab.gitlab_service import GitLabServiceImpl
 from openhands.integrations.service_types import GitService
 
 CHUNK_SIZE = 100
+WEBHOOK_NAME = 'OpenHands Resolver'
+SCOPES: list[str] = [
+    'note_events',
+    'merge_requests_events',
+    'confidential_issues_events',
+    'issues_events',
+    'confidential_note_events',
+    'job_events',
+    'pipeline_events',
+]
+
+
+class BreakLoopException(Exception):
+    pass
 
 
 class VerifyWebhookStatus:
@@ -33,6 +41,77 @@ class VerifyWebhookStatus:
         if status == WebhookStatus.RATE_LIMITED:
             raise BreakLoopException()
 
+    async def check_if_resource_exists(
+        self,
+        gitlab_service: type[GitService],
+        resource_type: GitLabResourceType,
+        resource_id: str,
+        webhook_store: GitlabWebhookStore,
+        webhook: GitlabWebhook,
+    ):
+        """
+        Check if the GitLab resource still exists
+        """
+        from integrations.gitlab.gitlab_service import SaaSGitLabService
+
+        gitlab_service = cast(type[SaaSGitLabService], gitlab_service)
+
+        does_resource_exist, status = await gitlab_service.check_resource_exists(
+            resource_type, resource_id
+        )
+
+        logger.info(
+            'Does resource exists',
+            extra={
+                'does_resource_exist': does_resource_exist,
+                'status': status,
+                'resource_id': resource_id,
+                'resource_type': resource_type,
+            },
+        )
+
+        self.determine_if_rate_limited(status)
+        if not does_resource_exist and status != WebhookStatus.RATE_LIMITED:
+            await webhook_store.delete_webhook(webhook)
+            raise BreakLoopException()
+
+    async def check_if_user_has_admin_acccess_to_resource(
+        self,
+        gitlab_service: type[GitService],
+        resource_type: GitLabResourceType,
+        resource_id: str,
+        webhook_store: GitlabWebhookStore,
+        webhook: GitlabWebhook,
+    ):
+        """
+        Check is user still has permission to resource
+        """
+        from integrations.gitlab.gitlab_service import SaaSGitLabService
+
+        gitlab_service = cast(type[SaaSGitLabService], gitlab_service)
+
+        (
+            is_user_admin_of_resource,
+            status,
+        ) = await gitlab_service.check_user_has_admin_access_to_resource(
+            resource_type, resource_id
+        )
+
+        logger.info(
+            'Is user admin',
+            extra={
+                'is_user_admin': is_user_admin_of_resource,
+                'status': status,
+                'resource_id': resource_id,
+                'resource_type': resource_type,
+            },
+        )
+
+        self.determine_if_rate_limited(status)
+        if not is_user_admin_of_resource:
+            await webhook_store.delete_webhook(webhook)
+            raise BreakLoopException()
+
     async def check_if_webhook_already_exists_on_resource(
         self,
         gitlab_service: type[GitService],
@@ -81,8 +160,23 @@ class VerifyWebhookStatus:
         webhook_store: GitlabWebhookStore,
         webhook: GitlabWebhook,
     ):
-        # Use the standalone function
-        await verify_webhook_conditions(
+        await self.check_if_resource_exists(
+            gitlab_service=gitlab_service,
+            resource_type=resource_type,
+            resource_id=resource_id,
+            webhook_store=webhook_store,
+            webhook=webhook,
+        )
+
+        await self.check_if_user_has_admin_acccess_to_resource(
+            gitlab_service=gitlab_service,
+            resource_type=resource_type,
+            resource_id=resource_id,
+            webhook_store=webhook_store,
+            webhook=webhook,
+        )
+
+        await self.check_if_webhook_already_exists_on_resource(
             gitlab_service=gitlab_service,
             resource_type=resource_type,
             resource_id=resource_id,
@@ -101,15 +195,51 @@ class VerifyWebhookStatus:
         """
         Install webhook on resource
         """
-        # Use the standalone function
-        await install_webhook_on_resource(
-            gitlab_service=gitlab_service,
+        from integrations.gitlab.gitlab_service import SaaSGitLabService
+
+        gitlab_service = cast(type[SaaSGitLabService], gitlab_service)
+
+        webhook_secret = f'{webhook.user_id}-{str(uuid4())}'
+        webhook_uuid = f'{str(uuid4())}'
+
+        webhook_id, status = await gitlab_service.install_webhook(
             resource_type=resource_type,
             resource_id=resource_id,
-            webhook_store=webhook_store,
-            webhook=webhook,
+            webhook_name=WEBHOOK_NAME,
+            webhook_url=GITLAB_WEBHOOK_URL,
+            webhook_secret=webhook_secret,
+            webhook_uuid=webhook_uuid,
+            scopes=SCOPES,
         )
 
+        logger.info(
+            'Creating new webhook',
+            extra={
+                'webhook_id': webhook_id,
+                'status': status,
+                'resource_id': resource_id,
+                'resource_type': resource_type,
+            },
+        )
+
+        self.determine_if_rate_limited(status)
+
+        if webhook_id:
+            await webhook_store.update_webhook(
+                webhook=webhook,
+                update_fields={
+                    'webhook_secret': webhook_secret,
+                    'webhook_exists': True,  # webhook was created
+                    'webhook_url': GITLAB_WEBHOOK_URL,
+                    'scopes': SCOPES,
+                    'webhook_uuid': webhook_uuid,  # required to identify which webhook installation is sending payload
+                },
+            )
+
+            logger.info(
+                f'Installed webhook for {webhook.user_id} on {resource_type}:{resource_id}'
+            )
+
     async def install_webhooks(self):
         """
         Periodically check the conditions for installing a webhook on resource as valid
@@ -128,25 +258,6 @@ class VerifyWebhookStatus:
 
         from integrations.gitlab.gitlab_service import SaaSGitLabService
 
-        # Check if the table exists before proceeding
-        # This handles cases where the CronJob runs before database migrations complete
-        async with a_session_maker() as session:
-            query = text("""
-                SELECT EXISTS (
-                    SELECT FROM information_schema.tables
-                    WHERE table_name = 'gitlab_webhook'
-                )
-            """)
-            result = await session.execute(query)
-            table_exists = result.scalar() or False
-
-        if not table_exists:
-            logger.info(
-                'gitlab_webhook table does not exist yet, '
-                'waiting for database migrations to complete'
-            )
-            return
-
         # Get an instance of the webhook store
         webhook_store = await GitlabWebhookStore.get_instance()
 

enterprise/telemetry/__init__.py

@@ -0,0 +1,17 @@
+"""OpenHands Enterprise Telemetry Collection Framework.
+
+This package provides a pluggable metrics collection framework that allows
+developers to easily define and register custom metrics collectors for the
+OpenHands Enterprise Telemetry Service.
+"""
+
+from .base_collector import MetricResult, MetricsCollector
+from .registry import CollectorRegistry, collector_registry, register_collector
+
+__all__ = [
+    'MetricResult',
+    'MetricsCollector',
+    'CollectorRegistry',
+    'register_collector',
+    'collector_registry',
+]

enterprise/telemetry/base_collector.py

@@ -0,0 +1,79 @@
+"""Base collector interface for the OpenHands Enterprise Telemetry Framework.
+
+This module defines the abstract base class that all metrics collectors must inherit from,
+providing a consistent interface for the collection system.
+"""
+
+from abc import ABC, abstractmethod
+from dataclasses import dataclass
+from typing import Any, List
+
+
+@dataclass
+class MetricResult:
+    """Represents a single metric result from a collector.
+
+    Attributes:
+        key: The metric name/identifier
+        value: The metric value (can be any JSON-serializable type)
+    """
+
+    key: str
+    value: Any
+
+    def __post_init__(self):
+        """Validate the metric result after initialization."""
+        if not isinstance(self.key, str) or not self.key.strip():
+            raise ValueError('Metric key must be a non-empty string')
+
+
+class MetricsCollector(ABC):
+    """Abstract base class for metrics collectors.
+
+    All metrics collectors must inherit from this class and implement the required
+    abstract methods. This ensures a consistent interface for the collection system.
+    """
+
+    @abstractmethod
+    def collect(self) -> List[MetricResult]:
+        """Collect metrics and return results.
+
+        This method should perform the actual metrics collection logic and return
+        a list of MetricResult objects representing the collected metrics.
+
+        Returns:
+            List of MetricResult objects containing the collected metrics
+
+        Raises:
+            Exception: If collection fails, the exception will be caught and logged
+                      by the collection system
+        """
+        pass
+
+    @property
+    @abstractmethod
+    def collector_name(self) -> str:
+        """Unique name for this collector.
+
+        This name is used for identification in logs and registry management.
+        It should be unique across all collectors in the system.
+
+        Returns:
+            A unique string identifier for this collector
+        """
+        pass
+
+    def should_collect(self) -> bool:
+        """Determine if this collector should run during the current collection cycle.
+
+        Override this method to add collection conditions (e.g., time-based collection,
+        conditional collection based on system state, etc.).
+
+        Returns:
+            True if the collector should run, False otherwise
+        """
+        return True
+
+    def __repr__(self) -> str:
+        """String representation of the collector."""
+        return f"<{self.__class__.__name__}(name='{self.collector_name}')>"

enterprise/telemetry/collectors/__init__.py

@@ -0,0 +1,5 @@
+"""Example collectors for the OpenHands Enterprise Telemetry Framework.
+
+This package contains example implementations of metrics collectors that demonstrate
+how to use the telemetry collection framework.
+"""

enterprise/telemetry/collectors/health_check.py

@@ -0,0 +1,110 @@
+"""Health check metrics collector for OpenHands Enterprise Telemetry.
+
+This collector provides basic health and operational status metrics that can
+help identify system issues and monitor overall installation health.
+"""
+
+import logging
+import os
+import platform
+import time
+from datetime import UTC, datetime
+from typing import List
+
+from storage.database import session_maker
+from telemetry.base_collector import MetricResult, MetricsCollector
+from telemetry.registry import register_collector
+
+logger = logging.getLogger(__name__)
+
+
+@register_collector('health_check')
+class HealthCheckCollector(MetricsCollector):
+    """Collects basic health and operational status metrics.
+
+    This collector provides system health indicators and operational
+    metrics that can help identify issues and monitor installation status.
+    """
+
+    _start_time: float = time.time()
+
+    @property
+    def collector_name(self) -> str:
+        """Return the unique name for this collector."""
+        return 'health_check'
+
+    def collect(self) -> List[MetricResult]:
+        """Collect health check metrics.
+
+        Returns:
+            List of MetricResult objects containing health metrics
+        """
+        results = []
+
+        try:
+            # Collection timestamp
+            results.append(
+                MetricResult(
+                    key='collection_timestamp', value=datetime.now(UTC).isoformat()
+                )
+            )
+
+            # System information
+            results.append(MetricResult(key='platform_system', value=platform.system()))
+
+            results.append(
+                MetricResult(key='platform_release', value=platform.release())
+            )
+
+            results.append(
+                MetricResult(key='python_version', value=platform.python_version())
+            )
+
+            # Database connectivity check
+            db_healthy = self._check_database_health()
+            results.append(MetricResult(key='database_healthy', value=db_healthy))
+
+            # Environment indicators (without exposing sensitive data)
+            results.append(
+                MetricResult(
+                    key='has_github_app_config',
+                    value=bool(os.getenv('GITHUB_APP_CLIENT_ID')),
+                )
+            )
+
+            results.append(
+                MetricResult(
+                    key='has_keycloak_config',
+                    value=bool(os.getenv('KEYCLOAK_SERVER_URL')),
+                )
+            )
+
+            # Uptime approximation (time since this collector was first loaded)
+            uptime_seconds = int(time.time() - self.__class__._start_time)
+            results.append(
+                MetricResult(key='collector_uptime_seconds', value=uptime_seconds)
+            )
+
+            logger.info(f'Collected {len(results)} health check metrics')
+
+        except Exception as e:
+            logger.error(f'Failed to collect health check metrics: {e}')
+            # Add an error metric instead of failing completely
+            results.append(MetricResult(key='health_check_error', value=str(e)))
+
+        return results
+
+    def _check_database_health(self) -> bool:
+        """Check if the database is accessible and healthy.
+
+        Returns:
+            True if database is healthy, False otherwise
+        """
+        try:
+            with session_maker() as session:
+                # Simple query to test database connectivity
+                session.execute('SELECT 1')
+                return True
+        except Exception as e:
+            logger.warning(f'Database health check failed: {e}')
+            return False

enterprise/telemetry/collectors/system_metrics.py

@@ -0,0 +1,101 @@
+"""System metrics collector for OpenHands Enterprise Telemetry.
+
+This collector gathers basic system and usage metrics including user counts,
+conversation statistics, and system health indicators.
+"""
+
+import logging
+from datetime import UTC, datetime, timedelta
+from typing import List
+
+from storage.database import session_maker
+from storage.minimal_conversation_metadata import StoredConversationMetadata
+from storage.user_settings import UserSettings
+from telemetry.base_collector import MetricResult, MetricsCollector
+from telemetry.registry import register_collector
+
+logger = logging.getLogger(__name__)
+
+
+@register_collector('system_metrics')
+class SystemMetricsCollector(MetricsCollector):
+    """Collects basic system and usage metrics.
+
+    This collector provides essential metrics about the OpenHands Enterprise
+    installation including user counts, conversation activity, and system usage.
+    """
+
+    @property
+    def collector_name(self) -> str:
+        """Return the unique name for this collector."""
+        return 'system_metrics'
+
+    def collect(self) -> List[MetricResult]:
+        """Collect system metrics from the database.
+
+        Returns:
+            List of MetricResult objects containing system metrics
+        """
+        results = []
+
+        try:
+            with session_maker() as session:
+                # Collect total user count
+                total_users = session.query(UserSettings).count()
+                results.append(MetricResult(key='total_users', value=total_users))
+
+                # Collect active users (users who have accepted ToS)
+                active_users = (
+                    session.query(UserSettings)
+                    .filter(UserSettings.accepted_tos.isnot(None))
+                    .count()
+                )
+                results.append(MetricResult(key='active_users', value=active_users))
+
+                # Collect total conversations
+                total_conversations = session.query(StoredConversationMetadata).count()
+                results.append(
+                    MetricResult(key='total_conversations', value=total_conversations)
+                )
+
+                # Collect conversations in the last 30 days
+                thirty_days_ago = datetime.now(UTC) - timedelta(days=30)
+                recent_conversations = (
+                    session.query(StoredConversationMetadata)
+                    .filter(StoredConversationMetadata.created_at >= thirty_days_ago)
+                    .count()
+                )
+                results.append(
+                    MetricResult(key='conversations_30d', value=recent_conversations)
+                )
+
+                # Collect conversations in the last 7 days
+                seven_days_ago = datetime.now(UTC) - timedelta(days=7)
+                weekly_conversations = (
+                    session.query(StoredConversationMetadata)
+                    .filter(StoredConversationMetadata.created_at >= seven_days_ago)
+                    .count()
+                )
+                results.append(
+                    MetricResult(key='conversations_7d', value=weekly_conversations)
+                )
+
+                # Collect unique active users in the last 30 days
+                active_users_30d = (
+                    session.query(StoredConversationMetadata.user_id)
+                    .filter(StoredConversationMetadata.created_at >= thirty_days_ago)
+                    .distinct()
+                    .count()
+                )
+                results.append(
+                    MetricResult(key='active_users_30d', value=active_users_30d)
+                )
+
+                logger.info(f'Collected {len(results)} system metrics')
+
+        except Exception as e:
+            logger.error(f'Failed to collect system metrics: {e}')
+            # Re-raise the exception so the collection system can handle it
+            raise
+
+        return results

enterprise/telemetry/collectors/user_activity.py

@@ -0,0 +1,206 @@
+"""User activity metrics collector for OpenHands Enterprise Telemetry.
+
+This collector gathers detailed user activity and engagement metrics including
+conversation patterns, feature usage, and user behavior analytics.
+"""
+
+import logging
+from datetime import UTC, datetime, timedelta
+from typing import List
+
+from sqlalchemy import func
+from storage.database import session_maker
+from storage.minimal_conversation_metadata import StoredConversationMetadata
+from storage.user_settings import UserSettings
+from telemetry.base_collector import MetricResult, MetricsCollector
+from telemetry.registry import register_collector
+
+logger = logging.getLogger(__name__)
+
+
+@register_collector('user_activity')
+class UserActivityCollector(MetricsCollector):
+    """Collects detailed user activity and engagement metrics.
+
+    This collector provides insights into how users are engaging with
+    OpenHands Enterprise, including conversation patterns, feature usage,
+    and user behavior analytics.
+    """
+
+    @property
+    def collector_name(self) -> str:
+        """Return the unique name for this collector."""
+        return 'user_activity'
+
+    def collect(self) -> List[MetricResult]:
+        """Collect user activity metrics from the database.
+
+        Returns:
+            List of MetricResult objects containing user activity metrics
+        """
+        results = []
+
+        try:
+            with session_maker() as session:
+                # Calculate time boundaries
+                now = datetime.now(UTC)
+                thirty_days_ago = now - timedelta(days=30)
+
+                # Average conversations per active user (30 days)
+                active_users_30d = (
+                    session.query(StoredConversationMetadata.user_id)
+                    .filter(StoredConversationMetadata.created_at >= thirty_days_ago)
+                    .distinct()
+                    .count()
+                )
+
+                conversations_30d = (
+                    session.query(StoredConversationMetadata)
+                    .filter(StoredConversationMetadata.created_at >= thirty_days_ago)
+                    .count()
+                )
+
+                avg_conversations_per_user = (
+                    conversations_30d / active_users_30d if active_users_30d > 0 else 0
+                )
+                results.append(
+                    MetricResult(
+                        key='avg_conversations_per_user_30d',
+                        value=round(avg_conversations_per_user, 2),
+                    )
+                )
+
+                # Most popular LLM models (top 5)
+                model_usage = (
+                    session.query(
+                        StoredConversationMetadata.llm_model,
+                        func.count(StoredConversationMetadata.llm_model).label('count'),
+                    )
+                    .filter(StoredConversationMetadata.created_at >= thirty_days_ago)
+                    .filter(StoredConversationMetadata.llm_model.isnot(None))
+                    .group_by(StoredConversationMetadata.llm_model)
+                    .order_by(func.count(StoredConversationMetadata.llm_model).desc())
+                    .limit(5)
+                    .all()
+                )
+
+                model_stats = {}
+                for model, count in model_usage:
+                    # Clean up model names for telemetry
+                    clean_model = (
+                        model.replace('/', '_').replace('-', '_')
+                        if model
+                        else 'unknown'
+                    )
+                    model_stats[f'model_usage_{clean_model}'] = count
+
+                for key, value in model_stats.items():
+                    results.append(MetricResult(key=key, value=value))
+
+                # Git provider usage
+                provider_usage = (
+                    session.query(
+                        StoredConversationMetadata.git_provider,
+                        func.count(StoredConversationMetadata.git_provider).label(
+                            'count'
+                        ),
+                    )
+                    .filter(StoredConversationMetadata.created_at >= thirty_days_ago)
+                    .filter(StoredConversationMetadata.git_provider.isnot(None))
+                    .group_by(StoredConversationMetadata.git_provider)
+                    .all()
+                )
+
+                for provider, count in provider_usage:
+                    clean_provider = (
+                        provider.lower().replace(' ', '_') if provider else 'unknown'
+                    )
+                    results.append(
+                        MetricResult(key=f'git_provider_{clean_provider}', value=count)
+                    )
+
+                # Conversation trigger types
+                trigger_usage = (
+                    session.query(
+                        StoredConversationMetadata.trigger,
+                        func.count(StoredConversationMetadata.trigger).label('count'),
+                    )
+                    .filter(StoredConversationMetadata.created_at >= thirty_days_ago)
+                    .filter(StoredConversationMetadata.trigger.isnot(None))
+                    .group_by(StoredConversationMetadata.trigger)
+                    .all()
+                )
+
+                for trigger, count in trigger_usage:
+                    clean_trigger = (
+                        trigger.lower().replace(' ', '_') if trigger else 'unknown'
+                    )
+                    results.append(
+                        MetricResult(key=f'trigger_{clean_trigger}', value=count)
+                    )
+
+                # User engagement metrics
+                # Users with multiple conversations (indicates engagement)
+                engaged_users = (
+                    session.query(StoredConversationMetadata.user_id)
+                    .filter(StoredConversationMetadata.created_at >= thirty_days_ago)
+                    .group_by(StoredConversationMetadata.user_id)
+                    .having(func.count(StoredConversationMetadata.conversation_id) > 1)
+                    .count()
+                )
+
+                results.append(
+                    MetricResult(key='engaged_users_30d', value=engaged_users)
+                )
+
+                # Average token usage per conversation (30 days)
+                token_stats = (
+                    session.query(
+                        func.avg(StoredConversationMetadata.total_tokens).label(
+                            'avg_tokens'
+                        ),
+                        func.sum(StoredConversationMetadata.total_tokens).label(
+                            'total_tokens'
+                        ),
+                    )
+                    .filter(StoredConversationMetadata.created_at >= thirty_days_ago)
+                    .filter(StoredConversationMetadata.total_tokens > 0)
+                    .first()
+                )
+
+                if token_stats and token_stats.avg_tokens:
+                    results.append(
+                        MetricResult(
+                            key='avg_tokens_per_conversation_30d',
+                            value=int(token_stats.avg_tokens),
+                        )
+                    )
+                    results.append(
+                        MetricResult(
+                            key='total_tokens_30d',
+                            value=int(token_stats.total_tokens or 0),
+                        )
+                    )
+
+                # Users with analytics consent
+                analytics_consent_users = (
+                    session.query(UserSettings)
+                    .filter(UserSettings.user_consents_to_analytics)
+                    .count()
+                )
+
+                results.append(
+                    MetricResult(
+                        key='users_with_analytics_consent',
+                        value=analytics_consent_users,
+                    )
+                )
+
+                logger.info(f'Collected {len(results)} user activity metrics')
+
+        except Exception as e:
+            logger.error(f'Failed to collect user activity metrics: {e}')
+            # Re-raise the exception so the collection system can handle it
+            raise
+
+        return results

enterprise/telemetry/registry.py

@@ -0,0 +1,235 @@
+"""Collector registry for automatic discovery and management of metrics collectors.
+
+This module provides the registry system that allows collectors to be automatically
+discovered and executed by the collection system using the @register_collector decorator.
+"""
+
+import importlib
+import logging
+import pkgutil
+from typing import Dict, List, Type
+
+from .base_collector import MetricsCollector
+
+logger = logging.getLogger(__name__)
+
+
+class CollectorRegistry:
+    """Registry for metrics collectors.
+
+    This class maintains a registry of all metrics collectors that have been
+    registered using the @register_collector decorator. It provides methods
+    to retrieve collectors and discover them automatically.
+    """
+
+    def __init__(self):
+        """Initialize an empty collector registry."""
+        self._collectors: Dict[str, Type[MetricsCollector]] = {}
+
+    def register(self, collector_class: Type[MetricsCollector]) -> None:
+        """Register a collector class.
+
+        Args:
+            collector_class: The collector class to register
+
+        Raises:
+            ValueError: If the collector name is already registered
+            TypeError: If the collector class doesn't inherit from MetricsCollector
+        """
+        if not issubclass(collector_class, MetricsCollector):
+            raise TypeError(
+                f'Collector class {collector_class.__name__} must inherit from MetricsCollector'
+            )
+
+        # Create a temporary instance to get the collector name
+        try:
+            collector_instance = collector_class()
+            collector_name = collector_instance.collector_name
+        except Exception as e:
+            raise ValueError(
+                f'Failed to instantiate collector {collector_class.__name__}: {e}'
+            ) from e
+
+        if collector_name in self._collectors:
+            existing_class = self._collectors[collector_name]
+            if existing_class != collector_class:
+                raise ValueError(
+                    f"Collector name '{collector_name}' is already registered "
+                    f'by {existing_class.__name__}'
+                )
+            # Same class being registered again - this is OK (e.g., during testing)
+            logger.debug(f"Collector '{collector_name}' already registered, skipping")
+            return
+
+        self._collectors[collector_name] = collector_class
+        logger.info(f'Registered collector: {collector_name}')
+
+    def get_all_collectors(self) -> List[MetricsCollector]:
+        """Get instances of all registered collectors.
+
+        Returns:
+            List of instantiated collector objects
+
+        Raises:
+            Exception: If any collector fails to instantiate, it will be logged
+                      and excluded from the returned list
+        """
+        collectors = []
+        for name, collector_class in self._collectors.items():
+            try:
+                collector = collector_class()
+                collectors.append(collector)
+            except Exception as e:
+                logger.error(f"Failed to instantiate collector '{name}': {e}")
+                # Continue with other collectors rather than failing completely
+
+        return collectors
+
+    def get_collector_by_name(self, name: str) -> MetricsCollector:
+        """Get a specific collector by name.
+
+        Args:
+            name: The collector name to retrieve
+
+        Returns:
+            An instance of the requested collector
+
+        Raises:
+            KeyError: If no collector with the given name is registered
+            Exception: If the collector fails to instantiate
+        """
+        if name not in self._collectors:
+            raise KeyError(f"No collector registered with name '{name}'")
+
+        collector_class = self._collectors[name]
+        return collector_class()
+
+    def list_collector_names(self) -> List[str]:
+        """Get a list of all registered collector names.
+
+        Returns:
+            List of collector names
+        """
+        return list(self._collectors.keys())
+
+    def unregister(self, name: str) -> bool:
+        """Unregister a collector by name.
+
+        This is primarily useful for testing scenarios.
+
+        Args:
+            name: The collector name to unregister
+
+        Returns:
+            True if the collector was unregistered, False if it wasn't found
+        """
+        if name in self._collectors:
+            del self._collectors[name]
+            logger.info(f'Unregistered collector: {name}')
+            return True
+        return False
+
+    def clear(self) -> None:
+        """Clear all registered collectors.
+
+        This is primarily useful for testing scenarios.
+        """
+        count = len(self._collectors)
+        self._collectors.clear()
+        logger.info(f'Cleared {count} registered collectors')
+
+    def discover_collectors(self, package_path: str) -> int:
+        """Auto-discover collectors in a package.
+
+        This method will import all modules in the specified package path,
+        which will trigger the @register_collector decorators to register
+        their collectors.
+
+        Args:
+            package_path: Python package path to scan (e.g., 'enterprise.telemetry.collectors')
+
+        Returns:
+            Number of new collectors discovered and registered
+
+        Raises:
+            ImportError: If the package cannot be imported
+        """
+        initial_count = len(self._collectors)
+
+        try:
+            package = importlib.import_module(package_path)
+        except ImportError as e:
+            logger.error(f"Failed to import package '{package_path}': {e}")
+            raise
+
+        # Import all submodules in the package
+        if hasattr(package, '__path__'):
+            for _, module_name, _ in pkgutil.iter_modules(package.__path__):
+                full_module_name = f'{package_path}.{module_name}'
+                try:
+                    importlib.import_module(full_module_name)
+                    logger.debug(f'Imported module: {full_module_name}')
+                except Exception as e:
+                    logger.error(f"Failed to import module '{full_module_name}': {e}")
+
+        new_count = len(self._collectors) - initial_count
+        logger.info(
+            f"Discovered {new_count} new collectors in package '{package_path}'"
+        )
+        return new_count
+
+    def __len__(self) -> int:
+        """Return the number of registered collectors."""
+        return len(self._collectors)
+
+    def __repr__(self) -> str:
+        """String representation of the registry."""
+        return f'<CollectorRegistry(collectors={len(self._collectors)})>'
+
+
+# Global registry instance
+collector_registry = CollectorRegistry()
+
+
+def register_collector(name: str):
+    """Decorator to register a collector.
+
+    This decorator automatically registers a collector class with the global
+    collector registry when the module is imported.
+
+    Args:
+        name: The name to register the collector under (optional, will use
+              collector_name property if not provided)
+
+    Returns:
+        The decorator function
+
+    Example:
+        @register_collector("system_metrics")
+        class SystemMetricsCollector(MetricsCollector):
+            @property
+            def collector_name(self) -> str:
+                return "system_metrics"
+
+            def collect(self) -> List[MetricResult]:
+                return [MetricResult("cpu_usage", 75.5)]
+    """
+
+    def decorator(cls: Type[MetricsCollector]) -> Type[MetricsCollector]:
+        """The actual decorator function.
+
+        Args:
+            cls: The collector class to register
+
+        Returns:
+            The original class (unchanged)
+        """
+        try:
+            collector_registry.register(cls)
+        except Exception as e:
+            logger.error(f'Failed to register collector {cls.__name__}: {e}')
+            # Don't raise the exception to avoid breaking module imports
+
+        return cls
+
+    return decorator

enterprise/tests/unit/conftest.py

@@ -16,7 +16,7 @@ from storage.device_code import DeviceCode  # noqa: F401
 from storage.feedback import Feedback
 from storage.github_app_installation import GithubAppInstallation
 from storage.maintenance_task import MaintenanceTask, MaintenanceTaskStatus
-from storage.stored_conversation_metadata import StoredConversationMetadata
+from storage.minimal_conversation_metadata import StoredConversationMetadata
 from storage.stored_offline_token import StoredOfflineToken
 from storage.stripe_customer import StripeCustomer
 from storage.user_settings import UserSettings

enterprise/tests/unit/integrations/gitlab/test_gitlab_service.py

@@ -1,204 +0,0 @@
-"""Unit tests for SaaSGitLabService."""
-
-from unittest.mock import patch
-
-import pytest
-from integrations.gitlab.gitlab_service import SaaSGitLabService
-
-
-@pytest.fixture
-def gitlab_service():
-    """Create a SaaSGitLabService instance for testing."""
-    return SaaSGitLabService(external_auth_id='test_user_id')
-
-
-class TestGetUserResourcesWithAdminAccess:
-    """Test cases for get_user_resources_with_admin_access method."""
-
-    @pytest.mark.asyncio
-    async def test_get_resources_single_page_projects_and_groups(self, gitlab_service):
-        """Test fetching resources when all data fits in a single page."""
-        # Arrange
-        mock_projects = [
-            {'id': 1, 'name': 'Project 1'},
-            {'id': 2, 'name': 'Project 2'},
-        ]
-        mock_groups = [
-            {'id': 10, 'name': 'Group 1'},
-        ]
-
-        with patch.object(gitlab_service, '_make_request') as mock_request:
-            # First call for projects, second for groups
-            mock_request.side_effect = [
-                (mock_projects, {'Link': ''}),  # No next page
-                (mock_groups, {'Link': ''}),  # No next page
-            ]
-
-            # Act
-            (
-                projects,
-                groups,
-            ) = await gitlab_service.get_user_resources_with_admin_access()
-
-            # Assert
-            assert len(projects) == 2
-            assert len(groups) == 1
-            assert projects[0]['id'] == 1
-            assert projects[1]['id'] == 2
-            assert groups[0]['id'] == 10
-            assert mock_request.call_count == 2
-
-    @pytest.mark.asyncio
-    async def test_get_resources_multiple_pages_projects(self, gitlab_service):
-        """Test fetching projects across multiple pages."""
-        # Arrange
-        page1_projects = [{'id': i, 'name': f'Project {i}'} for i in range(1, 101)]
-        page2_projects = [{'id': i, 'name': f'Project {i}'} for i in range(101, 151)]
-
-        with patch.object(gitlab_service, '_make_request') as mock_request:
-            mock_request.side_effect = [
-                (page1_projects, {'Link': '<url>; rel="next"'}),  # Has next page
-                (page2_projects, {'Link': ''}),  # Last page
-                ([], {'Link': ''}),  # Groups (empty)
-            ]
-
-            # Act
-            (
-                projects,
-                groups,
-            ) = await gitlab_service.get_user_resources_with_admin_access()
-
-            # Assert
-            assert len(projects) == 150
-            assert len(groups) == 0
-            assert mock_request.call_count == 3
-
-    @pytest.mark.asyncio
-    async def test_get_resources_multiple_pages_groups(self, gitlab_service):
-        """Test fetching groups across multiple pages."""
-        # Arrange
-        page1_groups = [{'id': i, 'name': f'Group {i}'} for i in range(1, 101)]
-        page2_groups = [{'id': i, 'name': f'Group {i}'} for i in range(101, 151)]
-
-        with patch.object(gitlab_service, '_make_request') as mock_request:
-            mock_request.side_effect = [
-                ([], {'Link': ''}),  # Projects (empty)
-                (page1_groups, {'Link': '<url>; rel="next"'}),  # Has next page
-                (page2_groups, {'Link': ''}),  # Last page
-            ]
-
-            # Act
-            (
-                projects,
-                groups,
-            ) = await gitlab_service.get_user_resources_with_admin_access()
-
-            # Assert
-            assert len(projects) == 0
-            assert len(groups) == 150
-            assert mock_request.call_count == 3
-
-    @pytest.mark.asyncio
-    async def test_get_resources_empty_response(self, gitlab_service):
-        """Test when user has no projects or groups with admin access."""
-        # Arrange
-        with patch.object(gitlab_service, '_make_request') as mock_request:
-            mock_request.side_effect = [
-                ([], {'Link': ''}),  # No projects
-                ([], {'Link': ''}),  # No groups
-            ]
-
-            # Act
-            (
-                projects,
-                groups,
-            ) = await gitlab_service.get_user_resources_with_admin_access()
-
-            # Assert
-            assert len(projects) == 0
-            assert len(groups) == 0
-            assert mock_request.call_count == 2
-
-    @pytest.mark.asyncio
-    async def test_get_resources_uses_correct_params_for_projects(self, gitlab_service):
-        """Test that projects API is called with correct parameters."""
-        # Arrange
-        with patch.object(gitlab_service, '_make_request') as mock_request:
-            mock_request.side_effect = [
-                ([], {'Link': ''}),  # Projects
-                ([], {'Link': ''}),  # Groups
-            ]
-
-            # Act
-            await gitlab_service.get_user_resources_with_admin_access()
-
-            # Assert
-            # Check first call (projects)
-            first_call = mock_request.call_args_list[0]
-            assert 'projects' in first_call[0][0]
-            assert first_call[0][1]['membership'] == 1
-            assert first_call[0][1]['min_access_level'] == 40
-            assert first_call[0][1]['per_page'] == '100'
-
-    @pytest.mark.asyncio
-    async def test_get_resources_uses_correct_params_for_groups(self, gitlab_service):
-        """Test that groups API is called with correct parameters."""
-        # Arrange
-        with patch.object(gitlab_service, '_make_request') as mock_request:
-            mock_request.side_effect = [
-                ([], {'Link': ''}),  # Projects
-                ([], {'Link': ''}),  # Groups
-            ]
-
-            # Act
-            await gitlab_service.get_user_resources_with_admin_access()
-
-            # Assert
-            # Check second call (groups)
-            second_call = mock_request.call_args_list[1]
-            assert 'groups' in second_call[0][0]
-            assert second_call[0][1]['min_access_level'] == 40
-            assert second_call[0][1]['top_level_only'] == 'true'
-            assert second_call[0][1]['per_page'] == '100'
-
-    @pytest.mark.asyncio
-    async def test_get_resources_handles_api_error_gracefully(self, gitlab_service):
-        """Test that API errors are handled gracefully and don't crash."""
-        # Arrange
-        with patch.object(gitlab_service, '_make_request') as mock_request:
-            # First call succeeds, second call fails
-            mock_request.side_effect = [
-                ([{'id': 1, 'name': 'Project 1'}], {'Link': ''}),
-                Exception('API Error'),
-            ]
-
-            # Act
-            (
-                projects,
-                groups,
-            ) = await gitlab_service.get_user_resources_with_admin_access()
-
-            # Assert
-            # Should return what was fetched before the error
-            assert len(projects) == 1
-            assert len(groups) == 0
-
-    @pytest.mark.asyncio
-    async def test_get_resources_stops_on_empty_response(self, gitlab_service):
-        """Test that pagination stops when API returns empty response."""
-        # Arrange
-        with patch.object(gitlab_service, '_make_request') as mock_request:
-            mock_request.side_effect = [
-                (None, {'Link': ''}),  # Empty response stops pagination
-                ([], {'Link': ''}),  # Groups
-            ]
-
-            # Act
-            (
-                projects,
-                groups,
-            ) = await gitlab_service.get_user_resources_with_admin_access()
-
-            # Assert
-            assert len(projects) == 0
-            assert mock_request.call_count == 2  # Should not continue pagination

enterprise/tests/unit/integrations/jira/test_jira_manager.py

@@ -18,11 +18,7 @@ from integrations.jira.jira_view import (
 from integrations.models import Message, SourceType
 
 from openhands.integrations.service_types import ProviderType, Repository
-from openhands.server.types import (
-    LLMAuthenticationError,
-    MissingSettingsError,
-    SessionExpiredError,
-)
+from openhands.server.types import LLMAuthenticationError, MissingSettingsError
 
 
 class TestJiraManagerInit:
@@ -736,32 +732,6 @@ class TestStartJob:
         call_args = jira_manager.send_message.call_args[0]
         assert 'valid LLM API key' in call_args[0].message
 
-    @pytest.mark.asyncio
-    async def test_start_job_session_expired_error(
-        self, jira_manager, sample_jira_workspace
-    ):
-        """Test job start with session expired error."""
-        mock_view = MagicMock(spec=JiraNewConversationView)
-        mock_view.jira_user = MagicMock()
-        mock_view.jira_user.keycloak_user_id = 'test_user'
-        mock_view.job_context = MagicMock()
-        mock_view.job_context.issue_key = 'PROJ-123'
-        mock_view.jira_workspace = sample_jira_workspace
-        mock_view.create_or_update_conversation = AsyncMock(
-            side_effect=SessionExpiredError('Session expired')
-        )
-
-        jira_manager.send_message = AsyncMock()
-        jira_manager.token_manager.decrypt_text.return_value = 'decrypted_key'
-
-        await jira_manager.start_job(mock_view)
-
-        # Should send error message about session expired
-        jira_manager.send_message.assert_called_once()
-        call_args = jira_manager.send_message.call_args[0]
-        assert 'session has expired' in call_args[0].message
-        assert 'login again' in call_args[0].message
-
     @pytest.mark.asyncio
     async def test_start_job_unexpected_error(
         self, jira_manager, sample_jira_workspace

enterprise/tests/unit/integrations/jira_dc/test_jira_dc_manager.py

@@ -18,11 +18,7 @@ from integrations.jira_dc.jira_dc_view import (
 from integrations.models import Message, SourceType
 
 from openhands.integrations.service_types import ProviderType, Repository
-from openhands.server.types import (
-    LLMAuthenticationError,
-    MissingSettingsError,
-    SessionExpiredError,
-)
+from openhands.server.types import LLMAuthenticationError, MissingSettingsError
 
 
 class TestJiraDcManagerInit:
@@ -765,32 +761,6 @@ class TestStartJob:
         call_args = jira_dc_manager.send_message.call_args[0]
         assert 'valid LLM API key' in call_args[0].message
 
-    @pytest.mark.asyncio
-    async def test_start_job_session_expired_error(
-        self, jira_dc_manager, sample_jira_dc_workspace
-    ):
-        """Test job start with session expired error."""
-        mock_view = MagicMock(spec=JiraDcNewConversationView)
-        mock_view.jira_dc_user = MagicMock()
-        mock_view.jira_dc_user.keycloak_user_id = 'test_user'
-        mock_view.job_context = MagicMock()
-        mock_view.job_context.issue_key = 'PROJ-123'
-        mock_view.jira_dc_workspace = sample_jira_dc_workspace
-        mock_view.create_or_update_conversation = AsyncMock(
-            side_effect=SessionExpiredError('Session expired')
-        )
-
-        jira_dc_manager.send_message = AsyncMock()
-        jira_dc_manager.token_manager.decrypt_text.return_value = 'decrypted_key'
-
-        await jira_dc_manager.start_job(mock_view)
-
-        # Should send error message about session expired
-        jira_dc_manager.send_message.assert_called_once()
-        call_args = jira_dc_manager.send_message.call_args[0]
-        assert 'session has expired' in call_args[0].message
-        assert 'login again' in call_args[0].message
-
     @pytest.mark.asyncio
     async def test_start_job_unexpected_error(
         self, jira_dc_manager, sample_jira_dc_workspace

enterprise/tests/unit/integrations/linear/test_linear_manager.py

@@ -18,11 +18,7 @@ from integrations.linear.linear_view import (
 from integrations.models import Message, SourceType
 
 from openhands.integrations.service_types import ProviderType, Repository
-from openhands.server.types import (
-    LLMAuthenticationError,
-    MissingSettingsError,
-    SessionExpiredError,
-)
+from openhands.server.types import LLMAuthenticationError, MissingSettingsError
 
 
 class TestLinearManagerInit:
@@ -830,33 +826,6 @@ class TestStartJob:
         call_args = linear_manager.send_message.call_args[0]
         assert 'valid LLM API key' in call_args[0].message
 
-    @pytest.mark.asyncio
-    async def test_start_job_session_expired_error(
-        self, linear_manager, sample_linear_workspace
-    ):
-        """Test job start with session expired error."""
-        mock_view = MagicMock(spec=LinearNewConversationView)
-        mock_view.linear_user = MagicMock()
-        mock_view.linear_user.keycloak_user_id = 'test_user'
-        mock_view.job_context = MagicMock()
-        mock_view.job_context.issue_key = 'TEST-123'
-        mock_view.job_context.issue_id = 'issue_id'
-        mock_view.linear_workspace = sample_linear_workspace
-        mock_view.create_or_update_conversation = AsyncMock(
-            side_effect=SessionExpiredError('Session expired')
-        )
-
-        linear_manager.send_message = AsyncMock()
-        linear_manager.token_manager.decrypt_text.return_value = 'decrypted_key'
-
-        await linear_manager.start_job(mock_view)
-
-        # Should send error message about session expired
-        linear_manager.send_message.assert_called_once()
-        call_args = linear_manager.send_message.call_args[0]
-        assert 'session has expired' in call_args[0].message
-        assert 'login again' in call_args[0].message
-
     @pytest.mark.asyncio
     async def test_start_job_unexpected_error(
         self, linear_manager, sample_linear_workspace

enterprise/tests/unit/integrations/test_utils.py

@@ -1,14 +1,7 @@
 """Tests for enterprise integrations utils module."""
 
-from unittest.mock import patch
-
 import pytest
-from integrations.utils import (
-    HOST_URL,
-    append_conversation_footer,
-    get_session_expired_message,
-    get_summary_for_agent_state,
-)
+from integrations.utils import get_summary_for_agent_state
 
 from openhands.core.schema.agent import AgentState
 from openhands.events.observation.agent import AgentStateChangedObservation
@@ -164,200 +157,3 @@ class TestGetSummaryForAgentState:
         assert 'try again later' in result.lower()
         # RATE_LIMITED doesn't include conversation link in response
         assert self.conversation_link not in result
-
-
-class TestGetSessionExpiredMessage:
-    """Test cases for get_session_expired_message function."""
-
-    def test_message_with_username_contains_at_prefix(self):
-        """Test that the message contains the username with @ prefix."""
-        result = get_session_expired_message('testuser')
-        assert '@testuser' in result
-
-    def test_message_with_username_contains_session_expired_text(self):
-        """Test that the message contains session expired text."""
-        result = get_session_expired_message('testuser')
-        assert 'session has expired' in result
-
-    def test_message_with_username_contains_login_instruction(self):
-        """Test that the message contains login instruction."""
-        result = get_session_expired_message('testuser')
-        assert 'login again' in result
-
-    def test_message_with_username_contains_host_url(self):
-        """Test that the message contains the OpenHands Cloud URL."""
-        result = get_session_expired_message('testuser')
-        assert HOST_URL in result
-        assert 'OpenHands Cloud' in result
-
-    def test_different_usernames(self):
-        """Test that different usernames produce different messages."""
-        result1 = get_session_expired_message('user1')
-        result2 = get_session_expired_message('user2')
-        assert '@user1' in result1
-        assert '@user2' in result2
-        assert '@user1' not in result2
-        assert '@user2' not in result1
-
-    def test_message_without_username_contains_session_expired_text(self):
-        """Test that the message without username contains session expired text."""
-        result = get_session_expired_message()
-        assert 'session has expired' in result
-
-    def test_message_without_username_contains_login_instruction(self):
-        """Test that the message without username contains login instruction."""
-        result = get_session_expired_message()
-        assert 'login again' in result
-
-    def test_message_without_username_contains_host_url(self):
-        """Test that the message without username contains the OpenHands Cloud URL."""
-        result = get_session_expired_message()
-        assert HOST_URL in result
-        assert 'OpenHands Cloud' in result
-
-    def test_message_without_username_does_not_contain_at_prefix(self):
-        """Test that the message without username does not contain @ prefix."""
-        result = get_session_expired_message()
-        assert not result.startswith('@')
-        assert 'Your session' in result
-
-    def test_message_with_none_username(self):
-        """Test that passing None explicitly works the same as no argument."""
-        result = get_session_expired_message(None)
-        assert not result.startswith('@')
-        assert 'Your session' in result
-
-
-class TestAppendConversationFooter:
-    """Test cases for append_conversation_footer function."""
-
-    @patch(
-        'integrations.utils.CONVERSATION_URL', 'https://example.com/conversations/{}'
-    )
-    def test_appends_footer_with_markdown_link(self):
-        """Test that footer is appended with correct markdown link format."""
-        # Arrange
-        message = 'This is a test message'
-        conversation_id = 'test-conv-123'
-
-        # Act
-        result = append_conversation_footer(message, conversation_id)
-
-        # Assert
-        assert result.startswith(message)
-        assert (
-            '[View full conversation](https://example.com/conversations/test-conv-123)'
-            in result
-        )
-        assert result.endswith(
-            '[View full conversation](https://example.com/conversations/test-conv-123)'
-        )
-
-    @patch(
-        'integrations.utils.CONVERSATION_URL', 'https://example.com/conversations/{}'
-    )
-    def test_footer_does_not_contain_html_tags(self):
-        """Test that footer does not contain HTML tags like <sub>."""
-        # Arrange
-        message = 'Test message'
-        conversation_id = 'test-conv-456'
-
-        # Act
-        result = append_conversation_footer(message, conversation_id)
-
-        # Assert
-        assert '<sub>' not in result
-        assert '</sub>' not in result
-
-    @patch(
-        'integrations.utils.CONVERSATION_URL', 'https://example.com/conversations/{}'
-    )
-    def test_footer_format_with_newlines(self):
-        """Test that footer is properly separated with newlines."""
-        # Arrange
-        message = 'Original message content'
-        conversation_id = 'test-conv-789'
-
-        # Act
-        result = append_conversation_footer(message, conversation_id)
-
-        # Assert
-        assert (
-            result
-            == 'Original message content\n\n[View full conversation](https://example.com/conversations/test-conv-789)'
-        )
-
-    @patch(
-        'integrations.utils.CONVERSATION_URL', 'https://example.com/conversations/{}'
-    )
-    def test_empty_message_still_appends_footer(self):
-        """Test that footer is appended even when message is empty."""
-        # Arrange
-        message = ''
-        conversation_id = 'empty-msg-conv'
-
-        # Act
-        result = append_conversation_footer(message, conversation_id)
-
-        # Assert
-        assert result.startswith('\n\n')
-        assert (
-            '[View full conversation](https://example.com/conversations/empty-msg-conv)'
-            in result
-        )
-
-    @patch(
-        'integrations.utils.CONVERSATION_URL', 'https://example.com/conversations/{}'
-    )
-    def test_conversation_id_with_special_characters(self):
-        """Test that footer handles conversation IDs with special characters."""
-        # Arrange
-        message = 'Test message'
-        conversation_id = 'conv-123_abc-456'
-
-        # Act
-        result = append_conversation_footer(message, conversation_id)
-
-        # Assert
-        expected_url = 'https://example.com/conversations/conv-123_abc-456'
-        assert expected_url in result
-        assert '[View full conversation]' in result
-
-    @patch(
-        'integrations.utils.CONVERSATION_URL', 'https://example.com/conversations/{}'
-    )
-    def test_multiline_message_preserves_content(self):
-        """Test that multiline messages are preserved correctly."""
-        # Arrange
-        message = 'Line 1\nLine 2\nLine 3'
-        conversation_id = 'multiline-conv'
-
-        # Act
-        result = append_conversation_footer(message, conversation_id)
-
-        # Assert
-        assert result.startswith('Line 1\nLine 2\nLine 3')
-        assert '\n\n[View full conversation]' in result
-        assert message in result
-
-    @patch(
-        'integrations.utils.CONVERSATION_URL', 'https://example.com/conversations/{}'
-    )
-    def test_footer_contains_only_markdown_syntax(self):
-        """Test that footer uses only markdown syntax, not HTML."""
-        # Arrange
-        message = 'Test message'
-        conversation_id = 'markdown-test'
-
-        # Act
-        result = append_conversation_footer(message, conversation_id)
-
-        # Assert
-        footer_part = result[len(message) :]
-        # Should only contain markdown link syntax: [text](url)
-        assert footer_part.startswith('\n\n[')
-        assert '](' in footer_part
-        assert footer_part.endswith(')')
-        # Should not contain any HTML tags (specifically <sub> tags that were removed)
-        assert '<sub>' not in footer_part
-        assert '</sub>' not in footer_part

enterprise/tests/unit/server/routes/test_api_keys.py

@@ -1,330 +0,0 @@
-"""Unit tests for API keys routes, focusing on BYOR key validation and retrieval."""
-
-from unittest.mock import AsyncMock, MagicMock, patch
-
-import httpx
-import pytest
-from fastapi import HTTPException
-from server.routes.api_keys import (
-    get_llm_api_key_for_byor,
-    verify_byor_key_in_litellm,
-)
-
-
-class TestVerifyByorKeyInLitellm:
-    """Test the verify_byor_key_in_litellm function."""
-
-    @pytest.mark.asyncio
-    @patch('server.routes.api_keys.LITE_LLM_API_URL', 'https://litellm.example.com')
-    @patch('server.routes.api_keys.httpx.AsyncClient')
-    async def test_verify_valid_key_returns_true(self, mock_client_class):
-        """Test that a valid key (200 response) returns True."""
-        # Arrange
-        byor_key = 'sk-valid-key-123'
-        user_id = 'user-123'
-        mock_response = MagicMock()
-        mock_response.status_code = 200
-        mock_response.is_success = True
-        mock_client = AsyncMock()
-        mock_client.__aenter__.return_value = mock_client
-        mock_client.__aexit__.return_value = None
-        mock_client.get.return_value = mock_response
-        mock_client_class.return_value = mock_client
-
-        # Act
-        result = await verify_byor_key_in_litellm(byor_key, user_id)
-
-        # Assert
-        assert result is True
-        mock_client.get.assert_called_once_with(
-            'https://litellm.example.com/v1/models',
-            headers={'Authorization': f'Bearer {byor_key}'},
-        )
-
-    @pytest.mark.asyncio
-    @patch('server.routes.api_keys.LITE_LLM_API_URL', 'https://litellm.example.com')
-    @patch('server.routes.api_keys.httpx.AsyncClient')
-    async def test_verify_invalid_key_401_returns_false(self, mock_client_class):
-        """Test that an invalid key (401 response) returns False."""
-        # Arrange
-        byor_key = 'sk-invalid-key-123'
-        user_id = 'user-123'
-        mock_response = MagicMock()
-        mock_response.status_code = 401
-        mock_client = AsyncMock()
-        mock_client.__aenter__.return_value = mock_client
-        mock_client.__aexit__.return_value = None
-        mock_client.get.return_value = mock_response
-        mock_client_class.return_value = mock_client
-
-        # Act
-        result = await verify_byor_key_in_litellm(byor_key, user_id)
-
-        # Assert
-        assert result is False
-
-    @pytest.mark.asyncio
-    @patch('server.routes.api_keys.LITE_LLM_API_URL', 'https://litellm.example.com')
-    @patch('server.routes.api_keys.httpx.AsyncClient')
-    async def test_verify_invalid_key_403_returns_false(self, mock_client_class):
-        """Test that an invalid key (403 response) returns False."""
-        # Arrange
-        byor_key = 'sk-forbidden-key-123'
-        user_id = 'user-123'
-        mock_response = MagicMock()
-        mock_response.status_code = 403
-        mock_client = AsyncMock()
-        mock_client.__aenter__.return_value = mock_client
-        mock_client.__aexit__.return_value = None
-        mock_client.get.return_value = mock_response
-        mock_client_class.return_value = mock_client
-
-        # Act
-        result = await verify_byor_key_in_litellm(byor_key, user_id)
-
-        # Assert
-        assert result is False
-
-    @pytest.mark.asyncio
-    @patch('server.routes.api_keys.LITE_LLM_API_URL', 'https://litellm.example.com')
-    @patch('server.routes.api_keys.httpx.AsyncClient')
-    async def test_verify_server_error_returns_false(self, mock_client_class):
-        """Test that a server error (500) returns False to ensure key validity."""
-        # Arrange
-        byor_key = 'sk-key-123'
-        user_id = 'user-123'
-        mock_response = MagicMock()
-        mock_response.status_code = 500
-        mock_response.is_success = False
-        mock_client = AsyncMock()
-        mock_client.__aenter__.return_value = mock_client
-        mock_client.__aexit__.return_value = None
-        mock_client.get.return_value = mock_response
-        mock_client_class.return_value = mock_client
-
-        # Act
-        result = await verify_byor_key_in_litellm(byor_key, user_id)
-
-        # Assert
-        assert result is False
-
-    @pytest.mark.asyncio
-    @patch('server.routes.api_keys.LITE_LLM_API_URL', 'https://litellm.example.com')
-    @patch('server.routes.api_keys.httpx.AsyncClient')
-    async def test_verify_timeout_returns_false(self, mock_client_class):
-        """Test that a timeout returns False to ensure key validity."""
-        # Arrange
-        byor_key = 'sk-key-123'
-        user_id = 'user-123'
-        mock_client = AsyncMock()
-        mock_client.__aenter__.return_value = mock_client
-        mock_client.__aexit__.return_value = None
-        mock_client.get.side_effect = httpx.TimeoutException('Request timed out')
-        mock_client_class.return_value = mock_client
-
-        # Act
-        result = await verify_byor_key_in_litellm(byor_key, user_id)
-
-        # Assert
-        assert result is False
-
-    @pytest.mark.asyncio
-    @patch('server.routes.api_keys.LITE_LLM_API_URL', 'https://litellm.example.com')
-    @patch('server.routes.api_keys.httpx.AsyncClient')
-    async def test_verify_network_error_returns_false(self, mock_client_class):
-        """Test that a network error returns False to ensure key validity."""
-        # Arrange
-        byor_key = 'sk-key-123'
-        user_id = 'user-123'
-        mock_client = AsyncMock()
-        mock_client.__aenter__.return_value = mock_client
-        mock_client.__aexit__.return_value = None
-        mock_client.get.side_effect = httpx.NetworkError('Network error')
-        mock_client_class.return_value = mock_client
-
-        # Act
-        result = await verify_byor_key_in_litellm(byor_key, user_id)
-
-        # Assert
-        assert result is False
-
-    @pytest.mark.asyncio
-    @patch('server.routes.api_keys.LITE_LLM_API_URL', None)
-    async def test_verify_missing_api_url_returns_false(self):
-        """Test that missing LITE_LLM_API_URL returns False."""
-        # Arrange
-        byor_key = 'sk-key-123'
-        user_id = 'user-123'
-
-        # Act
-        result = await verify_byor_key_in_litellm(byor_key, user_id)
-
-        # Assert
-        assert result is False
-
-    @pytest.mark.asyncio
-    @patch('server.routes.api_keys.LITE_LLM_API_URL', 'https://litellm.example.com')
-    async def test_verify_empty_key_returns_false(self):
-        """Test that empty key returns False."""
-        # Arrange
-        byor_key = ''
-        user_id = 'user-123'
-
-        # Act
-        result = await verify_byor_key_in_litellm(byor_key, user_id)
-
-        # Assert
-        assert result is False
-
-
-class TestGetLlmApiKeyForByor:
-    """Test the get_llm_api_key_for_byor endpoint."""
-
-    @pytest.mark.asyncio
-    @patch('server.routes.api_keys.store_byor_key_in_db')
-    @patch('server.routes.api_keys.generate_byor_key')
-    @patch('server.routes.api_keys.get_byor_key_from_db')
-    async def test_no_key_in_database_generates_new(
-        self, mock_get_key, mock_generate_key, mock_store_key
-    ):
-        """Test that when no key exists in database, a new one is generated."""
-        # Arrange
-        user_id = 'user-123'
-        new_key = 'sk-new-generated-key'
-        mock_get_key.return_value = None
-        mock_generate_key.return_value = new_key
-        mock_store_key.return_value = None
-
-        # Act
-        result = await get_llm_api_key_for_byor(user_id=user_id)
-
-        # Assert
-        assert result == {'key': new_key}
-        mock_get_key.assert_called_once_with(user_id)
-        mock_generate_key.assert_called_once_with(user_id)
-        mock_store_key.assert_called_once_with(user_id, new_key)
-
-    @pytest.mark.asyncio
-    @patch('server.routes.api_keys.verify_byor_key_in_litellm')
-    @patch('server.routes.api_keys.get_byor_key_from_db')
-    async def test_valid_key_in_database_returns_key(
-        self, mock_get_key, mock_verify_key
-    ):
-        """Test that when a valid key exists in database, it is returned."""
-        # Arrange
-        user_id = 'user-123'
-        existing_key = 'sk-existing-valid-key'
-        mock_get_key.return_value = existing_key
-        mock_verify_key.return_value = True
-
-        # Act
-        result = await get_llm_api_key_for_byor(user_id=user_id)
-
-        # Assert
-        assert result == {'key': existing_key}
-        mock_get_key.assert_called_once_with(user_id)
-        mock_verify_key.assert_called_once_with(existing_key, user_id)
-
-    @pytest.mark.asyncio
-    @patch('server.routes.api_keys.store_byor_key_in_db')
-    @patch('server.routes.api_keys.generate_byor_key')
-    @patch('server.routes.api_keys.delete_byor_key_from_litellm')
-    @patch('server.routes.api_keys.verify_byor_key_in_litellm')
-    @patch('server.routes.api_keys.get_byor_key_from_db')
-    async def test_invalid_key_in_database_regenerates(
-        self,
-        mock_get_key,
-        mock_verify_key,
-        mock_delete_key,
-        mock_generate_key,
-        mock_store_key,
-    ):
-        """Test that when an invalid key exists in database, it is regenerated."""
-        # Arrange
-        user_id = 'user-123'
-        invalid_key = 'sk-invalid-key'
-        new_key = 'sk-new-generated-key'
-        mock_get_key.return_value = invalid_key
-        mock_verify_key.return_value = False
-        mock_delete_key.return_value = True
-        mock_generate_key.return_value = new_key
-        mock_store_key.return_value = None
-
-        # Act
-        result = await get_llm_api_key_for_byor(user_id=user_id)
-
-        # Assert
-        assert result == {'key': new_key}
-        mock_get_key.assert_called_once_with(user_id)
-        mock_verify_key.assert_called_once_with(invalid_key, user_id)
-        mock_delete_key.assert_called_once_with(user_id, invalid_key)
-        mock_generate_key.assert_called_once_with(user_id)
-        mock_store_key.assert_called_once_with(user_id, new_key)
-
-    @pytest.mark.asyncio
-    @patch('server.routes.api_keys.store_byor_key_in_db')
-    @patch('server.routes.api_keys.generate_byor_key')
-    @patch('server.routes.api_keys.delete_byor_key_from_litellm')
-    @patch('server.routes.api_keys.verify_byor_key_in_litellm')
-    @patch('server.routes.api_keys.get_byor_key_from_db')
-    async def test_invalid_key_deletion_failure_still_regenerates(
-        self,
-        mock_get_key,
-        mock_verify_key,
-        mock_delete_key,
-        mock_generate_key,
-        mock_store_key,
-    ):
-        """Test that even if deletion fails, regeneration still proceeds."""
-        # Arrange
-        user_id = 'user-123'
-        invalid_key = 'sk-invalid-key'
-        new_key = 'sk-new-generated-key'
-        mock_get_key.return_value = invalid_key
-        mock_verify_key.return_value = False
-        mock_delete_key.return_value = False  # Deletion fails
-        mock_generate_key.return_value = new_key
-        mock_store_key.return_value = None
-
-        # Act
-        result = await get_llm_api_key_for_byor(user_id=user_id)
-
-        # Assert
-        assert result == {'key': new_key}
-        mock_delete_key.assert_called_once_with(user_id, invalid_key)
-        mock_generate_key.assert_called_once_with(user_id)
-        mock_store_key.assert_called_once_with(user_id, new_key)
-
-    @pytest.mark.asyncio
-    @patch('server.routes.api_keys.generate_byor_key')
-    @patch('server.routes.api_keys.get_byor_key_from_db')
-    async def test_key_generation_failure_raises_exception(
-        self, mock_get_key, mock_generate_key
-    ):
-        """Test that when key generation fails, an HTTPException is raised."""
-        # Arrange
-        user_id = 'user-123'
-        mock_get_key.return_value = None
-        mock_generate_key.return_value = None
-
-        # Act & Assert
-        with pytest.raises(HTTPException) as exc_info:
-            await get_llm_api_key_for_byor(user_id=user_id)
-
-        assert exc_info.value.status_code == 500
-        assert 'Failed to generate new BYOR LLM API key' in exc_info.value.detail
-
-    @pytest.mark.asyncio
-    @patch('server.routes.api_keys.get_byor_key_from_db')
-    async def test_database_error_raises_exception(self, mock_get_key):
-        """Test that database errors are properly handled."""
-        # Arrange
-        user_id = 'user-123'
-        mock_get_key.side_effect = Exception('Database connection error')
-
-        # Act & Assert
-        with pytest.raises(HTTPException) as exc_info:
-            await get_llm_api_key_for_byor(user_id=user_id)
-
-        assert exc_info.value.status_code == 500
-        assert 'Failed to retrieve BYOR LLM API key' in exc_info.value.detail

enterprise/tests/unit/server/routes/test_email_routes.py

@@ -1,361 +0,0 @@
-from unittest.mock import AsyncMock, MagicMock, patch
-
-import pytest
-from fastapi import HTTPException, Request, status
-from fastapi.responses import JSONResponse, RedirectResponse
-from pydantic import SecretStr
-from server.auth.saas_user_auth import SaasUserAuth
-from server.routes.email import (
-    ResendEmailVerificationRequest,
-    resend_email_verification,
-    verified_email,
-    verify_email,
-)
-
-
-@pytest.fixture
-def mock_request():
-    """Create a mock request object."""
-    request = MagicMock(spec=Request)
-    request.url = MagicMock()
-    request.url.hostname = 'localhost'
-    request.url.netloc = 'localhost:8000'
-    request.url.path = '/api/email/verified'
-    request.base_url = 'http://localhost:8000/'
-    request.headers = {}
-    request.cookies = {}
-    request.query_params = MagicMock()
-    return request
-
-
-@pytest.fixture
-def mock_user_auth():
-    """Create a mock SaasUserAuth object."""
-    auth = MagicMock(spec=SaasUserAuth)
-    auth.access_token = SecretStr('test_access_token')
-    auth.refresh_token = SecretStr('test_refresh_token')
-    auth.email = 'test@example.com'
-    auth.email_verified = False
-    auth.accepted_tos = True
-    auth.refresh = AsyncMock()
-    return auth
-
-
-@pytest.mark.asyncio
-async def test_verify_email_default_behavior(mock_request):
-    """Test verify_email with default is_auth_flow=False."""
-    # Arrange
-    user_id = 'test_user_id'
-    mock_keycloak_admin = AsyncMock()
-    mock_keycloak_admin.a_send_verify_email = AsyncMock()
-
-    # Act
-    with patch(
-        'server.routes.email.get_keycloak_admin', return_value=mock_keycloak_admin
-    ):
-        await verify_email(request=mock_request, user_id=user_id)
-
-    # Assert
-    mock_keycloak_admin.a_send_verify_email.assert_called_once()
-    call_args = mock_keycloak_admin.a_send_verify_email.call_args
-    assert call_args.kwargs['user_id'] == user_id
-    assert (
-        call_args.kwargs['redirect_uri'] == 'http://localhost:8000/api/email/verified'
-    )
-    assert 'client_id' in call_args.kwargs
-
-
-@pytest.mark.asyncio
-async def test_verify_email_with_auth_flow(mock_request):
-    """Test verify_email with is_auth_flow=True."""
-    # Arrange
-    user_id = 'test_user_id'
-    mock_keycloak_admin = AsyncMock()
-    mock_keycloak_admin.a_send_verify_email = AsyncMock()
-
-    # Act
-    with patch(
-        'server.routes.email.get_keycloak_admin', return_value=mock_keycloak_admin
-    ):
-        await verify_email(request=mock_request, user_id=user_id, is_auth_flow=True)
-
-    # Assert
-    mock_keycloak_admin.a_send_verify_email.assert_called_once()
-    call_args = mock_keycloak_admin.a_send_verify_email.call_args
-    assert call_args.kwargs['user_id'] == user_id
-    assert (
-        call_args.kwargs['redirect_uri'] == 'http://localhost:8000?email_verified=true'
-    )
-    assert 'client_id' in call_args.kwargs
-
-
-@pytest.mark.asyncio
-async def test_verify_email_https_scheme(mock_request):
-    """Test verify_email uses https scheme for non-localhost hosts."""
-    # Arrange
-    user_id = 'test_user_id'
-    mock_request.url.hostname = 'example.com'
-    mock_request.url.netloc = 'example.com'
-    mock_keycloak_admin = AsyncMock()
-    mock_keycloak_admin.a_send_verify_email = AsyncMock()
-
-    # Act
-    with patch(
-        'server.routes.email.get_keycloak_admin', return_value=mock_keycloak_admin
-    ):
-        await verify_email(request=mock_request, user_id=user_id, is_auth_flow=True)
-
-    # Assert
-    call_args = mock_keycloak_admin.a_send_verify_email.call_args
-    assert call_args.kwargs['redirect_uri'].startswith('https://')
-
-
-@pytest.mark.asyncio
-async def test_verified_email_default_redirect(mock_request, mock_user_auth):
-    """Test verified_email redirects to /settings/user by default."""
-    # Arrange
-    mock_request.query_params.get.return_value = None
-
-    # Act
-    with (
-        patch('server.routes.email.get_user_auth', return_value=mock_user_auth),
-        patch('server.routes.email.set_response_cookie') as mock_set_cookie,
-    ):
-        result = await verified_email(mock_request)
-
-    # Assert
-    assert isinstance(result, RedirectResponse)
-    assert result.status_code == 302
-    assert result.headers['location'] == 'http://localhost:8000/settings/user'
-    mock_user_auth.refresh.assert_called_once()
-    mock_set_cookie.assert_called_once()
-    assert mock_user_auth.email_verified is True
-
-
-@pytest.mark.asyncio
-async def test_verified_email_https_scheme(mock_request, mock_user_auth):
-    """Test verified_email uses https scheme for non-localhost hosts."""
-    # Arrange
-    mock_request.url.hostname = 'example.com'
-    mock_request.url.netloc = 'example.com'
-    mock_request.query_params.get.return_value = None
-
-    # Act
-    with (
-        patch('server.routes.email.get_user_auth', return_value=mock_user_auth),
-        patch('server.routes.email.set_response_cookie') as mock_set_cookie,
-    ):
-        result = await verified_email(mock_request)
-
-    # Assert
-    assert isinstance(result, RedirectResponse)
-    assert result.headers['location'].startswith('https://')
-    mock_set_cookie.assert_called_once()
-    # Verify secure flag is True for https
-    call_kwargs = mock_set_cookie.call_args.kwargs
-    assert call_kwargs['secure'] is True
-
-
-@pytest.mark.asyncio
-async def test_resend_email_verification_with_user_id_from_body_succeeds(mock_request):
-    """Test resend_email_verification succeeds when user_id is provided in body."""
-    # Arrange
-    user_id = 'test_user_id'
-    body = ResendEmailVerificationRequest(user_id=user_id, is_auth_flow=False)
-    mock_keycloak_admin = AsyncMock()
-    mock_keycloak_admin.a_send_verify_email = AsyncMock()
-
-    with (
-        patch('server.routes.email.check_rate_limit_by_user_id') as mock_rate_limit,
-        patch(
-            'server.routes.email.get_keycloak_admin', return_value=mock_keycloak_admin
-        ),
-        patch('server.routes.email.logger') as mock_logger,
-    ):
-        mock_rate_limit.return_value = None  # Rate limit check passes
-
-        # Act
-        result = await resend_email_verification(request=mock_request, body=body)
-
-        # Assert
-        assert isinstance(result, JSONResponse)
-        assert result.status_code == status.HTTP_200_OK
-        assert 'message' in result.body.decode()
-        mock_rate_limit.assert_called_once_with(
-            request=mock_request,
-            key_prefix='email_resend',
-            user_id=user_id,
-            user_rate_limit_seconds=30,
-            ip_rate_limit_seconds=60,
-        )
-        mock_keycloak_admin.a_send_verify_email.assert_called_once()
-        # Logger is called multiple times (verify_email and resend_email_verification)
-        # Check that the resend message was logged
-        assert any(
-            'Resending verification email for' in str(call)
-            for call in mock_logger.info.call_args_list
-        )
-
-
-@pytest.mark.asyncio
-async def test_resend_email_verification_with_user_id_from_auth_succeeds(mock_request):
-    """Test resend_email_verification succeeds when user_id comes from authentication."""
-    # Arrange
-    user_id = 'test_user_id'
-    mock_keycloak_admin = AsyncMock()
-    mock_keycloak_admin.a_send_verify_email = AsyncMock()
-
-    with (
-        patch(
-            'server.routes.email.get_user_id', return_value=user_id
-        ) as mock_get_user_id,
-        patch('server.routes.email.check_rate_limit_by_user_id') as mock_rate_limit,
-        patch(
-            'server.routes.email.get_keycloak_admin', return_value=mock_keycloak_admin
-        ),
-    ):
-        mock_rate_limit.return_value = None  # Rate limit check passes
-
-        # Act
-        result = await resend_email_verification(request=mock_request, body=None)
-
-        # Assert
-        assert isinstance(result, JSONResponse)
-        assert result.status_code == status.HTTP_200_OK
-        mock_get_user_id.assert_called_once_with(mock_request)
-        mock_rate_limit.assert_called_once_with(
-            request=mock_request,
-            key_prefix='email_resend',
-            user_id=user_id,
-            user_rate_limit_seconds=30,
-            ip_rate_limit_seconds=60,
-        )
-
-
-@pytest.mark.asyncio
-async def test_resend_email_verification_without_user_id_returns_400(mock_request):
-    """Test resend_email_verification returns 400 when user_id is not available."""
-    # Arrange
-    with patch(
-        'server.routes.email.get_user_id', side_effect=Exception('Not authenticated')
-    ):
-        # Act & Assert
-        with pytest.raises(HTTPException) as exc_info:
-            await resend_email_verification(request=mock_request, body=None)
-
-        assert exc_info.value.status_code == status.HTTP_400_BAD_REQUEST
-        assert 'user_id is required' in exc_info.value.detail
-
-
-@pytest.mark.asyncio
-async def test_resend_email_verification_rate_limit_exceeded_returns_429(mock_request):
-    """Test resend_email_verification returns 429 when rate limit is exceeded."""
-    # Arrange
-    user_id = 'test_user_id'
-    body = ResendEmailVerificationRequest(user_id=user_id)
-
-    with (
-        patch('server.routes.email.check_rate_limit_by_user_id') as mock_rate_limit,
-    ):
-        mock_rate_limit.side_effect = HTTPException(
-            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
-            detail='Too many requests. Please wait 2 minutes before trying again.',
-        )
-
-        # Act & Assert
-        with pytest.raises(HTTPException) as exc_info:
-            await resend_email_verification(request=mock_request, body=body)
-
-        assert exc_info.value.status_code == status.HTTP_429_TOO_MANY_REQUESTS
-        assert 'Too many requests' in exc_info.value.detail
-        mock_rate_limit.assert_called_once()
-
-
-@pytest.mark.asyncio
-async def test_resend_email_verification_with_is_auth_flow_true(mock_request):
-    """Test resend_email_verification passes is_auth_flow to verify_email."""
-    # Arrange
-    user_id = 'test_user_id'
-    body = ResendEmailVerificationRequest(user_id=user_id, is_auth_flow=True)
-    mock_keycloak_admin = AsyncMock()
-    mock_keycloak_admin.a_send_verify_email = AsyncMock()
-
-    with (
-        patch('server.routes.email.check_rate_limit_by_user_id') as mock_rate_limit,
-        patch(
-            'server.routes.email.get_keycloak_admin', return_value=mock_keycloak_admin
-        ),
-    ):
-        mock_rate_limit.return_value = None
-
-        # Act
-        await resend_email_verification(request=mock_request, body=body)
-
-        # Assert
-        mock_keycloak_admin.a_send_verify_email.assert_called_once()
-        call_args = mock_keycloak_admin.a_send_verify_email.call_args
-        # Verify that verify_email was called with is_auth_flow=True
-        # We check this indirectly by verifying the redirect_uri
-        assert 'email_verified=true' in call_args.kwargs['redirect_uri']
-
-
-@pytest.mark.asyncio
-async def test_resend_email_verification_with_is_auth_flow_false(mock_request):
-    """Test resend_email_verification uses default is_auth_flow=False when not specified."""
-    # Arrange
-    user_id = 'test_user_id'
-    body = ResendEmailVerificationRequest(user_id=user_id, is_auth_flow=False)
-    mock_keycloak_admin = AsyncMock()
-    mock_keycloak_admin.a_send_verify_email = AsyncMock()
-
-    with (
-        patch('server.routes.email.check_rate_limit_by_user_id') as mock_rate_limit,
-        patch(
-            'server.routes.email.get_keycloak_admin', return_value=mock_keycloak_admin
-        ),
-    ):
-        mock_rate_limit.return_value = None
-
-        # Act
-        await resend_email_verification(request=mock_request, body=body)
-
-        # Assert
-        mock_keycloak_admin.a_send_verify_email.assert_called_once()
-        call_args = mock_keycloak_admin.a_send_verify_email.call_args
-        # Verify that verify_email was called with is_auth_flow=False
-        assert '/api/email/verified' in call_args.kwargs['redirect_uri']
-
-
-@pytest.mark.asyncio
-async def test_resend_email_verification_body_none_uses_auth(mock_request):
-    """Test resend_email_verification uses auth when body is None."""
-    # Arrange
-    user_id = 'test_user_id'
-    mock_keycloak_admin = AsyncMock()
-    mock_keycloak_admin.a_send_verify_email = AsyncMock()
-
-    with (
-        patch(
-            'server.routes.email.get_user_id', return_value=user_id
-        ) as mock_get_user_id,
-        patch('server.routes.email.check_rate_limit_by_user_id') as mock_rate_limit,
-        patch(
-            'server.routes.email.get_keycloak_admin', return_value=mock_keycloak_admin
-        ),
-    ):
-        mock_rate_limit.return_value = None
-
-        # Act
-        result = await resend_email_verification(request=mock_request, body=None)
-
-        # Assert
-        assert isinstance(result, JSONResponse)
-        assert result.status_code == status.HTTP_200_OK
-        mock_get_user_id.assert_called_once()
-        mock_rate_limit.assert_called_once_with(
-            request=mock_request,
-            key_prefix='email_resend',
-            user_id=user_id,
-            user_rate_limit_seconds=30,
-            ip_rate_limit_seconds=60,
-        )

enterprise/tests/unit/server/routes/test_gitlab_integration_routes.py

@@ -1,502 +0,0 @@
-"""Unit tests for GitLab integration routes."""
-
-from unittest.mock import AsyncMock, MagicMock, patch
-
-import pytest
-from fastapi import HTTPException, status
-from integrations.gitlab.gitlab_service import SaaSGitLabService
-from integrations.gitlab.webhook_installation import BreakLoopException
-from integrations.types import GitLabResourceType
-from server.routes.integration.gitlab import (
-    ReinstallWebhookRequest,
-    ResourceIdentifier,
-    get_gitlab_resources,
-    reinstall_gitlab_webhook,
-)
-from storage.gitlab_webhook import GitlabWebhook
-
-
-@pytest.fixture
-def mock_gitlab_service():
-    """Create a mock SaaSGitLabService instance."""
-    service = MagicMock(spec=SaaSGitLabService)
-    service.get_user_resources_with_admin_access = AsyncMock(
-        return_value=(
-            [
-                {
-                    'id': 1,
-                    'name': 'Test Project',
-                    'path_with_namespace': 'user/test-project',
-                    'namespace': {'kind': 'user'},
-                },
-                {
-                    'id': 2,
-                    'name': 'Group Project',
-                    'path_with_namespace': 'group/group-project',
-                    'namespace': {'kind': 'group'},
-                },
-            ],
-            [
-                {
-                    'id': 10,
-                    'name': 'Test Group',
-                    'full_path': 'test-group',
-                },
-            ],
-        )
-    )
-    service.check_webhook_exists_on_resource = AsyncMock(return_value=(True, None))
-    service.check_user_has_admin_access_to_resource = AsyncMock(
-        return_value=(True, None)
-    )
-    return service
-
-
-@pytest.fixture
-def mock_webhook():
-    """Create a mock webhook object."""
-    webhook = MagicMock(spec=GitlabWebhook)
-    webhook.webhook_uuid = 'test-uuid'
-    webhook.last_synced = None
-    return webhook
-
-
-class TestGetGitLabResources:
-    """Test cases for get_gitlab_resources endpoint."""
-
-    @pytest.mark.asyncio
-    @patch('server.routes.integration.gitlab.GitLabServiceImpl')
-    @patch('server.routes.integration.gitlab.webhook_store')
-    @patch('server.routes.integration.gitlab.isinstance')
-    async def test_get_resources_success(
-        self,
-        mock_isinstance,
-        mock_webhook_store,
-        mock_gitlab_service_impl,
-        mock_gitlab_service,
-    ):
-        """Test successfully retrieving GitLab resources with webhook status."""
-        # Arrange
-        user_id = 'test_user_id'
-        mock_gitlab_service_impl.return_value = mock_gitlab_service
-        mock_isinstance.return_value = True
-        mock_webhook_store.get_webhooks_by_resources = AsyncMock(
-            return_value=({}, {})  # Empty maps for simplicity
-        )
-
-        # Act
-        response = await get_gitlab_resources(user_id=user_id)
-
-        # Assert
-        assert len(response.resources) == 2  # 1 project (filtered) + 1 group
-        assert response.resources[0].type == 'project'
-        assert response.resources[0].id == '1'
-        assert response.resources[0].name == 'Test Project'
-        assert response.resources[1].type == 'group'
-        assert response.resources[1].id == '10'
-        mock_gitlab_service.get_user_resources_with_admin_access.assert_called_once()
-        mock_webhook_store.get_webhooks_by_resources.assert_called_once()
-
-    @pytest.mark.asyncio
-    @patch('server.routes.integration.gitlab.GitLabServiceImpl')
-    @patch('server.routes.integration.gitlab.webhook_store')
-    @patch('server.routes.integration.gitlab.isinstance')
-    async def test_get_resources_filters_nested_projects(
-        self,
-        mock_isinstance,
-        mock_webhook_store,
-        mock_gitlab_service_impl,
-        mock_gitlab_service,
-    ):
-        """Test that projects nested under groups are filtered out."""
-        # Arrange
-        user_id = 'test_user_id'
-        mock_gitlab_service_impl.return_value = mock_gitlab_service
-        mock_isinstance.return_value = True
-        mock_webhook_store.get_webhooks_by_resources = AsyncMock(return_value=({}, {}))
-
-        # Act
-        response = await get_gitlab_resources(user_id=user_id)
-
-        # Assert
-        # Should only include the user project, not the group project
-        project_resources = [r for r in response.resources if r.type == 'project']
-        assert len(project_resources) == 1
-        assert project_resources[0].id == '1'
-        assert project_resources[0].name == 'Test Project'
-
-    @pytest.mark.asyncio
-    @patch('server.routes.integration.gitlab.GitLabServiceImpl')
-    @patch('server.routes.integration.gitlab.webhook_store')
-    @patch('server.routes.integration.gitlab.isinstance')
-    async def test_get_resources_includes_webhook_metadata(
-        self,
-        mock_isinstance,
-        mock_webhook_store,
-        mock_gitlab_service_impl,
-        mock_gitlab_service,
-        mock_webhook,
-    ):
-        """Test that webhook metadata is included in the response."""
-        # Arrange
-        user_id = 'test_user_id'
-        mock_gitlab_service_impl.return_value = mock_gitlab_service
-        mock_isinstance.return_value = True
-        mock_webhook_store.get_webhooks_by_resources = AsyncMock(
-            return_value=({'1': mock_webhook}, {'10': mock_webhook})
-        )
-
-        # Act
-        response = await get_gitlab_resources(user_id=user_id)
-
-        # Assert
-        assert response.resources[0].webhook_uuid == 'test-uuid'
-        assert response.resources[1].webhook_uuid == 'test-uuid'
-
-    @pytest.mark.asyncio
-    @patch('server.routes.integration.gitlab.GitLabServiceImpl')
-    async def test_get_resources_non_saas_service(
-        self, mock_gitlab_service_impl, mock_gitlab_service
-    ):
-        """Test that non-SaaS GitLab service raises an error."""
-        # Arrange
-        user_id = 'test_user_id'
-        non_saas_service = AsyncMock()
-        mock_gitlab_service_impl.return_value = non_saas_service
-
-        # Act & Assert
-        with pytest.raises(HTTPException) as exc_info:
-            await get_gitlab_resources(user_id=user_id)
-
-        assert exc_info.value.status_code == status.HTTP_400_BAD_REQUEST
-        assert 'Only SaaS GitLab service is supported' in exc_info.value.detail
-
-    @pytest.mark.asyncio
-    @patch('server.routes.integration.gitlab.GitLabServiceImpl')
-    @patch('server.routes.integration.gitlab.webhook_store')
-    @patch('server.routes.integration.gitlab.isinstance')
-    async def test_get_resources_parallel_api_calls(
-        self,
-        mock_isinstance,
-        mock_webhook_store,
-        mock_gitlab_service_impl,
-        mock_gitlab_service,
-    ):
-        """Test that webhook status checks are made in parallel."""
-        # Arrange
-        user_id = 'test_user_id'
-        mock_gitlab_service_impl.return_value = mock_gitlab_service
-        mock_isinstance.return_value = True
-        mock_webhook_store.get_webhooks_by_resources = AsyncMock(return_value=({}, {}))
-        call_count = 0
-
-        async def track_calls(*args, **kwargs):
-            nonlocal call_count
-            call_count += 1
-            return (True, None)
-
-        mock_gitlab_service.check_webhook_exists_on_resource = AsyncMock(
-            side_effect=track_calls
-        )
-
-        # Act
-        await get_gitlab_resources(user_id=user_id)
-
-        # Assert
-        # Should be called for each resource (1 project + 1 group)
-        assert call_count == 2
-
-
-class TestReinstallGitLabWebhook:
-    """Test cases for reinstall_gitlab_webhook endpoint."""
-
-    @pytest.mark.asyncio
-    @patch('server.routes.integration.gitlab.install_webhook_on_resource')
-    @patch('server.routes.integration.gitlab.verify_webhook_conditions')
-    @patch('server.routes.integration.gitlab.GitLabServiceImpl')
-    @patch('server.routes.integration.gitlab.webhook_store')
-    @patch('server.routes.integration.gitlab.isinstance')
-    async def test_reinstall_webhook_success_existing_webhook(
-        self,
-        mock_isinstance,
-        mock_webhook_store,
-        mock_gitlab_service_impl,
-        mock_verify_conditions,
-        mock_install_webhook,
-        mock_gitlab_service,
-        mock_webhook,
-    ):
-        """Test successful webhook reinstallation when webhook record exists."""
-        # Arrange
-        user_id = 'test_user_id'
-        resource_id = 'project-123'
-        resource_type = GitLabResourceType.PROJECT
-
-        mock_gitlab_service_impl.return_value = mock_gitlab_service
-        mock_isinstance.return_value = True
-        mock_webhook_store.reset_webhook_for_reinstallation_by_resource = AsyncMock(
-            return_value=True
-        )
-        mock_webhook_store.get_webhook_by_resource_only = AsyncMock(
-            return_value=mock_webhook
-        )
-        mock_verify_conditions.return_value = None
-        mock_install_webhook.return_value = ('webhook-id-123', None)
-
-        body = ReinstallWebhookRequest(
-            resource=ResourceIdentifier(type=resource_type, id=resource_id)
-        )
-
-        # Act
-        result = await reinstall_gitlab_webhook(body=body, user_id=user_id)
-
-        # Assert
-        assert result.success is True
-        assert result.resource_id == resource_id
-        assert result.resource_type == resource_type.value
-        assert result.error is None
-        mock_gitlab_service.check_user_has_admin_access_to_resource.assert_called_once_with(
-            resource_type, resource_id
-        )
-        mock_webhook_store.reset_webhook_for_reinstallation_by_resource.assert_called_once_with(
-            resource_type, resource_id, user_id
-        )
-        mock_verify_conditions.assert_called_once()
-        mock_install_webhook.assert_called_once()
-
-    @pytest.mark.asyncio
-    @patch('server.routes.integration.gitlab.install_webhook_on_resource')
-    @patch('server.routes.integration.gitlab.verify_webhook_conditions')
-    @patch('server.routes.integration.gitlab.GitLabServiceImpl')
-    @patch('server.routes.integration.gitlab.webhook_store')
-    @patch('server.routes.integration.gitlab.isinstance')
-    async def test_reinstall_webhook_success_new_webhook_record(
-        self,
-        mock_isinstance,
-        mock_webhook_store,
-        mock_gitlab_service_impl,
-        mock_verify_conditions,
-        mock_install_webhook,
-        mock_gitlab_service,
-    ):
-        """Test successful webhook reinstallation when webhook record doesn't exist."""
-        # Arrange
-        user_id = 'test_user_id'
-        resource_id = 'project-456'
-        resource_type = GitLabResourceType.PROJECT
-
-        mock_gitlab_service_impl.return_value = mock_gitlab_service
-        mock_isinstance.return_value = True
-        mock_webhook_store.reset_webhook_for_reinstallation_by_resource = (
-            AsyncMock(return_value=False)  # No existing webhook to reset
-        )
-        mock_webhook_store.get_webhook_by_resource_only = AsyncMock(
-            side_effect=[
-                None,
-                MagicMock(),
-            ]  # First call returns None, second returns new webhook
-        )
-        mock_webhook_store.store_webhooks = AsyncMock()
-        mock_verify_conditions.return_value = None
-        mock_install_webhook.return_value = ('webhook-id-456', None)
-
-        body = ReinstallWebhookRequest(
-            resource=ResourceIdentifier(type=resource_type, id=resource_id)
-        )
-
-        # Act
-        result = await reinstall_gitlab_webhook(body=body, user_id=user_id)
-
-        # Assert
-        assert result.success is True
-        mock_webhook_store.store_webhooks.assert_called_once()
-        # Should fetch webhook twice: once to check, once after creating
-        assert mock_webhook_store.get_webhook_by_resource_only.call_count == 2
-
-    @pytest.mark.asyncio
-    @patch('server.routes.integration.gitlab.GitLabServiceImpl')
-    @patch('server.routes.integration.gitlab.isinstance')
-    async def test_reinstall_webhook_no_admin_access(
-        self, mock_isinstance, mock_gitlab_service_impl, mock_gitlab_service
-    ):
-        """Test reinstallation when user doesn't have admin access."""
-        # Arrange
-        user_id = 'test_user_id'
-        resource_id = 'project-789'
-        resource_type = GitLabResourceType.PROJECT
-
-        mock_gitlab_service_impl.return_value = mock_gitlab_service
-        mock_isinstance.return_value = True
-        mock_gitlab_service.check_user_has_admin_access_to_resource = AsyncMock(
-            return_value=(False, None)
-        )
-
-        body = ReinstallWebhookRequest(
-            resource=ResourceIdentifier(type=resource_type, id=resource_id)
-        )
-
-        # Act & Assert
-        with pytest.raises(HTTPException) as exc_info:
-            await reinstall_gitlab_webhook(body=body, user_id=user_id)
-
-        assert exc_info.value.status_code == status.HTTP_403_FORBIDDEN
-        assert 'does not have admin access' in exc_info.value.detail
-
-    @pytest.mark.asyncio
-    @patch('server.routes.integration.gitlab.GitLabServiceImpl')
-    async def test_reinstall_webhook_non_saas_service(self, mock_gitlab_service_impl):
-        """Test reinstallation with non-SaaS GitLab service."""
-        # Arrange
-        user_id = 'test_user_id'
-        resource_id = 'project-999'
-        resource_type = GitLabResourceType.PROJECT
-
-        non_saas_service = AsyncMock()
-        mock_gitlab_service_impl.return_value = non_saas_service
-
-        body = ReinstallWebhookRequest(
-            resource=ResourceIdentifier(type=resource_type, id=resource_id)
-        )
-
-        # Act & Assert
-        with pytest.raises(HTTPException) as exc_info:
-            await reinstall_gitlab_webhook(body=body, user_id=user_id)
-
-        assert exc_info.value.status_code == status.HTTP_400_BAD_REQUEST
-        assert 'Only SaaS GitLab service is supported' in exc_info.value.detail
-
-    @pytest.mark.asyncio
-    @patch('server.routes.integration.gitlab.install_webhook_on_resource')
-    @patch('server.routes.integration.gitlab.verify_webhook_conditions')
-    @patch('server.routes.integration.gitlab.GitLabServiceImpl')
-    @patch('server.routes.integration.gitlab.webhook_store')
-    @patch('server.routes.integration.gitlab.isinstance')
-    async def test_reinstall_webhook_conditions_not_met(
-        self,
-        mock_isinstance,
-        mock_webhook_store,
-        mock_gitlab_service_impl,
-        mock_verify_conditions,
-        mock_install_webhook,
-        mock_gitlab_service,
-        mock_webhook,
-    ):
-        """Test reinstallation when webhook conditions are not met."""
-        # Arrange
-        user_id = 'test_user_id'
-        resource_id = 'project-111'
-        resource_type = GitLabResourceType.PROJECT
-
-        mock_gitlab_service_impl.return_value = mock_gitlab_service
-        mock_isinstance.return_value = True
-        mock_webhook_store.reset_webhook_for_reinstallation_by_resource = AsyncMock(
-            return_value=True
-        )
-        mock_webhook_store.get_webhook_by_resource_only = AsyncMock(
-            return_value=mock_webhook
-        )
-        mock_verify_conditions.side_effect = BreakLoopException()
-
-        body = ReinstallWebhookRequest(
-            resource=ResourceIdentifier(type=resource_type, id=resource_id)
-        )
-
-        # Act & Assert
-        with pytest.raises(HTTPException) as exc_info:
-            await reinstall_gitlab_webhook(body=body, user_id=user_id)
-
-        assert exc_info.value.status_code == status.HTTP_400_BAD_REQUEST
-        assert 'conditions not met' in exc_info.value.detail.lower()
-        mock_install_webhook.assert_not_called()
-
-    @pytest.mark.asyncio
-    @patch('server.routes.integration.gitlab.install_webhook_on_resource')
-    @patch('server.routes.integration.gitlab.verify_webhook_conditions')
-    @patch('server.routes.integration.gitlab.GitLabServiceImpl')
-    @patch('server.routes.integration.gitlab.webhook_store')
-    @patch('server.routes.integration.gitlab.isinstance')
-    async def test_reinstall_webhook_installation_fails(
-        self,
-        mock_isinstance,
-        mock_webhook_store,
-        mock_gitlab_service_impl,
-        mock_verify_conditions,
-        mock_install_webhook,
-        mock_gitlab_service,
-        mock_webhook,
-    ):
-        """Test reinstallation when webhook installation fails."""
-        # Arrange
-        user_id = 'test_user_id'
-        resource_id = 'project-222'
-        resource_type = GitLabResourceType.PROJECT
-
-        mock_gitlab_service_impl.return_value = mock_gitlab_service
-        mock_isinstance.return_value = True
-        mock_webhook_store.reset_webhook_for_reinstallation_by_resource = AsyncMock(
-            return_value=True
-        )
-        mock_webhook_store.get_webhook_by_resource_only = AsyncMock(
-            return_value=mock_webhook
-        )
-        mock_verify_conditions.return_value = None
-        mock_install_webhook.return_value = (None, None)  # Installation failed
-
-        body = ReinstallWebhookRequest(
-            resource=ResourceIdentifier(type=resource_type, id=resource_id)
-        )
-
-        # Act & Assert
-        with pytest.raises(HTTPException) as exc_info:
-            await reinstall_gitlab_webhook(body=body, user_id=user_id)
-
-        assert exc_info.value.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
-        assert 'Failed to install webhook' in exc_info.value.detail
-
-    @pytest.mark.asyncio
-    @patch('server.routes.integration.gitlab.install_webhook_on_resource')
-    @patch('server.routes.integration.gitlab.verify_webhook_conditions')
-    @patch('server.routes.integration.gitlab.GitLabServiceImpl')
-    @patch('server.routes.integration.gitlab.webhook_store')
-    @patch('server.routes.integration.gitlab.isinstance')
-    async def test_reinstall_webhook_group_resource(
-        self,
-        mock_isinstance,
-        mock_webhook_store,
-        mock_gitlab_service_impl,
-        mock_verify_conditions,
-        mock_install_webhook,
-        mock_gitlab_service,
-        mock_webhook,
-    ):
-        """Test reinstallation for a group resource."""
-        # Arrange
-        user_id = 'test_user_id'
-        resource_id = 'group-333'
-        resource_type = GitLabResourceType.GROUP
-
-        mock_gitlab_service_impl.return_value = mock_gitlab_service
-        mock_isinstance.return_value = True
-        mock_webhook_store.reset_webhook_for_reinstallation_by_resource = AsyncMock(
-            return_value=True
-        )
-        mock_webhook_store.get_webhook_by_resource_only = AsyncMock(
-            return_value=mock_webhook
-        )
-        mock_verify_conditions.return_value = None
-        mock_install_webhook.return_value = ('webhook-id-group', None)
-
-        body = ReinstallWebhookRequest(
-            resource=ResourceIdentifier(type=resource_type, id=resource_id)
-        )
-
-        # Act
-        result = await reinstall_gitlab_webhook(body=body, user_id=user_id)
-
-        # Assert
-        assert result.success is True
-        assert result.resource_id == resource_id
-        assert result.resource_type == resource_type.value
-        mock_webhook_store.reset_webhook_for_reinstallation_by_resource.assert_called_once_with(
-            resource_type, resource_id, user_id
-        )

enterprise/tests/unit/server/test_event_webhook.py

@@ -21,7 +21,7 @@ from server.utils.conversation_callback_utils import (
     process_event,
     update_conversation_metadata,
 )
-from storage.stored_conversation_metadata import StoredConversationMetadata
+from storage.minimal_conversation_metadata import StoredConversationMetadata
 
 from openhands.events.observation.agent import AgentStateChangedObservation
 
@@ -699,11 +699,12 @@ class TestProcessBatchOperationsBackground:
             # Should not raise exceptions
             await _process_batch_operations_background(batch_ops, 'test-api-key')
 
-            # Should log the error with exception type and message in the log message
-            mock_logger.error.assert_called_once()
-            call_args = mock_logger.error.call_args
-            log_message = call_args[0][0]
-            assert log_message.startswith('error_processing_batch_operation:')
-            assert call_args[1]['extra']['path'] == 'invalid-path'
-            assert call_args[1]['extra']['method'] == 'BatchMethod.POST'
-            assert call_args[1]['exc_info'] is True
+            # Should log the error
+            mock_logger.error.assert_called_once_with(
+                'error_processing_batch_operation',
+                extra={
+                    'path': 'invalid-path',
+                    'method': 'BatchMethod.POST',
+                    'error': mock_logger.error.call_args[1]['extra']['error'],
+                },
+            )

enterprise/tests/unit/server/test_rate_limit_utils.py

@@ -1,290 +0,0 @@
-from unittest.mock import AsyncMock, MagicMock, patch
-
-import pytest
-from fastapi import HTTPException, Request, status
-from server.utils.rate_limit_utils import (
-    RATE_LIMIT_IP_SECONDS,
-    RATE_LIMIT_USER_SECONDS,
-    check_rate_limit_by_user_id,
-)
-
-
-@pytest.fixture
-def mock_request():
-    """Create a mock request object."""
-    request = MagicMock(spec=Request)
-    request.client = MagicMock()
-    request.client.host = '192.168.1.1'
-    return request
-
-
-@pytest.fixture
-def mock_redis():
-    """Create a mock Redis client."""
-    redis = AsyncMock()
-    redis.set = AsyncMock(return_value=True)  # First call succeeds (key doesn't exist)
-    return redis
-
-
-@pytest.mark.asyncio
-async def test_rate_limit_by_user_id_first_request_succeeds(mock_request, mock_redis):
-    """Test that first request with user_id succeeds and sets rate limit key."""
-    # Arrange
-    user_id = 'test_user_id'
-    key_prefix = 'email_resend'
-
-    with (
-        patch('server.utils.rate_limit_utils.sio') as mock_sio,
-        patch('server.utils.rate_limit_utils.logger') as mock_logger,
-    ):
-        mock_sio.manager.redis = mock_redis
-
-        # Act
-        await check_rate_limit_by_user_id(
-            request=mock_request, key_prefix=key_prefix, user_id=user_id
-        )
-
-        # Assert
-        mock_redis.set.assert_called_once_with(
-            f'{key_prefix}:{user_id}', 1, nx=True, ex=RATE_LIMIT_USER_SECONDS
-        )
-        mock_logger.warning.assert_not_called()
-        mock_logger.info.assert_not_called()
-
-
-@pytest.mark.asyncio
-async def test_rate_limit_by_user_id_second_request_within_window_fails(
-    mock_request, mock_redis
-):
-    """Test that second request with same user_id within rate limit window fails."""
-    # Arrange
-    user_id = 'test_user_id'
-    key_prefix = 'email_resend'
-    mock_redis.set = AsyncMock(return_value=False)  # Key already exists
-
-    with (
-        patch('server.utils.rate_limit_utils.sio') as mock_sio,
-        patch('server.utils.rate_limit_utils.logger') as mock_logger,
-    ):
-        mock_sio.manager.redis = mock_redis
-
-        # Act & Assert
-        with pytest.raises(HTTPException) as exc_info:
-            await check_rate_limit_by_user_id(
-                request=mock_request, key_prefix=key_prefix, user_id=user_id
-            )
-
-        assert exc_info.value.status_code == status.HTTP_429_TOO_MANY_REQUESTS
-        assert 'Too many requests' in exc_info.value.detail
-        assert f'{RATE_LIMIT_USER_SECONDS // 60} minutes' in exc_info.value.detail
-        mock_logger.info.assert_called_once()
-
-
-@pytest.mark.asyncio
-async def test_rate_limit_by_ip_when_user_id_is_none(mock_request, mock_redis):
-    """Test that rate limiting falls back to IP address when user_id is None."""
-    # Arrange
-    key_prefix = 'email_resend'
-
-    with (
-        patch('server.utils.rate_limit_utils.sio') as mock_sio,
-        patch('server.utils.rate_limit_utils.logger') as mock_logger,
-    ):
-        mock_sio.manager.redis = mock_redis
-
-        # Act
-        await check_rate_limit_by_user_id(
-            request=mock_request, key_prefix=key_prefix, user_id=None
-        )
-
-        # Assert
-        mock_redis.set.assert_called_once_with(
-            f'{key_prefix}:ip:{mock_request.client.host}',
-            1,
-            nx=True,
-            ex=RATE_LIMIT_IP_SECONDS,
-        )
-        mock_logger.warning.assert_not_called()
-
-
-@pytest.mark.asyncio
-async def test_rate_limit_by_ip_second_request_within_window_fails(
-    mock_request, mock_redis
-):
-    """Test that second request from same IP within rate limit window fails."""
-    # Arrange
-    key_prefix = 'email_resend'
-    mock_redis.set = AsyncMock(return_value=False)  # Key already exists
-
-    with (
-        patch('server.utils.rate_limit_utils.sio') as mock_sio,
-    ):
-        mock_sio.manager.redis = mock_redis
-
-        # Act & Assert
-        with pytest.raises(HTTPException) as exc_info:
-            await check_rate_limit_by_user_id(
-                request=mock_request, key_prefix=key_prefix, user_id=None
-            )
-
-        assert exc_info.value.status_code == status.HTTP_429_TOO_MANY_REQUESTS
-        assert f'{RATE_LIMIT_IP_SECONDS // 60} minutes' in exc_info.value.detail
-
-
-@pytest.mark.asyncio
-async def test_rate_limit_redis_unavailable_fails_open(mock_request):
-    """Test that rate limiting fails open when Redis is unavailable."""
-    # Arrange
-    key_prefix = 'email_resend'
-    user_id = 'test_user_id'
-
-    with (
-        patch('server.utils.rate_limit_utils.sio') as mock_sio,
-        patch('server.utils.rate_limit_utils.logger') as mock_logger,
-    ):
-        mock_sio.manager.redis = None  # Redis unavailable
-
-        # Act
-        await check_rate_limit_by_user_id(
-            request=mock_request, key_prefix=key_prefix, user_id=user_id
-        )
-
-        # Assert
-        mock_logger.warning.assert_called_once_with(
-            'Redis unavailable for rate limiting, allowing request'
-        )
-
-
-@pytest.mark.asyncio
-async def test_rate_limit_redis_exception_fails_open(mock_request, mock_redis):
-    """Test that rate limiting fails open when Redis raises an exception."""
-    # Arrange
-    key_prefix = 'email_resend'
-    user_id = 'test_user_id'
-    mock_redis.set = AsyncMock(side_effect=Exception('Redis connection error'))
-
-    with (
-        patch('server.utils.rate_limit_utils.sio') as mock_sio,
-        patch('server.utils.rate_limit_utils.logger') as mock_logger,
-    ):
-        mock_sio.manager.redis = mock_redis
-
-        # Act
-        await check_rate_limit_by_user_id(
-            request=mock_request, key_prefix=key_prefix, user_id=user_id
-        )
-
-        # Assert
-        mock_logger.warning.assert_called_once()
-        assert 'Error checking rate limit' in str(mock_logger.warning.call_args[0][0])
-
-
-@pytest.mark.asyncio
-async def test_rate_limit_custom_key_prefix(mock_request, mock_redis):
-    """Test that different key prefixes create different rate limit keys."""
-    # Arrange
-    user_id = 'test_user_id'
-    key_prefix = 'password_reset'
-
-    with patch('server.utils.rate_limit_utils.sio') as mock_sio:
-        mock_sio.manager.redis = mock_redis
-
-        # Act
-        await check_rate_limit_by_user_id(
-            request=mock_request, key_prefix=key_prefix, user_id=user_id
-        )
-
-        # Assert
-        mock_redis.set.assert_called_once_with(
-            f'{key_prefix}:{user_id}', 1, nx=True, ex=RATE_LIMIT_USER_SECONDS
-        )
-
-
-@pytest.mark.asyncio
-async def test_rate_limit_custom_rate_limit_seconds(mock_request, mock_redis):
-    """Test that custom rate limit seconds are used correctly."""
-    # Arrange
-    user_id = 'test_user_id'
-    key_prefix = 'email_resend'
-    custom_user_seconds = 60
-    custom_ip_seconds = 180
-
-    with patch('server.utils.rate_limit_utils.sio') as mock_sio:
-        mock_sio.manager.redis = mock_redis
-
-        # Act
-        await check_rate_limit_by_user_id(
-            request=mock_request,
-            key_prefix=key_prefix,
-            user_id=user_id,
-            user_rate_limit_seconds=custom_user_seconds,
-            ip_rate_limit_seconds=custom_ip_seconds,
-        )
-
-        # Assert
-        mock_redis.set.assert_called_once_with(
-            f'{key_prefix}:{user_id}', 1, nx=True, ex=custom_user_seconds
-        )
-
-
-@pytest.mark.asyncio
-async def test_rate_limit_ip_with_unknown_client(mock_request, mock_redis):
-    """Test that rate limiting handles missing client host gracefully."""
-    # Arrange
-    key_prefix = 'email_resend'
-    mock_request.client = None  # No client information
-
-    with patch('server.utils.rate_limit_utils.sio') as mock_sio:
-        mock_sio.manager.redis = mock_redis
-
-        # Act
-        await check_rate_limit_by_user_id(
-            request=mock_request, key_prefix=key_prefix, user_id=None
-        )
-
-        # Assert
-        mock_redis.set.assert_called_once_with(
-            f'{key_prefix}:ip:unknown', 1, nx=True, ex=RATE_LIMIT_IP_SECONDS
-        )
-
-
-@pytest.mark.asyncio
-async def test_rate_limit_different_users_have_separate_limits(
-    mock_request, mock_redis
-):
-    """Test that different user_ids have separate rate limit keys."""
-    # Arrange
-    key_prefix = 'email_resend'
-    user_id_1 = 'user_1'
-    user_id_2 = 'user_2'
-
-    with patch('server.utils.rate_limit_utils.sio') as mock_sio:
-        mock_sio.manager.redis = mock_redis
-
-        # Act
-        await check_rate_limit_by_user_id(
-            request=mock_request, key_prefix=key_prefix, user_id=user_id_1
-        )
-        await check_rate_limit_by_user_id(
-            request=mock_request, key_prefix=key_prefix, user_id=user_id_2
-        )
-
-        # Assert
-        assert mock_redis.set.call_count == 2
-        # Extract call arguments properly
-        call_args_list = [
-            (call[0][0], call[0][1], call[1]['nx'], call[1]['ex'])
-            for call in mock_redis.set.call_args_list
-        ]
-        assert (
-            f'{key_prefix}:{user_id_1}',
-            1,
-            True,
-            RATE_LIMIT_USER_SECONDS,
-        ) in call_args_list
-        assert (
-            f'{key_prefix}:{user_id_2}',
-            1,
-            True,
-            RATE_LIMIT_USER_SECONDS,
-        ) in call_args_list

enterprise/tests/unit/storage/test_gitlab_webhook_store.py

@@ -1,388 +0,0 @@
-"""Unit tests for GitlabWebhookStore."""
-
-import pytest
-from integrations.types import GitLabResourceType
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
-from sqlalchemy.pool import StaticPool
-from storage.base import Base
-from storage.gitlab_webhook import GitlabWebhook
-from storage.gitlab_webhook_store import GitlabWebhookStore
-
-
-@pytest.fixture
-async def async_engine():
-    """Create an async SQLite engine for testing."""
-    engine = create_async_engine(
-        'sqlite+aiosqlite:///:memory:',
-        poolclass=StaticPool,
-        connect_args={'check_same_thread': False},
-        echo=False,
-    )
-
-    # Create all tables
-    async with engine.begin() as conn:
-        await conn.run_sync(Base.metadata.create_all)
-
-    yield engine
-
-    await engine.dispose()
-
-
-@pytest.fixture
-async def async_session_maker(async_engine):
-    """Create an async session maker for testing."""
-    return async_sessionmaker(async_engine, class_=AsyncSession, expire_on_commit=False)
-
-
-@pytest.fixture
-async def webhook_store(async_session_maker):
-    """Create a GitlabWebhookStore instance for testing."""
-    return GitlabWebhookStore(a_session_maker=async_session_maker)
-
-
-@pytest.fixture
-async def sample_webhooks(async_session_maker):
-    """Create sample webhook records for testing."""
-    async with async_session_maker() as session:
-        # Create webhooks for user_1
-        webhook1 = GitlabWebhook(
-            project_id='project-1',
-            group_id=None,
-            user_id='user_1',
-            webhook_exists=True,
-            webhook_url='https://example.com/webhook',
-            webhook_secret='secret-1',
-            webhook_uuid='uuid-1',
-        )
-        webhook2 = GitlabWebhook(
-            project_id='project-2',
-            group_id=None,
-            user_id='user_1',
-            webhook_exists=True,
-            webhook_url='https://example.com/webhook',
-            webhook_secret='secret-2',
-            webhook_uuid='uuid-2',
-        )
-        webhook3 = GitlabWebhook(
-            project_id=None,
-            group_id='group-1',
-            user_id='user_1',
-            webhook_exists=False,  # Already marked for reinstallation
-            webhook_url='https://example.com/webhook',
-            webhook_secret='secret-3',
-            webhook_uuid='uuid-3',
-        )
-
-        # Create webhook for user_2
-        webhook4 = GitlabWebhook(
-            project_id='project-3',
-            group_id=None,
-            user_id='user_2',
-            webhook_exists=True,
-            webhook_url='https://example.com/webhook',
-            webhook_secret='secret-4',
-            webhook_uuid='uuid-4',
-        )
-
-        session.add_all([webhook1, webhook2, webhook3, webhook4])
-        await session.commit()
-
-        # Refresh to get IDs (outside of begin() context)
-        await session.refresh(webhook1)
-        await session.refresh(webhook2)
-        await session.refresh(webhook3)
-        await session.refresh(webhook4)
-
-    return [webhook1, webhook2, webhook3, webhook4]
-
-
-class TestGetWebhookByResourceOnly:
-    """Test cases for get_webhook_by_resource_only method."""
-
-    @pytest.mark.asyncio
-    async def test_get_project_webhook_by_resource_only(
-        self, webhook_store, async_session_maker, sample_webhooks
-    ):
-        """Test getting a project webhook by resource ID without user_id filter."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'project-1'
-
-        # Act
-        webhook = await webhook_store.get_webhook_by_resource_only(
-            resource_type, resource_id
-        )
-
-        # Assert
-        assert webhook is not None
-        assert webhook.project_id == resource_id
-        assert webhook.user_id == 'user_1'
-
-    @pytest.mark.asyncio
-    async def test_get_group_webhook_by_resource_only(
-        self, webhook_store, async_session_maker, sample_webhooks
-    ):
-        """Test getting a group webhook by resource ID without user_id filter."""
-        # Arrange
-        resource_type = GitLabResourceType.GROUP
-        resource_id = 'group-1'
-
-        # Act
-        webhook = await webhook_store.get_webhook_by_resource_only(
-            resource_type, resource_id
-        )
-
-        # Assert
-        assert webhook is not None
-        assert webhook.group_id == resource_id
-        assert webhook.user_id == 'user_1'
-
-    @pytest.mark.asyncio
-    async def test_get_webhook_by_resource_only_not_found(
-        self, webhook_store, async_session_maker
-    ):
-        """Test getting a webhook that doesn't exist."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'non-existent-project'
-
-        # Act
-        webhook = await webhook_store.get_webhook_by_resource_only(
-            resource_type, resource_id
-        )
-
-        # Assert
-        assert webhook is None
-
-    @pytest.mark.asyncio
-    async def test_get_webhook_by_resource_only_organization_wide(
-        self, webhook_store, async_session_maker, sample_webhooks
-    ):
-        """Test that webhook lookup works regardless of which user originally created it."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'project-3'  # Created by user_2
-
-        # Act
-        webhook = await webhook_store.get_webhook_by_resource_only(
-            resource_type, resource_id
-        )
-
-        # Assert
-        assert webhook is not None
-        assert webhook.project_id == resource_id
-        # Should find webhook even though it was created by a different user
-        assert webhook.user_id == 'user_2'
-
-
-class TestResetWebhookForReinstallationByResource:
-    """Test cases for reset_webhook_for_reinstallation_by_resource method."""
-
-    @pytest.mark.asyncio
-    async def test_reset_project_webhook_by_resource(
-        self, webhook_store, async_session_maker, sample_webhooks
-    ):
-        """Test resetting a project webhook by resource without user_id filter."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'project-1'
-        updating_user_id = 'user_2'  # Different user can reset it
-
-        # Act
-        result = await webhook_store.reset_webhook_for_reinstallation_by_resource(
-            resource_type, resource_id, updating_user_id
-        )
-
-        # Assert
-        assert result is True
-
-        # Verify webhook was reset
-        async with async_session_maker() as session:
-            result_query = await session.execute(
-                select(GitlabWebhook).where(GitlabWebhook.project_id == resource_id)
-            )
-            webhook = result_query.scalars().first()
-            assert webhook.webhook_exists is False
-            assert webhook.webhook_uuid is None
-            assert (
-                webhook.user_id == updating_user_id
-            )  # Updated to track who modified it
-
-    @pytest.mark.asyncio
-    async def test_reset_group_webhook_by_resource(
-        self, webhook_store, async_session_maker, sample_webhooks
-    ):
-        """Test resetting a group webhook by resource without user_id filter."""
-        # Arrange
-        resource_type = GitLabResourceType.GROUP
-        resource_id = 'group-1'
-        updating_user_id = 'user_2'
-
-        # Act
-        result = await webhook_store.reset_webhook_for_reinstallation_by_resource(
-            resource_type, resource_id, updating_user_id
-        )
-
-        # Assert
-        assert result is True
-
-        # Verify webhook was reset
-        async with async_session_maker() as session:
-            result_query = await session.execute(
-                select(GitlabWebhook).where(GitlabWebhook.group_id == resource_id)
-            )
-            webhook = result_query.scalars().first()
-            assert webhook.webhook_exists is False
-            assert webhook.webhook_uuid is None
-            assert webhook.user_id == updating_user_id
-
-    @pytest.mark.asyncio
-    async def test_reset_webhook_by_resource_not_found(
-        self, webhook_store, async_session_maker
-    ):
-        """Test resetting a webhook that doesn't exist."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'non-existent-project'
-        updating_user_id = 'user_1'
-
-        # Act
-        result = await webhook_store.reset_webhook_for_reinstallation_by_resource(
-            resource_type, resource_id, updating_user_id
-        )
-
-        # Assert
-        assert result is False
-
-    @pytest.mark.asyncio
-    async def test_reset_webhook_by_resource_organization_wide(
-        self, webhook_store, async_session_maker, sample_webhooks
-    ):
-        """Test that any user can reset a webhook regardless of original creator."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'project-3'  # Created by user_2
-        updating_user_id = 'user_1'  # Different user resetting it
-
-        # Act
-        result = await webhook_store.reset_webhook_for_reinstallation_by_resource(
-            resource_type, resource_id, updating_user_id
-        )
-
-        # Assert
-        assert result is True
-
-        # Verify webhook was reset and user_id updated
-        async with async_session_maker() as session:
-            result_query = await session.execute(
-                select(GitlabWebhook).where(GitlabWebhook.project_id == resource_id)
-            )
-            webhook = result_query.scalars().first()
-            assert webhook.webhook_exists is False
-            assert webhook.user_id == updating_user_id
-
-
-class TestGetWebhooksByResources:
-    """Test cases for get_webhooks_by_resources method."""
-
-    @pytest.mark.asyncio
-    async def test_get_webhooks_by_resources_projects_only(
-        self, webhook_store, async_session_maker, sample_webhooks
-    ):
-        """Test bulk fetching webhooks for multiple projects."""
-        # Arrange
-        project_ids = ['project-1', 'project-2', 'project-3']
-        group_ids: list[str] = []
-
-        # Act
-        project_map, group_map = await webhook_store.get_webhooks_by_resources(
-            project_ids, group_ids
-        )
-
-        # Assert
-        assert len(project_map) == 3
-        assert 'project-1' in project_map
-        assert 'project-2' in project_map
-        assert 'project-3' in project_map
-        assert len(group_map) == 0
-
-    @pytest.mark.asyncio
-    async def test_get_webhooks_by_resources_groups_only(
-        self, webhook_store, async_session_maker, sample_webhooks
-    ):
-        """Test bulk fetching webhooks for multiple groups."""
-        # Arrange
-        project_ids: list[str] = []
-        group_ids = ['group-1']
-
-        # Act
-        project_map, group_map = await webhook_store.get_webhooks_by_resources(
-            project_ids, group_ids
-        )
-
-        # Assert
-        assert len(project_map) == 0
-        assert len(group_map) == 1
-        assert 'group-1' in group_map
-
-    @pytest.mark.asyncio
-    async def test_get_webhooks_by_resources_mixed(
-        self, webhook_store, async_session_maker, sample_webhooks
-    ):
-        """Test bulk fetching webhooks for both projects and groups."""
-        # Arrange
-        project_ids = ['project-1', 'project-2']
-        group_ids = ['group-1']
-
-        # Act
-        project_map, group_map = await webhook_store.get_webhooks_by_resources(
-            project_ids, group_ids
-        )
-
-        # Assert
-        assert len(project_map) == 2
-        assert len(group_map) == 1
-        assert 'project-1' in project_map
-        assert 'project-2' in project_map
-        assert 'group-1' in group_map
-
-    @pytest.mark.asyncio
-    async def test_get_webhooks_by_resources_empty_lists(
-        self, webhook_store, async_session_maker
-    ):
-        """Test bulk fetching with empty ID lists."""
-        # Arrange
-        project_ids: list[str] = []
-        group_ids: list[str] = []
-
-        # Act
-        project_map, group_map = await webhook_store.get_webhooks_by_resources(
-            project_ids, group_ids
-        )
-
-        # Assert
-        assert len(project_map) == 0
-        assert len(group_map) == 0
-
-    @pytest.mark.asyncio
-    async def test_get_webhooks_by_resources_partial_matches(
-        self, webhook_store, async_session_maker, sample_webhooks
-    ):
-        """Test bulk fetching when some IDs don't exist."""
-        # Arrange
-        project_ids = ['project-1', 'non-existent-project']
-        group_ids = ['group-1', 'non-existent-group']
-
-        # Act
-        project_map, group_map = await webhook_store.get_webhooks_by_resources(
-            project_ids, group_ids
-        )
-
-        # Assert
-        assert len(project_map) == 1
-        assert 'project-1' in project_map
-        assert 'non-existent-project' not in project_map
-        assert len(group_map) == 1
-        assert 'group-1' in group_map
-        assert 'non-existent-group' not in group_map

enterprise/tests/unit/sync/test_install_gitlab_webhooks.py

@@ -1,438 +0,0 @@
-"""Unit tests for install_gitlab_webhooks module."""
-
-from unittest.mock import AsyncMock, MagicMock
-
-import pytest
-from integrations.gitlab.webhook_installation import (
-    BreakLoopException,
-    install_webhook_on_resource,
-    verify_webhook_conditions,
-)
-from integrations.types import GitLabResourceType
-from integrations.utils import GITLAB_WEBHOOK_URL
-from storage.gitlab_webhook import GitlabWebhook, WebhookStatus
-
-
-@pytest.fixture
-def mock_gitlab_service():
-    """Create a mock GitLab service."""
-    service = MagicMock()
-    service.check_resource_exists = AsyncMock(return_value=(True, None))
-    service.check_user_has_admin_access_to_resource = AsyncMock(
-        return_value=(True, None)
-    )
-    service.check_webhook_exists_on_resource = AsyncMock(return_value=(False, None))
-    service.install_webhook = AsyncMock(return_value=('webhook-id-123', None))
-    return service
-
-
-@pytest.fixture
-def mock_webhook_store():
-    """Create a mock webhook store."""
-    store = MagicMock()
-    store.delete_webhook = AsyncMock()
-    store.update_webhook = AsyncMock()
-    return store
-
-
-@pytest.fixture
-def sample_webhook():
-    """Create a sample webhook object."""
-    webhook = MagicMock(spec=GitlabWebhook)
-    webhook.user_id = 'test_user_id'
-    webhook.webhook_exists = False
-    webhook.webhook_uuid = None
-    return webhook
-
-
-class TestVerifyWebhookConditions:
-    """Test cases for verify_webhook_conditions function."""
-
-    @pytest.mark.asyncio
-    async def test_verify_conditions_all_pass(
-        self, mock_gitlab_service, mock_webhook_store, sample_webhook
-    ):
-        """Test when all conditions are met for webhook installation."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'project-123'
-
-        # Act
-        # Should not raise any exception
-        await verify_webhook_conditions(
-            gitlab_service=mock_gitlab_service,
-            resource_type=resource_type,
-            resource_id=resource_id,
-            webhook_store=mock_webhook_store,
-            webhook=sample_webhook,
-        )
-
-        # Assert
-        mock_gitlab_service.check_resource_exists.assert_called_once_with(
-            resource_type, resource_id
-        )
-        mock_gitlab_service.check_user_has_admin_access_to_resource.assert_called_once_with(
-            resource_type, resource_id
-        )
-        mock_gitlab_service.check_webhook_exists_on_resource.assert_called_once_with(
-            resource_type, resource_id, GITLAB_WEBHOOK_URL
-        )
-        mock_webhook_store.delete_webhook.assert_not_called()
-
-    @pytest.mark.asyncio
-    async def test_verify_conditions_resource_does_not_exist(
-        self, mock_gitlab_service, mock_webhook_store, sample_webhook
-    ):
-        """Test when resource does not exist."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'project-999'
-        mock_gitlab_service.check_resource_exists = AsyncMock(
-            return_value=(False, None)
-        )
-
-        # Act & Assert
-        with pytest.raises(BreakLoopException):
-            await verify_webhook_conditions(
-                gitlab_service=mock_gitlab_service,
-                resource_type=resource_type,
-                resource_id=resource_id,
-                webhook_store=mock_webhook_store,
-                webhook=sample_webhook,
-            )
-
-        # Assert webhook is deleted
-        mock_webhook_store.delete_webhook.assert_called_once_with(sample_webhook)
-
-    @pytest.mark.asyncio
-    async def test_verify_conditions_rate_limited_on_resource_check(
-        self, mock_gitlab_service, mock_webhook_store, sample_webhook
-    ):
-        """Test when rate limited during resource existence check."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'project-123'
-        mock_gitlab_service.check_resource_exists = AsyncMock(
-            return_value=(False, WebhookStatus.RATE_LIMITED)
-        )
-
-        # Act & Assert
-        with pytest.raises(BreakLoopException):
-            await verify_webhook_conditions(
-                gitlab_service=mock_gitlab_service,
-                resource_type=resource_type,
-                resource_id=resource_id,
-                webhook_store=mock_webhook_store,
-                webhook=sample_webhook,
-            )
-
-        # Should not delete webhook on rate limit
-        mock_webhook_store.delete_webhook.assert_not_called()
-
-    @pytest.mark.asyncio
-    async def test_verify_conditions_user_no_admin_access(
-        self, mock_gitlab_service, mock_webhook_store, sample_webhook
-    ):
-        """Test when user does not have admin access."""
-        # Arrange
-        resource_type = GitLabResourceType.GROUP
-        resource_id = 'group-456'
-        mock_gitlab_service.check_user_has_admin_access_to_resource = AsyncMock(
-            return_value=(False, None)
-        )
-
-        # Act & Assert
-        with pytest.raises(BreakLoopException):
-            await verify_webhook_conditions(
-                gitlab_service=mock_gitlab_service,
-                resource_type=resource_type,
-                resource_id=resource_id,
-                webhook_store=mock_webhook_store,
-                webhook=sample_webhook,
-            )
-
-        # Assert webhook is deleted
-        mock_webhook_store.delete_webhook.assert_called_once_with(sample_webhook)
-
-    @pytest.mark.asyncio
-    async def test_verify_conditions_rate_limited_on_admin_check(
-        self, mock_gitlab_service, mock_webhook_store, sample_webhook
-    ):
-        """Test when rate limited during admin access check."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'project-123'
-        mock_gitlab_service.check_user_has_admin_access_to_resource = AsyncMock(
-            return_value=(False, WebhookStatus.RATE_LIMITED)
-        )
-
-        # Act & Assert
-        with pytest.raises(BreakLoopException):
-            await verify_webhook_conditions(
-                gitlab_service=mock_gitlab_service,
-                resource_type=resource_type,
-                resource_id=resource_id,
-                webhook_store=mock_webhook_store,
-                webhook=sample_webhook,
-            )
-
-        # Should not delete webhook on rate limit
-        mock_webhook_store.delete_webhook.assert_not_called()
-
-    @pytest.mark.asyncio
-    async def test_verify_conditions_webhook_already_exists(
-        self, mock_gitlab_service, mock_webhook_store, sample_webhook
-    ):
-        """Test when webhook already exists on resource."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'project-123'
-        mock_gitlab_service.check_webhook_exists_on_resource = AsyncMock(
-            return_value=(True, None)
-        )
-
-        # Act & Assert
-        with pytest.raises(BreakLoopException):
-            await verify_webhook_conditions(
-                gitlab_service=mock_gitlab_service,
-                resource_type=resource_type,
-                resource_id=resource_id,
-                webhook_store=mock_webhook_store,
-                webhook=sample_webhook,
-            )
-
-    @pytest.mark.asyncio
-    async def test_verify_conditions_rate_limited_on_webhook_check(
-        self, mock_gitlab_service, mock_webhook_store, sample_webhook
-    ):
-        """Test when rate limited during webhook existence check."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'project-123'
-        mock_gitlab_service.check_webhook_exists_on_resource = AsyncMock(
-            return_value=(False, WebhookStatus.RATE_LIMITED)
-        )
-
-        # Act & Assert
-        with pytest.raises(BreakLoopException):
-            await verify_webhook_conditions(
-                gitlab_service=mock_gitlab_service,
-                resource_type=resource_type,
-                resource_id=resource_id,
-                webhook_store=mock_webhook_store,
-                webhook=sample_webhook,
-            )
-
-    @pytest.mark.asyncio
-    async def test_verify_conditions_updates_webhook_status_mismatch(
-        self, mock_gitlab_service, mock_webhook_store, sample_webhook
-    ):
-        """Test that webhook status is updated when database and API don't match."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'project-123'
-        sample_webhook.webhook_exists = True  # DB says exists
-        mock_gitlab_service.check_webhook_exists_on_resource = AsyncMock(
-            return_value=(False, None)  # API says doesn't exist
-        )
-
-        # Act
-        # Should not raise BreakLoopException when webhook doesn't exist (allows installation)
-        await verify_webhook_conditions(
-            gitlab_service=mock_gitlab_service,
-            resource_type=resource_type,
-            resource_id=resource_id,
-            webhook_store=mock_webhook_store,
-            webhook=sample_webhook,
-        )
-
-        # Assert webhook status was updated to match API
-        mock_webhook_store.update_webhook.assert_called_once_with(
-            sample_webhook, {'webhook_exists': False}
-        )
-
-
-class TestInstallWebhookOnResource:
-    """Test cases for install_webhook_on_resource function."""
-
-    @pytest.mark.asyncio
-    async def test_install_webhook_success(
-        self, mock_gitlab_service, mock_webhook_store, sample_webhook
-    ):
-        """Test successful webhook installation."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'project-123'
-
-        # Act
-        webhook_id, status = await install_webhook_on_resource(
-            gitlab_service=mock_gitlab_service,
-            resource_type=resource_type,
-            resource_id=resource_id,
-            webhook_store=mock_webhook_store,
-            webhook=sample_webhook,
-        )
-
-        # Assert
-        assert webhook_id == 'webhook-id-123'
-        assert status is None
-        mock_gitlab_service.install_webhook.assert_called_once()
-        mock_webhook_store.update_webhook.assert_called_once()
-        # Verify update_webhook was called with correct fields (using keyword arguments)
-        call_args = mock_webhook_store.update_webhook.call_args
-        assert call_args[1]['webhook'] == sample_webhook
-        update_fields = call_args[1]['update_fields']
-        assert update_fields['webhook_exists'] is True
-        assert update_fields['webhook_url'] == GITLAB_WEBHOOK_URL
-        assert 'webhook_secret' in update_fields
-        assert 'webhook_uuid' in update_fields
-        assert 'scopes' in update_fields
-
-    @pytest.mark.asyncio
-    async def test_install_webhook_group_resource(
-        self, mock_gitlab_service, mock_webhook_store, sample_webhook
-    ):
-        """Test webhook installation for a group resource."""
-        # Arrange
-        resource_type = GitLabResourceType.GROUP
-        resource_id = 'group-456'
-
-        # Act
-        webhook_id, status = await install_webhook_on_resource(
-            gitlab_service=mock_gitlab_service,
-            resource_type=resource_type,
-            resource_id=resource_id,
-            webhook_store=mock_webhook_store,
-            webhook=sample_webhook,
-        )
-
-        # Assert
-        assert webhook_id == 'webhook-id-123'
-        # Verify install_webhook was called with GROUP type
-        call_args = mock_gitlab_service.install_webhook.call_args
-        assert call_args[1]['resource_type'] == resource_type
-        assert call_args[1]['resource_id'] == resource_id
-
-    @pytest.mark.asyncio
-    async def test_install_webhook_rate_limited(
-        self, mock_gitlab_service, mock_webhook_store, sample_webhook
-    ):
-        """Test when installation is rate limited."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'project-123'
-        mock_gitlab_service.install_webhook = AsyncMock(
-            return_value=(None, WebhookStatus.RATE_LIMITED)
-        )
-
-        # Act & Assert
-        with pytest.raises(BreakLoopException):
-            await install_webhook_on_resource(
-                gitlab_service=mock_gitlab_service,
-                resource_type=resource_type,
-                resource_id=resource_id,
-                webhook_store=mock_webhook_store,
-                webhook=sample_webhook,
-            )
-
-        # Should not update webhook on rate limit
-        mock_webhook_store.update_webhook.assert_not_called()
-
-    @pytest.mark.asyncio
-    async def test_install_webhook_installation_fails(
-        self, mock_gitlab_service, mock_webhook_store, sample_webhook
-    ):
-        """Test when webhook installation fails."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'project-123'
-        mock_gitlab_service.install_webhook = AsyncMock(return_value=(None, None))
-
-        # Act
-        webhook_id, status = await install_webhook_on_resource(
-            gitlab_service=mock_gitlab_service,
-            resource_type=resource_type,
-            resource_id=resource_id,
-            webhook_store=mock_webhook_store,
-            webhook=sample_webhook,
-        )
-
-        # Assert
-        assert webhook_id is None
-        assert status is None
-        # Should not update webhook when installation fails
-        mock_webhook_store.update_webhook.assert_not_called()
-
-    @pytest.mark.asyncio
-    async def test_install_webhook_generates_unique_secrets(
-        self, mock_gitlab_service, mock_webhook_store, sample_webhook
-    ):
-        """Test that unique webhook secrets and UUIDs are generated."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'project-123'
-
-        # Act - First call
-        webhook_id1, _ = await install_webhook_on_resource(
-            gitlab_service=mock_gitlab_service,
-            resource_type=resource_type,
-            resource_id=resource_id,
-            webhook_store=mock_webhook_store,
-            webhook=sample_webhook,
-        )
-
-        # Capture first call's values before resetting
-        call1_secret = mock_webhook_store.update_webhook.call_args_list[0][1][
-            'update_fields'
-        ]['webhook_secret']
-        call1_uuid = mock_webhook_store.update_webhook.call_args_list[0][1][
-            'update_fields'
-        ]['webhook_uuid']
-
-        # Reset mocks and call again
-        mock_gitlab_service.install_webhook.reset_mock()
-        mock_webhook_store.update_webhook.reset_mock()
-
-        # Act - Second call
-        webhook_id2, _ = await install_webhook_on_resource(
-            gitlab_service=mock_gitlab_service,
-            resource_type=resource_type,
-            resource_id=resource_id,
-            webhook_store=mock_webhook_store,
-            webhook=sample_webhook,
-        )
-
-        # Capture second call's values
-        call2_secret = mock_webhook_store.update_webhook.call_args_list[0][1][
-            'update_fields'
-        ]['webhook_secret']
-        call2_uuid = mock_webhook_store.update_webhook.call_args_list[0][1][
-            'update_fields'
-        ]['webhook_uuid']
-
-        # Assert - Secrets and UUIDs should be different
-        assert call1_secret != call2_secret
-        assert call1_uuid != call2_uuid
-
-    @pytest.mark.asyncio
-    async def test_install_webhook_uses_correct_webhook_name_and_url(
-        self, mock_gitlab_service, mock_webhook_store, sample_webhook
-    ):
-        """Test that correct webhook name and URL are used."""
-        # Arrange
-        resource_type = GitLabResourceType.PROJECT
-        resource_id = 'project-123'
-
-        # Act
-        await install_webhook_on_resource(
-            gitlab_service=mock_gitlab_service,
-            resource_type=resource_type,
-            resource_id=resource_id,
-            webhook_store=mock_webhook_store,
-            webhook=sample_webhook,
-        )
-
-        # Assert
-        call_args = mock_gitlab_service.install_webhook.call_args
-        assert call_args[1]['webhook_name'] == 'OpenHands Resolver'
-        assert call_args[1]['webhook_url'] == GITLAB_WEBHOOK_URL

enterprise/tests/unit/telemetry/__init__.py

@@ -0,0 +1 @@
+"""Tests for the OpenHands Enterprise Telemetry Framework."""

enterprise/tests/unit/telemetry/conftest.py

@@ -0,0 +1,19 @@
+"""Conftest for telemetry tests."""
+
+from unittest.mock import MagicMock
+
+import pytest
+
+
+@pytest.fixture
+def mock_session_maker():
+    """Mock session maker for database tests."""
+    mock_session = MagicMock()
+    mock_session_maker = MagicMock(return_value=mock_session)
+    return mock_session_maker
+
+
+@pytest.fixture
+def mock_database_session():
+    """Mock database session."""
+    return MagicMock()

enterprise/tests/unit/telemetry/test_base_collector.py

@@ -0,0 +1,155 @@
+"""Tests for the base collector interface."""
+
+from abc import ABC
+from typing import List
+
+import pytest
+
+from enterprise.telemetry.base_collector import MetricResult, MetricsCollector
+
+
+class TestMetricResult:
+    """Test cases for the MetricResult dataclass."""
+
+    def test_metric_result_creation(self):
+        """Test creating a MetricResult with basic values."""
+        result = MetricResult(key='test_metric', value=42)
+        assert result.key == 'test_metric'
+        assert result.value == 42
+
+    def test_metric_result_with_string_value(self):
+        """Test creating a MetricResult with string value."""
+        result = MetricResult(key='status', value='healthy')
+        assert result.key == 'status'
+        assert result.value == 'healthy'
+
+    def test_metric_result_with_float_value(self):
+        """Test creating a MetricResult with float value."""
+        result = MetricResult(key='cpu_usage', value=75.5)
+        assert result.key == 'cpu_usage'
+        assert result.value == 75.5
+
+    def test_metric_result_equality(self):
+        """Test MetricResult equality comparison."""
+        result1 = MetricResult(key='test', value=100)
+        result2 = MetricResult(key='test', value=100)
+        result3 = MetricResult(key='test', value=200)
+
+        assert result1 == result2
+        assert result1 != result3
+
+    def test_metric_result_repr(self):
+        """Test MetricResult string representation."""
+        result = MetricResult(key='test_metric', value=42)
+        repr_str = repr(result)
+        assert 'test_metric' in repr_str
+        assert '42' in repr_str
+
+
+class TestMetricsCollector:
+    """Test cases for the MetricsCollector abstract base class."""
+
+    def test_metrics_collector_is_abstract(self):
+        """Test that MetricsCollector cannot be instantiated directly."""
+        with pytest.raises(TypeError):
+            MetricsCollector()  # type: ignore[abstract]
+
+    def test_metrics_collector_inheritance(self):
+        """Test that MetricsCollector is properly abstract."""
+        assert issubclass(MetricsCollector, ABC)
+
+        # Check that the required methods are abstract
+        abstract_methods = MetricsCollector.__abstractmethods__
+        assert 'collect' in abstract_methods
+        assert 'collector_name' in abstract_methods
+
+    def test_concrete_collector_implementation(self):
+        """Test that a concrete collector can be implemented."""
+
+        class TestCollector(MetricsCollector):
+            @property
+            def collector_name(self) -> str:
+                return 'test_collector'
+
+            def collect(self) -> List[MetricResult]:
+                return [
+                    MetricResult(key='metric1', value=10),
+                    MetricResult(key='metric2', value='test'),
+                ]
+
+        collector = TestCollector()
+        assert collector.collector_name == 'test_collector'
+
+        results = collector.collect()
+        assert len(results) == 2
+        assert results[0].key == 'metric1'
+        assert results[0].value == 10
+        assert results[1].key == 'metric2'
+        assert results[1].value == 'test'
+
+    def test_collector_with_empty_results(self):
+        """Test collector that returns empty results."""
+
+        class EmptyCollector(MetricsCollector):
+            @property
+            def collector_name(self) -> str:
+                return 'empty_collector'
+
+            def collect(self) -> List[MetricResult]:
+                return []
+
+        collector = EmptyCollector()
+        results = collector.collect()
+        assert results == []
+
+    def test_collector_with_exception(self):
+        """Test collector that raises an exception."""
+
+        class FailingCollector(MetricsCollector):
+            @property
+            def collector_name(self) -> str:
+                return 'failing_collector'
+
+            def collect(self) -> List[MetricResult]:
+                raise RuntimeError('Collection failed')
+
+        collector = FailingCollector()
+        with pytest.raises(RuntimeError, match='Collection failed'):
+            collector.collect()
+
+    def test_collector_name_property(self):
+        """Test that collector_name is properly implemented as a property."""
+
+        class NamedCollector(MetricsCollector):
+            def __init__(self, name: str):
+                self._name = name
+
+            @property
+            def collector_name(self) -> str:
+                return self._name
+
+            def collect(self) -> List[MetricResult]:
+                return []
+
+        collector = NamedCollector('dynamic_name')
+        assert collector.collector_name == 'dynamic_name'
+
+    def test_incomplete_collector_implementation(self):
+        """Test that incomplete implementations cannot be instantiated."""
+
+        # Missing collect method
+        class IncompleteCollector1(MetricsCollector):
+            @property
+            def collector_name(self) -> str:
+                return 'incomplete'
+
+        with pytest.raises(TypeError):
+            IncompleteCollector1()  # type: ignore[abstract]
+
+        # Missing collector_name property
+        class IncompleteCollector2(MetricsCollector):
+            def collect(self) -> List[MetricResult]:
+                return []
+
+        with pytest.raises(TypeError):
+            IncompleteCollector2()  # type: ignore[abstract]