Skip to content

Conversation

@malhotra5
Copy link
Collaborator

@malhotra5 malhotra5 commented Nov 5, 2025

Summary

Proposed solution

  1. make a security related system prompt
  2. slice security prompt out of llm view when analyzer is disabled, without removing event from history

@malhotra5 can click here to continue refining the PR


Agent Server images for this PR

GHCR package: https://github.com/OpenHands/agent-sdk/pkgs/container/agent-server

Variants & Base Images

Variant Architectures Base Image Docs / Tags
java amd64, arm64 eclipse-temurin:17-jdk Link
python amd64, arm64 nikolaik/python-nodejs:python3.12-nodejs22 Link
golang amd64, arm64 golang:1.21-bookworm Link

Pull (multi-arch manifest)

# Each variant is a multi-arch manifest supporting both amd64 and arm64
docker pull ghcr.io/openhands/agent-server:263245b-python

Run

docker run -it --rm \
  -p 8000:8000 \
  --name agent-server-263245b-python \
  ghcr.io/openhands/agent-server:263245b-python

All tags pushed for this build

ghcr.io/openhands/agent-server:263245b-golang-amd64
ghcr.io/openhands/agent-server:v1.0.0a5_golang_tag_1.21-bookworm_binary-amd64
ghcr.io/openhands/agent-server:263245b-golang-arm64
ghcr.io/openhands/agent-server:v1.0.0a5_golang_tag_1.21-bookworm_binary-arm64
ghcr.io/openhands/agent-server:263245b-java-amd64
ghcr.io/openhands/agent-server:v1.0.0a5_eclipse-temurin_tag_17-jdk_binary-amd64
ghcr.io/openhands/agent-server:263245b-java-arm64
ghcr.io/openhands/agent-server:v1.0.0a5_eclipse-temurin_tag_17-jdk_binary-arm64
ghcr.io/openhands/agent-server:263245b-python-amd64
ghcr.io/openhands/agent-server:v1.0.0a5_nikolaik_s_python-nodejs_tag_python3.12-nodejs22_binary-amd64
ghcr.io/openhands/agent-server:263245b-python-arm64
ghcr.io/openhands/agent-server:v1.0.0a5_nikolaik_s_python-nodejs_tag_python3.12-nodejs22_binary-arm64
ghcr.io/openhands/agent-server:263245b-golang
ghcr.io/openhands/agent-server:263245b-java
ghcr.io/openhands/agent-server:263245b-python

About Multi-Architecture Support

  • Each variant tag (e.g., 263245b-python) is a multi-arch manifest supporting both amd64 and arm64
  • Docker automatically pulls the correct architecture for your platform
  • Individual architecture tags (e.g., 263245b-python-amd64) are also available if needed

- Create SecurityPromptEvent class similar to SystemPromptEvent
- Add security_prompt to EventType literal in types.py
- Export SecurityPromptEvent through __init__.py files
- Create security_analyzer_info.j2 template for security guidance
- Modify Agent.init_state() to add SecurityPromptEvent when security analyzer enabled
- Modify View.from_events() to conditionally include SecurityPromptEvent
- Add comprehensive tests for SecurityPromptEvent functionality

Co-authored-by: openhands <[email protected]>
…meter

- Add is_security_analyzer_enabled parameter to View.from_events() method
- Update SecurityPromptEvent filtering logic to use parameter instead of event presence detection
- Modify Agent.init_state() to always add SecurityPromptEvent when template is available
- Update all call sites of View.from_events() to pass the security analyzer parameter
- Add comprehensive test for the new parameter-based filtering logic
- Ensure consistent security filtering in both condenser and non-condenser code paths

Co-authored-by: openhands <[email protected]>
@github-actions
Copy link
Contributor

github-actions bot commented Nov 5, 2025

Coverage

Coverage Report •
FileStmtsMissCoverMissing
openhands-sdk/openhands/sdk/agent
   agent.py1595764%123, 127, 152, 156–157, 164, 167, 170, 172–174, 176–178, 198, 213–215, 222–224, 226, 230, 233–234, 236, 243, 269, 274, 305, 309, 314, 325, 328, 350–352, 354, 366–367, 372–373, 385–388, 397–398, 403, 415–416, 421–422, 454, 461–462, 481
openhands-sdk/openhands/sdk/context
   view.py1143371%42, 47, 52–53, 58–59, 64–68, 84–88, 90, 117–118, 200–201, 203, 205, 231–234, 237, 239–240, 247, 249–250
openhands-sdk/openhands/sdk/event/llm_convertible
   security.py20860%20–23, 26, 30–31, 36
TOTAL11693536654% 

Since is_security_analyzer_enabled defaults to False in View.from_events(),
the explicit False parameters are redundant and can be removed for cleaner code.
Only explicit True values are needed when security analyzer is enabled.

Co-authored-by: openhands <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants