Chore/bump openhands sdk 1.41.0

[cbagwell]

HUMAN: Newer SDK/LiteLLM would be nice to have access to. Tested with Toad for ACP changes and with https://mcp.deepwiki.com/mcp for MCP changes. Broken into 2 commits if prefer to only update to SDK 1.31.0 for now.

AGENT:

End-to-end verification performed:

1. Dependency resolution & install: uv lock resolved cleanly, bumping
   openhands-sdk and openhands-tools to 1.41.0. uv sync installed
   the new versions with no errors. Verified the installed version reports
   1.41.0.

2. Full test suite: uv run pytest -q → 1428 passed, 3 failed. The 3
   failures are a pre-existing asyncio.get_event_loop() test-isolation issue
   in tests/test_web_command.py (confirmed to fail identically on unmodified
   main under the same full-suite run, and to pass in isolation) — unrelated
   to the SDK version.

3. MCP coercion runtime check: Verified at runtime that the migration
   helpers behave correctly:

   • Legacy {"mcpServers": ...} wrapper → flat dict[str, MCPServer]
   • fastmcp string auth "oauth" → strategy='oauth2'
   • fastmcp bearer token "tok123" → strategy='bearer' with secret value preserved
   • MCPServer dump round-trips cleanly via dump_mcp_config
   • getattr(server.auth, "strategy", None) returns None safely when auth is None

---

Why

openhands-sdk 1.28.1 is outdated. Along the upgrade path to 1.41.0, the SDK
introduced two API changes that require CLI code changes:

• agent-client-protocol 0.10.x renamed/reshaped ACP schema types
  (AuthMethod → AuthMethodAgent, new close_session, new kwargs) that the
  CLI's acp_impl must conform to.
• SDK >= 1.32 changed Agent.mcp_config from an opaque
  {"mcpServers": ...} wrapper to a flat dict[str, MCPServer]. Every CLI
  code path reading or writing mcp_config needed updating, and persisted
  agents saved by older versions need coercion on load.

Summary

• Bump openhands-sdk / openhands-tools from 1.28.1 to 1.41.0 and
  agent-client-protocol to >=0.10.1,<0.11.0; port acp_impl to the 0.10.x
  ACP API.
• Migrate all mcp_config handling to the flat dict[str, MCPServer] format,
  including backward-compat coercion of legacy {"mcpServers": ...} persisted
  agents on load.
• Migrate tests/fixtures to the flat format; add regression tests for legacy
  wrapper coercion, string auth, ACP header conversion, and the "Incoming on
  Restart" panel comparison.

Issue Number

#786

How to Test

git clone git@github.com:cbagwell/OpenHands-CLI.git
cd OpenHands-CLI
git checkout chore/bump-openhands-sdk-1.41.0
uv sync
uv run pytest -q

Expected: 1428 passed, 3 failed (the 3 test_web_command.py failures are
pre-existing event-loop isolation issues, not introduced by this PR — they
fail identically on main).

To specifically verify the MCP migration paths:

uv run pytest tests/settings/test_mcp_settings_reconciliation.py \
             tests/tui/panels/test_mcp_side_panel.py \
             tests/test_utils.py tests/acp/test_confirmation.py \
             tests/snapshots/test_app_snapshots.py -q

Expected: all pass.

Video/Screenshots

N/A — this is a dependency bump and internal API migration with no UI changes.
Snapshot tests (tests/snapshots/test_app_snapshots.py) confirm the TUI renders
identically before and after the migration.

Type

• Bug fix
• Feature
• Refactor
• Breaking change
• Docs / chore

Notes

• Backward compatibility: load_from_disk coerces pre-1.32 persisted
  {"mcpServers": ...} wrappers to the flat format at load, so existing users
  won't see a "corrupted file" error on upgrade. An uncoercible MCP config is
  dropped (not fatal); genuinely corrupted non-MCP fields still surface as
  corrupted. Covered by test_load_legacy_persisted_mcp_wrapper,
  test_load_persisted_mcp_with_fastmcp_string_auth,
  test_load_uncoercible_persisted_mcp_is_dropped, and
  test_load_non_mcp_validation_error_reports_corrupted.

[github-actions]

This PR is stale because it has been open for 40 days with no activity. Remove the stale label or leave a comment, otherwise it will be closed in 10 days.