chore: run make validate in a clean allowlist environment (#77)

[geeen-jp]

AGENT:
Implemented through the multi-agent pipeline (Claude Sonnet 5.5 medium design/review/triage, OpenAI GPT-6 Luna max implementation, OpenAI GPT-6.1 Sol high audit). On this host, with dummy sentinel files only: make validate rc 0 in 19m39s (dummy auth/secrets/config/persistence checksums unchanged, host sensitive-path checksums unchanged, sentinel absent from the log, git status --porcelain empty); the same make validate from a fresh clone with no .venv rc 0 in 17m39s (under 31 min, porcelain empty, dummy and host checksums unchanged). sdk_validate with CLAUDE_CODE_OAUTH_TOKEN and CLAUDE_AUTH_CODE unset: 2550 passed, 13 deselected.

Why

sdk#75 unset a fixed denylist (VALIDATE_UNSET_ENV) before make validate. VERIFY for sdk#73 still inherited OPENHANDS_SESSION_API_KEY, which is outside that list, and test_terminal_does_not_expose_session_api_key_via_env_command failed on the substring. A denylist misses the next injected name. make validate now starts from a clean allowlist instead.

Summary

• scripts/validate-env.sh runs the validation steps with env -i. The child receives PATH, LANG / LC_*, CI=true, UV_CACHE_DIR / UV_PYTHON_INSTALL_DIR / PRE_COMMIT_HOME (host cache locations, so a cold run stays within the time limit), and a throwaway HOME / TMPDIR that the script removes on exit. Parent OPENHANDS_*, OH_*, CLAUDE_*, OPENAI_*, CODEX_*, CURSOR_*, GH_TOKEN / GITHUB_*, and CLOUD_AGENT_* are not passed through.
• make validate calls that wrapper and then the same suites, pyright, pre-commit, and diff checks as before. VALIDATE_UNSET_ENV is gone. The Actions job name stays validate. .aidw/validation.json is unchanged (make validate only).
• The tests/conftest.py denylist strip is removed so the two approaches are not stacked. Direct uv run pytest is not isolated; tests that need a variable still set it with monkeypatch. tests/sdk/test_env_isolation.py checks the allowlist, the throwaway home, and the Makefile wiring, including a parent dummy OPENHANDS_SESSION_API_KEY.

Issue Number

Closes #77

How to Test

Export dummy OPENHANDS_SESSION_API_KEY plus representative OPENHANDS_*, OH_*, CLAUDE_*, OPENAI_*, CODEX_*, CURSOR_*, GH_TOKEN, GITHUB_TOKEN, and CLOUD_AGENT_* values (fake strings or paths under a temp dir you create). Then:

make validate

On this host that was rc 0 in 19m39s. sha256 of the dummy files and of the host sensitive paths matched before and after, the sentinel string was absent from the log, and porcelain was empty. A fresh clone of this branch with no .venv, same dummy env, finished in 17m39s with porcelain empty.

sdk_validate with the two OAuth variables unset passed (2550 passed, 13 deselected).

Type

• Bug fix
• Feature
• Refactor
• Docs / chore

Notes

Direct pytest isolation is not claimed. The allowlist lives only in scripts/validate-env.sh. Dummy variables were never pointed at /home/box/.codex or the runtime state dir. Host checksums covered Codex auth, OpenHands secrets and settings, profile json, and the runtime provider-credentials secrets file.

[github-actions]

Python API breakage checks — ✅ PASSED

Result: ✅ PASSED

Action log

[github-actions]

Endpoint audit

⚠️ 18 actionable Agent Server contract divergence(s) · report-only

Contract: pinned release artifact

Category	Count
Actionable client-only calls	0
Actionable server-only operations	18
Documented non-divergences	13
Agent Server contract operations	129
Audited handwritten client endpoints	119

Actionable client-only calls (0)

none

Actionable server-only operations (18)

• DELETE /api/canvas-extensions/installed/{}
• DELETE /api/llm/provider-connections/{}
• GET /api/canvas-extensions/installed
• GET /api/canvas-extensions/installed/{}
• GET /api/canvas-extensions/installed/{}/bundle
• GET /api/conversations/{}/events
• GET /api/file/archive
• GET /api/git/commits
• GET /api/git/commits/{}/changes
• GET /api/init
• GET /api/llm/provider-connections
• PATCH /api/canvas-extensions/installed/{}
• PATCH /api/llm/provider-connections/{}
• POST /api/canvas-extensions/install
• POST /api/conversations/{}/load_plugin
• POST /api/file/create_directory
• POST /api/init
• POST /api/llm/provider-connections

Documented non-divergences (13)

Client calls intentionally absent from the filtered contract (11)

• GET /
• GET /alive
• GET /health
• GET /ready
• GET /server_info

Reason: Operational Agent Server endpoints intentionally excluded from the filtered public release artifact.
Owner: OpenHands runtime maintainers

• DELETE /api/meta-profiles/{}
• GET /api/meta-profiles
• GET /api/meta-profiles/{}
• POST /api/meta-profiles/{}
• POST /api/meta-profiles/{}/activate

Reason: Client-ahead API stacked on the pending Agent Server meta-profiles implementation.
Owner: OpenHands SDK maintainers
Tracking: OpenHands#3744

• POST /api/profiles/{}/validate

Reason: Client-ahead API stacked on the pending Agent Server pre-flight LLM validation endpoint.
Owner: OpenHands TypeScript client maintainers
Tracking: OpenHands#4422

Server operations covered by an exposed browser URL (2)

• GET /api/conversations/{}/workspace
• GET /api/conversations/{}/workspace/{}

Reason: RemoteWorkspace.startWorkspaceSession exposes these authenticated URLs for browser iframe and file requests; they are not HttpClient method calls.
Owner: OpenHands TypeScript client maintainers

[github-actions]

📁 PR Artifacts Notice

This PR contains a .pr/ directory with temporary PR-specific documents. The directory will be automatically removed when the PR is approved.

[github-actions]

REST API breakage checks (OpenAPI) — ✅ PASSED

Result: ✅ PASSED

Action log

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	42846	11816	72%

report-only-changed-files is enabled. No files were changed during this commit :)