fix(agent-server): resolve linked providers for plaintext profile reads

[enyst]

HUMAN:

---

AGENT:
I am an AI agent acting on behalf of Engel.

Why

OpenHands/extensions#547 selects a named LLM profile and passes its configuration to a new conversation, but plaintext profile reads currently omit a linked provider's API key and base URL.

Summary

• Resolve linked providers for GET /api/profiles/{name} with X-Expose-Secrets: plaintext.
• Preserve stored profiles, active defaults, and the existing unresolved behavior of ordinary and encrypted editor reads.
• Cover encrypted provider storage and credential rotation, plus real HTTP selection through RemoteWorkspace.get_llm(profile_name=...).

Issue Number

Supports OpenHands/extensions#548 and OpenHands/automation#430.

How to Test

uv run pytest tests/agent_server/test_profiles_router.py -q
uv run pytest tests/cross/test_remote_conversation_live_server.py -k 'workspace_named_llm_resolves_current_provider_credentials or workspace_default_llm_resolves_active_profile_despite_settings_drift' -q
uv run pre-commit run --files openhands-agent-server/openhands/agent_server/profiles_router.py tests/agent_server/test_profiles_router.py tests/cross/test_remote_conversation_live_server.py

Results: 106 profile tests passed; both live-server tests passed; all applicable pre-commit hooks passed.
The live test starts Uvicorn, creates a provider and profile through HTTP, selects the profile through the SDK, rotates the provider key, and confirms the next selection uses that key while the active default is unchanged.
The existing shared-provider test failed on the original route because the plaintext API key was None, then passed with this fix.

Type

• Bug fix

Notes

The GitHub connection rejected opening this PR in OpenHands/software-agent-sdk (403: resource not accessible by integration), so this reviewable PR targets the freshly synchronized fork main. Merging it here does not update upstream; apply commit 8e6ff575035022cb5a1b860761844c6d2756d3f6 to upstream for rollout.

This dependency must reach the deployed Agent Server before the extensions OpenHands#547 follow-up can run provider-linked profiles. No external LLM calls are used by these tests. Draft pending the repository's human review requirement.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Python API breakage checks — ✅ PASSED

Result: ✅ PASSED

Action log

[github-actions]

REST API breakage checks (OpenAPI) — ✅ PASSED

Result: ✅ PASSED

Action log

[enyst]

Relocated upstream: opened as OpenHands#4952 (base main). Closing this fork mirror. — smolpaws for Engel 🐾