v1.54.0

Behavioral compatibility notes

The following merged PRs were labeled release-note-required and are called out explicitly in this release:

• #5503 feat(apps): support checksum-pinned remote backend artifacts (@neubig)

What's Changed

• fix(ci): bump OpenHands' local-stack skill guide and drop the OpenHands-CLI bump by @VascoSch92 in #5517
• docs: align triage and review policy with audit findings by @neubig in #5518
• feat(apps): support checksum-pinned remote backend artifacts by @neubig in #5503
• chore: replace Node 22 with Node 24 by @enyst in #5527
• refactor(sdk): type LLM streaming, message, and tokenizer boundaries by @vedjoshi1 in #5504
• chore(ci): exclude .pr/ review artifacts from pre-commit hooks by @enyst in #5532
• feat(agent-server): reclaim Docker runtime caches and disable core dumps by @VascoSch92 in #5263
• feat(agent-server): shed gitignored workspace dirs of stopped runtimes above a disk budget by @VascoSch92 in #5407
• feat(agent-server): archive runtimes of long-inactive Docker conversations by @VascoSch92 in #5429
• refactor(sdk): replace settings and tool metadata probing with typed APIs by @MdTanwer in #5357
• fix(agent-server): omit acp/ credential dir from download-trajectory zip by @simonrosenberg in #5551
• Define typed ACP capability and session contracts by @MdTanwer in #5293
• feat(typescript-client): add HttpError.detail and isHttpError by @enyst in #5536
• fix(llm): stop string-serializing vision-capable DeepSeek v4 models by @cbagwell in #5467
• test(agent-server): real Docker scenario for storage reclaim by @VascoSch92 in #5548
• fix(agent-server): tolerate state saves while zipping a trajectory by @enyst in #5538
• fix(agent-server): remove a deleted local conversation's worktree, keep its branch by @VascoSch92 in #5547
• fix(terminal): preserve scripts across heredoc boundaries by @neubig in #5342
• fix(llm): stop dropping images when string serializer is forced by @neubig in #5460
• fix(container): refresh agent server security dependencies by @neubig in #5582
• feat(agent-server): expose requested_ref on installed canvas extensions by @VascoSch92 in #5341
• fix(file_editor): prefer valid UTF-8 encoding by @Shimada666 in #4784
• fix(agent-server): keep tmux socket paths within the Unix socket limit by @enyst in #5559
• fix(agent-server): resolve linked providers for plaintext profile reads by @enyst in #4952
• test(agent-server): avoid overlong tmux test socket paths on macOS by @enyst in #5619
• chore(agent-server): refresh npm pin and automate observed updates by @neubig in #5616
• feat(llm): add DigitalOcean Inference as a verified provider by @VascoSch92 in #5673
• feat(security): emit SecurityAnalysisEvent with the analyzer's verdict per action batch by @smolpaws in #5182
• chore: remove stale triage workflow and maintainer roster by @enyst in #5683
• fix(file-editor): preserve terminal newline semantics by @neubig in #5670
• feat(acp): discover an ACP agent's default and available models (and restore Gemini model handling) by @simonrosenberg in #5579
• test(integration): validate hard reset semantics in c02 by @neubig in #5671
• Release v1.54.0 by @all-hands-bot in #5609

New Contributors

• @vedjoshi1 made their first contribution in #5504
• @MdTanwer made their first contribution in #5357

Full Changelog: v1.53.0...v1.54.0