chore(agent-server): use three-day Debian snapshot window

.github/scripts/update_debian_snapshot.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Advance the agent-server Debian snapshot after a seven-day observation period."""
+"""Advance the agent-server Debian snapshot after a three-day observation period."""
 
 from __future__ import annotations
 
@@ -10,7 +10,7 @@
 from pathlib import Path
 
 
-MINIMUM_AGE = timedelta(days=7)
+MINIMUM_AGE = timedelta(days=3)
 SNAPSHOT_RE = re.compile(r"(?m)^ARG DEBIAN_SNAPSHOT=(\d{8}T\d{6}Z)$")
 ARCHIVES = ("debian", "debian-security")
 

.github/workflows/update-debian-snapshot.yml

@@ -29,7 +29,7 @@ jobs:
               with:
                   token: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC }}
 
-            - name: Select the newest snapshot older than seven days
+            - name: Select the newest snapshot older than three days
               run: python .github/scripts/update_debian_snapshot.py --dockerfile "$DOCKERFILE"
 
             - name: Build binary-minimal
@@ -71,14 +71,14 @@ jobs:
                   git checkout -B "$BRANCH"
                   git add "$DOCKERFILE"
                   git commit -m "chore(agent-server): update Debian snapshot to $SNAPSHOT" \
-                    -m "Use the newest UTC snapshot that has completed the seven-day observation period." \
+                    -m "Use the newest UTC snapshot that has completed the three-day observation period." \
                     -m "Co-authored-by: openhands <openhands@all-hands.dev>"
                   git push --force-with-lease -u origin "$BRANCH"
 
                   BODY=$(cat <<EOF
                   ## Summary
 
-                  Advance the agent-server runtime to Debian snapshot \`$SNAPSHOT\`, the newest UTC snapshot that has completed the seven-day observation period.
+                  Advance the agent-server runtime to Debian snapshot \`$SNAPSHOT\`, the newest UTC snapshot that has completed the three-day observation period.
 
                   The workflow successfully built and scanned \`binary-minimal\` before opening this PR.
 

openhands-agent-server/openhands/agent_server/docker/Dockerfile

@@ -33,13 +33,12 @@ ARG INSTALL_CAPABILITIES=vscode,browser,docker
 # images. The final stage installs only the shared libraries required by Python
 # and Node; developer and package-manager tooling is added by the agent-server
 # stages below when needed. Package upgrades resolve against a dated snapshot so
-# newly published Debian packages have a seven-day observation period.
+# newly published Debian packages have a three-day observation period.
 ####################################################################################
 FROM python:3.13.15-slim-trixie AS python-runtime
 FROM node:24.21.0-trixie-slim AS node-runtime
 FROM debian:trixie-slim AS python-node-runtime
-# Temporary exception to pick up Debian 13.7 before the normal observation period.
-ARG DEBIAN_SNAPSHOT=20260913T000000Z
+ARG DEBIAN_SNAPSHOT=20260920T000000Z
 
 COPY --from=python-runtime /usr/local /usr/local
 COPY --from=node-runtime /usr/local/bin/node /usr/local/bin/node

tests/cross/test_update_debian_snapshot.py

@@ -13,20 +13,20 @@
 SPEC.loader.exec_module(snapshot)
 
 
-def test_eligible_snapshot_is_at_least_seven_days_old() -> None:
+def test_eligible_snapshot_is_at_least_three_days_old() -> None:
     now = datetime(2026, 9, 15, 12, 30, tzinfo=UTC)
 
     selected = snapshot.eligible_snapshot(now)
 
-    assert selected == datetime(2026, 9, 8, tzinfo=UTC)
-    assert now - selected >= timedelta(days=7)
+    assert selected == datetime(2026, 9, 12, tzinfo=UTC)
+    assert now - selected >= timedelta(days=3)
 
 
 def test_validate_snapshot_age_rejects_fresh_snapshot() -> None:
     now = datetime(2026, 9, 15, 12, 30, tzinfo=UTC)
 
     with pytest.raises(ValueError, match="minimum age"):
-        snapshot.validate_snapshot_age(now - timedelta(days=6), now)
+        snapshot.validate_snapshot_age(now - timedelta(days=2), now)
 
 
 def test_update_dockerfile_replaces_exactly_one_pin(tmp_path: Path) -> None: