[codex] Fix loopback backend fetch failures by neubig · Pull Request #754 · OpenHands/agent-canvas

neubig · 2026-05-25T02:32:29Z

Summary

Fixes browser-level Failed to fetch failures when agent-canvas is opened from a remote hostname but the stored local backend still points at loopback (localhost / 127.0.0.1). The existing browser-origin fallback only applied to the default agent-server config path, so stored backend entries could still make typed SDK clients and local proxy callers fetch an unreachable loopback URL from the user's browser.

Changes

Add resolveBrowserReachableAgentServerBaseUrl() and use it for agent-server client options.
Use the same normalization for local cloud-proxy callers, device-flow proxy calls, and local automation base URLs.
Add regression coverage for typed client options, cloud proxy posting, device flow proxy posting, and the shared URL resolver.

Validation

npm test -- __tests__/api/agent-server-config.test.ts __tests__/api/agent-server-client-options.test.ts __tests__/api/cloud/proxy.test.ts __tests__/api/device-flow-client.test.ts
npm run typecheck && npm run build

🐳 Docker images for this PR

• GHCR package: https://github.com/OpenHands/agent-canvas/pkgs/container/agent-canvas

Component	Value
Image	`ghcr.io/openhands/agent-canvas`
Architectures	amd64, arm64
Agent Server	`ghcr.io/openhands/agent-server:1.23.0-python`
Automation	`openhands-automation==1.0.0a3`
Commit	`d7c16e2e726f719b2c240ddf5c143e6f98ac0dad`

Pull (multi-arch manifest)

# Multi-arch manifest — Docker automatically pulls the correct architecture
docker pull ghcr.io/openhands/agent-canvas:sha-d7c16e2

Run

docker run -it --rm \
  -p 8000:8000 \
  ghcr.io/openhands/agent-canvas:sha-d7c16e2

All tags pushed for this build

ghcr.io/openhands/agent-canvas:sha-d7c16e2-amd64
ghcr.io/openhands/agent-canvas:codex-fix-loopback-backend-fetch-toast-amd64
ghcr.io/openhands/agent-canvas:pr-754-amd64
ghcr.io/openhands/agent-canvas:sha-d7c16e2-arm64
ghcr.io/openhands/agent-canvas:codex-fix-loopback-backend-fetch-toast-arm64
ghcr.io/openhands/agent-canvas:pr-754-arm64
ghcr.io/openhands/agent-canvas:sha-d7c16e2
ghcr.io/openhands/agent-canvas:codex-fix-loopback-backend-fetch-toast
ghcr.io/openhands/agent-canvas:pr-754

About Multi-Architecture Support

Each tag (e.g., sha-d7c16e2) is a multi-arch manifest supporting both amd64 and arm64
Docker automatically pulls the correct architecture for your platform
Individual architecture tags (e.g., sha-d7c16e2-amd64) are also available if needed

vercel · 2026-05-25T02:32:34Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agent-canvas	Ready	Preview, Comment	May 25, 2026 4:05pm

neubig · 2026-05-25T02:44:28Z

@OpenHands /iterate

openhands-ai · 2026-05-25T02:44:53Z

I'm on it! neubig can track my progress at all-hands.dev

Co-authored-by: openhands <openhands@all-hands.dev>

all-hands-bot

🟢 Good taste - Elegant, centralized solution to a real browser connectivity issue.

Key strengths:

Solves the specific problem: remote browsers can't reach loopback backend URLs
Centralized in resolveBrowserReachableAgentServerBaseUrl() and applied consistently across all call sites
Comprehensive test coverage for both loopback resolution and non-loopback preservation
Backward compatible - only affects the problematic scenario

[RISK ASSESSMENT]

[Overall PR] ⚠️ Risk Assessment: 🟢 LOW

Focused bug fix with no breaking changes. Logic is sound and well-tested.

VERDICT:
✅ Worth merging - Clean implementation with proper test coverage.

Was this automated review useful? React with 👍 or 👎 to this review to help us measure review quality.
Workflow run: https://github.com/OpenHands/agent-canvas/actions/runs/26380965296

openhands-ai · 2026-05-25T03:09:16Z

Since the last summary, there were no additional code changes or tool actions.

Final status:

✅ The requested PR iteration was completed.
✅ The CI failure was fixed with a concise test-only change.
✅ The fix was committed and pushed to PR [codex] Fix loopback backend fetch failures #754.
✅ Local validation passed (npm test, npm run typecheck, npm run build).
✅ GitHub checks passed on the latest SHA.
✅ The PR was marked ready for review.
✅ The automated review approved the PR.
✅ No unresolved review threads remain.
✅ No extraneous changes were made beyond updating the missing test mocks.

The PR is merge-ready.

neubig · 2026-05-25T15:52:30Z

@OpenHands I think we may need to think this through more carefully. Would this break the situation where someone is looking at separately-hosted frontend, but the agent-server backend is running on the local machine?

openhands-ai · 2026-05-25T15:53:05Z

I'm on it! neubig can track my progress at all-hands.dev

Co-authored-by: openhands <openhands@all-hands.dev>

neubig · 2026-05-25T16:04:26Z

Thanks for calling this out — yes, the previous version of the PR was too broad and could break that setup. It rewrote any loopback backend whenever the browser hostname was non-loopback, so a separately hosted frontend that intentionally talks to http://localhost:<port> on the user's machine could have been redirected to the frontend origin instead.

I pushed d7c16e2e to narrow the fallback:

loopback backends are rewritten to window.location.origin only for known proxy-capable All Hands runtime/work hosts (*.prod-runtime.all-hands.dev / *.staging-runtime.all-hands.dev), where the frontend origin proxies /api and /sockets back into the same runtime;
generic separately hosted frontends now preserve loopback hosts, so browser requests continue targeting the user's local agent-server;
added regression coverage for the hosted-frontend case across the shared resolver, typed client options, cloud proxy, and device-flow proxy paths.

Validation passed:

npm test -- __tests__/api/agent-server-config.test.ts __tests__/api/agent-server-client-options.test.ts __tests__/api/cloud/proxy.test.ts __tests__/api/device-flow-client.test.ts
npm run typecheck
npm run build

This comment was created by an AI agent (OpenHands) on behalf of the user.

openhands-ai · 2026-05-25T16:05:19Z

Since the last summary, there were no additional tool actions or code changes.

Final status:

✅ The PR comment was addressed completely.
✅ The reviewer’s concern was confirmed as valid: the prior fallback could have broken separately hosted frontends that intentionally connect to a user-local localhost agent-server.
✅ A concise fix was pushed in commit d7c16e2e, narrowing loopback rewriting to known proxy-capable All Hands runtime hosts only.
✅ Regression coverage was added for the hosted-frontend/local-backend case across the resolver, typed client options, cloud proxy, and device-flow proxy paths.
✅ Local validation passed:
- targeted npm test
- npm run typecheck
- npm run build
✅ A PR comment was posted explaining the issue, the fix, and validation results.
✅ The changes are focused and not extraneous; no revert is needed.

github-actions · 2026-05-25T16:12:50Z

📸 Snapshot Test Report

Warning

Snapshot comparison step crashed (timeout, OOM, or runner error) — diff results below may be incomplete or absent.
Check the CI logs for the full error output (look for the "Run snapshot comparison" step).

❌ 1 snapshot differ from the main branch baseline. Add the update-snapshots label to acknowledge intentional changes.

Category	Count
🔴 Changed	1
🆕 New	0
✅ Unchanged	72
Total	73

How to resolve:

Unintentional diffs — the baselines on main may have moved since this branch was created. Merge the latest main into this branch and re-run CI.

Intentional changes — add the update-snapshots label. CI will pass and the new screenshots become the baseline when this PR merges.

🔴 Changed snapshots (1)

`changes-tab`

changes-diff-viewer

Expected (main)	Actual (PR)	Diff

✅ Unchanged snapshots (72)

archived-conversation

conversation-panel-with-archived-badges
conversation-view-archived
conversation-view-sandbox-error

automations

automations-delete-modal
automations-list-active-inactive
automations-no-automations
automations-search-no-results

backends-extended

backend-add-blank-disabled
backend-add-cloud-advanced-open
backend-add-cloud-no-key-disabled
backend-add-cloud-with-key-enabled
backend-add-form-partially-filled
backend-add-invalid-url-disabled
backend-add-local-ready
backend-add-name-only-disabled
backend-add-two-column-layout
backend-add-whitespace-host-disabled
backend-after-switch
backend-cancel-nothing-saved
backend-dropdown-two-backends
backend-edit-prefilled
backend-manage-after-removal
backend-manage-two-listed
backend-remove-cancelled
backend-remove-confirmation
backend-switch-overlay

backends

backend-add-modal
backend-manage-modal
backend-selector-open

changes-tab

changes-deleted-file
changes-empty

collapsible-thinking

reasoning-content-collapsed
reasoning-content-expanded
think-action-collapsed
think-action-expanded

mcp-page

mcp-custom-server-1-editor-open
mcp-custom-server-2-url-filled
mcp-custom-server-3-all-filled
mcp-custom-server-4-installed
mcp-custom-server-editor
mcp-empty-installed
mcp-search-filtered
mcp-slack-install-1-marketplace
mcp-slack-install-2-modal
mcp-slack-install-3-filled
mcp-slack-install-4-installed

onboarding

onboarding-step-0-choose-agent
onboarding-step-1-check-backend
onboarding-step-2-setup-llm
onboarding-step-3-say-hello

projects-workspace-browser

projects-workspace-browser

settings-page

add-backend-modal
analytics-consent-modal
home-screen
settings-app-page
settings-page

settings-secrets

secrets-add-form-filled
secrets-add-form
secrets-after-save
secrets-delete-confirm
secrets-list

settings-verification

condenser-settings
verification-settings-off
verification-settings-on

sidebar

sidebar-collapsed
sidebar-conversation-panel
sidebar-filter-menu

skills-page

skills-empty
skills-loaded
skills-no-match
skills-search-filtered
skills-type-filter

Generated by the Snapshot Tests workflow. This comment was created by an AI agent (OpenHands) on behalf of the repo maintainers.

Fix loopback backend fetch failures

05cb7b5

vercel Bot deployed to Preview May 25, 2026 02:33 View deployment

fix: update agent-server config mocks

236534f

Co-authored-by: openhands <openhands@all-hands.dev>

vercel Bot deployed to Preview May 25, 2026 02:53 View deployment

neubig marked this pull request as ready for review May 25, 2026 03:03

all-hands-bot approved these changes May 25, 2026

View reviewed changes

neubig marked this pull request as draft May 25, 2026 11:53

fix: preserve loopback backends on hosted frontends

d7c16e2

Co-authored-by: openhands <openhands@all-hands.dev>

vercel Bot deployed to Preview May 25, 2026 16:05 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[codex] Fix loopback backend fetch failures#754

[codex] Fix loopback backend fetch failures#754
neubig wants to merge 3 commits into
mainfrom
codex/fix-loopback-backend-fetch-toast

neubig commented May 25, 2026 •

edited by github-actions Bot

Loading

Uh oh!

vercel Bot commented May 25, 2026 •

edited

Loading

Uh oh!

neubig commented May 25, 2026

Uh oh!

openhands-ai Bot commented May 25, 2026

Uh oh!

all-hands-bot left a comment

Uh oh!

openhands-ai Bot commented May 25, 2026

Uh oh!

neubig commented May 25, 2026

Uh oh!

openhands-ai Bot commented May 25, 2026

Uh oh!

neubig commented May 25, 2026

Uh oh!

openhands-ai Bot commented May 25, 2026

Uh oh!

github-actions Bot commented May 25, 2026

`changes-tab`

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

neubig commented May 25, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Validation

Uh oh!

vercel Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

neubig commented May 25, 2026

Uh oh!

openhands-ai Bot commented May 25, 2026

Uh oh!

all-hands-bot left a comment

Choose a reason for hiding this comment

Uh oh!

openhands-ai Bot commented May 25, 2026

Uh oh!

neubig commented May 25, 2026

Uh oh!

openhands-ai Bot commented May 25, 2026

Uh oh!

neubig commented May 25, 2026

Uh oh!

openhands-ai Bot commented May 25, 2026

Uh oh!

github-actions Bot commented May 25, 2026

📸 Snapshot Test Report

changes-tab

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

neubig commented May 25, 2026 •

edited by github-actions Bot

Loading

vercel Bot commented May 25, 2026 •

edited

Loading

`changes-tab`