mirror of
https://github.com/All-Hands-AI/OpenHands.git
synced 2026-04-29 03:00:45 -04:00
* feat: Initial work on security analyzer * feat: Add remote invariant client * chore: improve fault tolerance of client * feat: Add button to enable Invariant Security Analyzer * [feat] confirmation mode for bash actions * feat: Add Invariant Tab with security risk outputs * feat: Add modal setting for Confirmation Mode * fix: frontend tests for confirmation mode switch * fix: add missing CONFIRMATION_MODE value in SettingsModal.test.tsx * fix: update test to integrate new setting * feat: Initial work on security analyzer * feat: Add remote invariant client * chore: improve fault tolerance of client * feat: Add button to enable Invariant Security Analyzer * feat: Add Invariant Tab with security risk outputs * feat: integrate security analyzer with confirmation mode * feat: improve invariant analyzer tab * feat: Implement user confirmation for running bash/python code * fix: don't display rejected actions * fix: make confirmation show only on assistant messages * feat: download traces, update policy, implement settings, auto-approve based on defined risk * Fix: low risk not being shown because it's 0 * fix: duplicate logs in tab * fix: log duplication * chore: prepare for merge, remove logging * Merge confirmation_mode from OpenDevin main * test: update tests to pass * chore: finish merging changes, security analyzer now operational again * feat: document Security Analyzers * refactor: api, monitor * chore: lint, fix risk None, revert policy * fix: check security_risk for None * refactor: rename instances of invariant to security analyzer * feat: add /api/options/security-analyzers endpoint * Move security analyzer from tab to modal * Temporary fix lock when security analyzer is not chosen * feat: don't show lock at all when security analyzer is not enabled * refactor: - Frontend: * change type of SECURITY_ANALYZER from bool to string * add combobox to select SECURITY_ANALYZER, current options are "invariant and "" (no security analyzer) * Security is now a modal, lock in bottom right is visible only if there's a security analyzer selected - Backend: * add close to SecurityAnalyzer * instantiate SecurityAnalyzer based on provided string from frontend * fix: update close to be async, to be consistent with other close on resources * fix: max height of modal (prevent overflow) * feat: add logo * small fixes * update docs for creating a security analyzer module * fix linting * update timeout for http client * fix: move security_analyzer config from agent to session * feat: add security_risk to browser actions * add optional remark on combobox * fix: asdict not called on dataclass, remove invariant dependency * fix: exclude None values when serializing * feat: take default policy from invariant-server instead of being hardcoded * fix: check if policy is None * update image name * test: fix some failing runs * fix: security analyzer tests * refactor: merge confirmation_mode and security_analyzer into SecurityConfig. Change invariant error message for docker * test: add tests for invariant parsing actions / observations * fix: python linting for test_security.py * Apply suggestions from code review Co-authored-by: Engel Nyst <enyst@users.noreply.github.com> * use ActionSecurityRisk | None intead of Optional * refactor action parsing * add extra check * lint parser.py * test: add field keep_prompt to test_security * docs: add information about how to enable the analyzer * test: Remove trailing whitespace in README.md text --------- Co-authored-by: Mislav Balunovic <mislav.balunovic@gmail.com> Co-authored-by: Engel Nyst <enyst@users.noreply.github.com> Co-authored-by: Xingyao Wang <xingyao6@illinois.edu>
OpenDevin Server
This is a WebSocket server that executes tasks using an agent.
Recommended Prerequisites
- Initialize the frontend code
- Install Python 3.12 (
brew install pythonfor those using homebrew) - Install pipx: (
brew install pipxfollowed bypipx ensurepath) - Install poetry: (
pipx install poetry)
Install
First build a distribution of the frontend code (From the project root directory):
cd frontend
npm install
npm run build
cd ..
Next run poetry shell (So you don't have to repeat poetry run)
Start the Server
uvicorn opendevin.server.listen:app --reload --port 3000
Test the Server
You can use websocat to test the server.
websocat ws://127.0.0.1:3000/ws
{"action": "start", "args": {"task": "write a bash script that prints hello"}}
Supported Environment Variables
LLM_API_KEY=sk-... # Your OpenAI API Key
LLM_MODEL=gpt-4o # Default model for the agent to use
WORKSPACE_BASE=/path/to/your/workspace # Default absolute path to workspace
API Schema
There are two types of messages that can be sent to, or received from, the server:
- Actions
- Observations
Actions
An action has three parts:
action: The action to be takenargs: The arguments for the actionmessage: A friendly message that can be put in the chat log
There are several kinds of actions. Their arguments are listed below. This list may grow over time.
initialize- initializes the agent. Only sent by client.model- the name of the model to usedirectory- the path to the workspaceagent_cls- the class of the agent to use
start- starts a new development task. Only sent by the client.task- the task to start
read- reads the content of a file.path- the path of the file to read
write- writes the content to a file.path- the path of the file to writecontent- the content to write to the file
run- runs a command.command- the command to run
browse- opens a web page.url- the URL to open
think- Allows the agent to make a plan, set a goal, or record thoughtsthought- the thought to record
finish- agent signals that the task is completed
Observations
An observation has four parts:
observation: The observation typecontent: A string representing the observed dataextras: additional structured datamessage: A friendly message that can be put in the chat log
There are several kinds of observations. Their extras are listed below. This list may grow over time.
read- the content of a filepath- the path of the file read
browse- the HTML content of a urlurl- the URL opened
run- the output of a commandcommand- the command runexit_code- the exit code of the command
chat- a message from the user