chore: agent-server (software-agent-sdk) to v1.38.0

[all-hands-bot]

Bump tracked agent-server / SDK version

Updates the pinned OpenHands software-agent-sdk / agent-server image from v1.37.0 to v1.38.0 (package.json config.agentServerImage, plus the integration-tests.yml, AGENTS.md, and README.md mirrors).

CI + integration tests on this PR run against ghcr.io/openhands/agent-server:1.38.0-python, validating the client against the new server before merge. This does not release the npm package.

Agent Server API change summary

• Generated TypeScript diff: +7584 / -8528 lines
• Added exported types: AgentSettings, AgentSettingsPatch, AgentSettingsPatchWritable, McpAuthCredential, McpConfig, McpConfigPatch, McpConfigPatchWritable, McpNoneAuthCredential, McpServer, McpServerPatch, McpServerPatchWritable, McpTestResponse, RemoteMcpServer, RemoteMcpServerWritable, SettingsUpdateRequestWritable, StdioMcpServer
• Removed exported types: AliveAliveGetData, AliveAliveGetResponse, AliveAliveGetResponses, Annotation, AnnotationUrlCitation, BrowserActionWithRisk, BrowserClickActionWithRisk, BrowserCloseTabActionWithRisk, BrowserGetContentActionWithRisk, BrowserGetStateActionWithRisk, BrowserGetStorageActionWithRisk, BrowserGoBackActionWithRisk, BrowserListTabsActionWithRisk, BrowserNavigateActionWithRisk, BrowserScrollActionWithRisk, BrowserSetStorageActionWithRisk, BrowserStartRecordingActionWithRisk, BrowserStopRecordingActionWithRisk, BrowserSwitchTabActionWithRisk, BrowserTypeActionWithRisk, ChatCompletion, ChatCompletionAudio, ChatCompletionMessage, ChatCompletionMessageCustomToolCall, ChatCompletionMessageFunctionToolCall, and 63 more
• Existing exported declarations may also contain field-level changes; review the generated diff.

Triggered by: software-agent-sdk v1.38.0 — https://github.com/OpenHands/software-agent-sdk/releases/tag/v1.38.0

---

Automatically created by the version-bump-prs workflow.

[github-actions]

Endpoint audit

⚠️ 7 actionable Agent Server contract divergence(s) · report-only

Contract: pinned release artifact

Category	Count
Actionable client-only calls	0
Actionable server-only operations	7
Documented non-divergences	12
Agent Server contract operations	114
Audited handwritten client endpoints	115

Actionable client-only calls (0)

none

Actionable server-only operations (7)

• GET /api/conversations/{}/events
• GET /api/file/archive
• GET /api/git/commits
• GET /api/git/commits/{}/changes
• GET /api/init
• POST /api/conversations/{}/load_plugin
• POST /api/init

Documented non-divergences (12)

Client calls intentionally absent from the filtered contract (10)

• GET /
• GET /alive
• GET /health
• GET /ready
• GET /server_info

Reason: Operational Agent Server endpoints intentionally excluded from the filtered public release artifact.
Owner: OpenHands runtime maintainers

• DELETE /api/meta-profiles/{}
• GET /api/meta-profiles
• GET /api/meta-profiles/{}
• POST /api/meta-profiles/{}
• POST /api/meta-profiles/{}/activate

Reason: Client-ahead API stacked on the pending Agent Server meta-profiles implementation.
Owner: OpenHands SDK maintainers
Tracking: OpenHands/software-agent-sdk#3744

Server operations covered by an exposed browser URL (2)

• GET /api/conversations/{}/workspace
• GET /api/conversations/{}/workspace/{}

Reason: RemoteWorkspace.startWorkspaceSession exposes these authenticated URLs for browser iframe and file requests; they are not HttpClient method calls.
Owner: OpenHands TypeScript client maintainers

[openhands-release-bot]

🚀 Released in v1.35.0.