chore: ratchet weak public API types

[neubig]

• A human has tested these changes.

---

Why

The client previously had no repository-wide guard against new or widened weak
public types. Important domain boundaries could silently degrade even when
generated Agent Server operations remained strong.

Fixes #300
Linear: OSS-6127

Summary

• Scan the built declaration graph reachable from every public package entry
  point and check in a reviewed budget of existing unknown sites.
• Fail CI when a weak site is added, widened, changed, or removed without
  permanently lowering the budget.
• Replace all remaining reachable public any declarations with unknown,
  with runtime narrowing for remote full-state events.
• Merge main (including the Agent Server 1.40.0 schema and the merged
  canonical MCP settings operations from feat: add canonical MCP settings operations #302/feat(events): mirror SDK event payloads #318) and refresh the weak-type
  budget for the events/types refactor.

Issue Number

#300 / OSS-6127

How to Test

• npm run build
• npm run test:public-type-budget
• npm run check:public-type-budget
• env -u AGENT_SERVER_URL npm run test:coverage — 18 suites, 304 tests
• npm run check:agent-server-api — checked-in contract is current for 1.40.0
• npm run test:agent-server-api-tooling
• npm run test:endpoint-audit-tooling
• npm run lint — 0 errors
• npm run format:check — all files formatted

Live evidence (AGENT)

Merge conflict resolution against main was validated locally on commit
cbfeeff:

$ npm run build                     # tsc + asset copy: OK
$ npm run test:public-type-budget   # public-type-budget self-test passed
$ npm run check:public-type-budget  # Public weak-type budget unchanged: 103 sites (0 any, 103 unknown)
$ npm run check:agent-server-api    # Checked-in Agent Server contract is current (1.40.0 artifact)
$ env -u AGENT_SERVER_URL npm run test:coverage  # 18 suites, 304 tests passed
$ npm run lint                      # 0 errors, 8 pre-existing warnings
$ npm run format:check              # All matched files use Prettier code style!

The budget refresh mirrors main's events/types refactor (handwritten
interfaces became schema-derived type aliases): six stale interface: budget
tuples were removed and two type: tuples added at the current fingerprints.

Video/Screenshots

Not applicable: this adds public type and CI enforcement without changing the
Canvas UI.

Type

• Bug fix
• Feature
• Refactor
• Breaking change
• Docs / chore

Notes

Depends on #302. Public domain contracts, generic transport internals, and
deliberately opaque Cloud proxy payloads have separate budget groups. Generated
Agent Server declarations remain governed by the SDK OpenAPI quality allowlist
and the pinned generated-file drift check.

[github-actions]

Endpoint audit

⚠️ 7 actionable Agent Server contract divergence(s) · report-only

Contract: pinned release artifact

Category	Count
Actionable client-only calls	0
Actionable server-only operations	7
Documented non-divergences	12
Agent Server contract operations	117
Audited handwritten client endpoints	118

Actionable client-only calls (0)

none

Actionable server-only operations (7)

• GET /api/conversations/{}/events
• GET /api/file/archive
• GET /api/git/commits
• GET /api/git/commits/{}/changes
• GET /api/init
• POST /api/conversations/{}/load_plugin
• POST /api/init

Documented non-divergences (12)

Client calls intentionally absent from the filtered contract (10)

• GET /
• GET /alive
• GET /health
• GET /ready
• GET /server_info

Reason: Operational Agent Server endpoints intentionally excluded from the filtered public release artifact.
Owner: OpenHands runtime maintainers

• DELETE /api/meta-profiles/{}
• GET /api/meta-profiles
• GET /api/meta-profiles/{}
• POST /api/meta-profiles/{}
• POST /api/meta-profiles/{}/activate

Reason: Client-ahead API stacked on the pending Agent Server meta-profiles implementation.
Owner: OpenHands SDK maintainers
Tracking: OpenHands/software-agent-sdk#3744

Server operations covered by an exposed browser URL (2)

• GET /api/conversations/{}/workspace
• GET /api/conversations/{}/workspace/{}

Reason: RemoteWorkspace.startWorkspaceSession exposes these authenticated URLs for browser iframe and file requests; they are not HttpClient method calls.
Owner: OpenHands TypeScript client maintainers