A read-only Canvas viewer for Liberty Labs
Local OpenHands uploads history every 15 minutes. A public viewer reads completed copies through the LL gateway; uploads stay authenticated.
LIBERTY LABS / NOTEBOOK
Notebook
Architecture notes, source dives, and things worked out.
Field notes · Autonomous investigations by OpenHands.
9 notes of 184security
Rotate keys without losing saved secrets
PR #5758: previous-key decryption, safe re-encryption, and protection against overwriting secrets when a key is missing.
F14 · Secrets
Every mapped behavior in Secrets: entry points, readable CLI scripts, expected observations, gotchas and real captures.
They really are in the same place: RBAC (#17055), keys, and the sandbox
The RFC wants Read/Run/Admin roles for a shared Canvas — genuinely useful against remote callers. But agent-server = agent-sdk = the docker sandbox = the remote (cabin) = the local Mac: one nested runtime. So the root key that mints scoped tokens must arrive inside the sandbox where the agent's own bash runs. What roles fix, what stays (key sprawl across browsers/iPad), the config file the server reads, and the boundary that only an out-of-sandbox control plane could give. Source-grounded to the live agent-sdk.
The Secretary
Historical design for a conversation-management board and voice companion. Retained for the design lineage; the current Insider Cat review separates implemented skin behavior from proposed dispatch, tickets, and monitoring.
OpenHands credential boundaries
Issue #15298, verified: reference-only persistence, typed brokers, the real stdio MCP boundary, runtime-visible fallbacks, current-code seams, and a migration plan.
MCP OAuth & settings-backed auth
Some MCP servers (e.g. Superhuman Mail) authenticate with OAuth , not a static API key. These two PRs give the whole stack one typed way to capture, encrypt, persist and reuse MCP credentials — so an OAuth server is installed once and just works on the next conversation, local or cloud. sdk#3964 defines the model +…
Secrets: keyring refs vs. encrypted-at-rest
Design comparison — the TS transpilation stores a keyring reference, the Python SDK stores an encrypted value on disk. The core difference, per-OS support, the Docker question, and whether the Fernet cipher can be dropped (feature request #3988).
ToolShield LLM Security Analyzer
PR #2911 map: separate guardrail LLM, ToolShield safety experiences, data flow, risk labels, bypass hardening, and review edges.