feat: add ProfilesClient.validateProfile for LLM pre-flight checks

[neubig]

Why

The agent-server is adding a pre-flight LLM validation endpoint
(POST /api/profiles/{name}/validate, software-agent-sdk PR #4422) so
LLM misconfigurations can be caught before a profile is saved. Agent
Canvas (OpenHands/OpenHands#16417) needs a typed client method to call it
instead of a generic request.

Summary

• ProfilesClient.validateProfile(name, request) → POST /api/profiles/{name}/validate.
• New ValidateProfileResponse / ValidateProfileError models exported from the package root.
• Endpoint-audit allowlist entry with tracking to software-agent-sdk PR #4422 (the endpoint is client-ahead of the pinned agent-server release).

Issue Number

• Add pre-flight LLM validation endpoint to prevent saving misconfigured LLM profiles OpenHands#16416
• software-agent-sdk#4429

How to Test

npm ci
npm run build
npm run lint
npm test -- --testPathPatterns=api-clients

Unit coverage: success verdict, valid:false error verdict, name
percent-encoding, and 404 surfacing as HttpError.

Video/Screenshots

N/A — library API addition; no UI.

Type

• Bug fix
• Feature
• Refactor
• Breaking change
• Docs / chore

Notes

• Draft: this method depends on the agent-server endpoint from
  software-agent-sdk PR #4422, which is not yet in a released agent-server
  image. The endpoint audit is report-only for this client-ahead API.
• A new @openhands/typescript-client release is required before
  dependent consumers can switch off the git-SHA pin.

This PR was created by an AI agent (OpenHands) on behalf of the user.

[github-actions]

Endpoint audit

⚠️ 7 actionable Agent Server contract divergence(s) · report-only

Contract: pinned release artifact

Category	Count
Actionable client-only calls	0
Actionable server-only operations	7
Documented non-divergences	13
Agent Server contract operations	117
Audited handwritten client endpoints	119

Actionable client-only calls (0)

none

Actionable server-only operations (7)

• GET /api/conversations/{}/events
• GET /api/file/archive
• GET /api/git/commits
• GET /api/git/commits/{}/changes
• GET /api/init
• POST /api/conversations/{}/load_plugin
• POST /api/init

Documented non-divergences (13)

Client calls intentionally absent from the filtered contract (11)

• GET /
• GET /alive
• GET /health
• GET /ready
• GET /server_info

Reason: Operational Agent Server endpoints intentionally excluded from the filtered public release artifact.
Owner: OpenHands runtime maintainers

• DELETE /api/meta-profiles/{}
• GET /api/meta-profiles
• GET /api/meta-profiles/{}
• POST /api/meta-profiles/{}
• POST /api/meta-profiles/{}/activate

Reason: Client-ahead API stacked on the pending Agent Server meta-profiles implementation.
Owner: OpenHands SDK maintainers
Tracking: OpenHands/software-agent-sdk#3744

• POST /api/profiles/{}/validate

Reason: Client-ahead API stacked on the pending Agent Server pre-flight LLM validation endpoint.
Owner: OpenHands TypeScript client maintainers
Tracking: OpenHands/software-agent-sdk#4422

Server operations covered by an exposed browser URL (2)

• GET /api/conversations/{}/workspace
• GET /api/conversations/{}/workspace/{}

Reason: RemoteWorkspace.startWorkspaceSession exposes these authenticated URLs for browser iframe and file requests; they are not HttpClient method calls.
Owner: OpenHands TypeScript client maintainers

[VascoSch92]

LGTM

[openhands-release-bot]

🚀 Released in v1.38.0.