[earakely-scale]

Follow-up to #281 (OpenHands) and #288/#293 (publishing and pulling the Claude Code agent's image).

Alias. aliases.toml gives OpenHands the alias openhands, so a task names it as openhands like claude-code and pi.

pi and OpenHands images on GHCR.

• AGENT_IMAGES in published_images.py is now one image per agent folder in the agents bundle (agentenv-<folder>) instead of a hand-kept list holding only Claude Code. A release builds, checks and publishes agentenv-pi and agentenv-openhands with agentenv-claude-code, for linux/amd64 and linux/arm64, after the protocol is on PyPI (their requirements already get the release's protocol pin). A deploy pulls them by digest, as feat(bundle): pull the shipped agent's published image instead of building it #293 does for Claude Code.
• infra_build.py, which the jobs that hold the push token run without agent-env, gains both in its allowlist and its smoke checks: pi runs pi --version and imports its server, OpenHands imports its server, which loads the OpenHands SDK. The existing tests require exactly that: the allowlist must equal the published images, and every image but service-db needs a smoke check. A future agent folder fails CI until it has both.
• published_images_test now checks every shipped agent folder's Dockerfile is published, not only Claude Code's.
• Dependabot bumps both images' base digests, like the other published images.

Built only when they change (#309). Rebased on #309, which stops a release from pinning an agent's protocol requirement, so a published agent image is built again only when its folder changes. That applies to pi's and OpenHands' images as soon as this publishes them: pi's floor is >=0.1.305 (from #309) and OpenHands' >=0.1.351, whose requirements.txt now explains the floor as the other two do. The README line that still said Claude Code's image is built "with the protocol pinned" now says it's built again only when its folder changes.

Simulated two releases on this branch (protocol 0.1.400, then 0.1.401), with each source tag computed after the release's pin step:

Agent	Unpinned	After 0.1.400	After 0.1.401
claude-code	dcd20d2f4796	same	same
openhands	221d399d13e5	same	same
pi	56e4c5440305	same	same

The pin step rewrote only the echo-mcp example env's requirements, as #309 intends.

Docs: AGENTS.md, CONTRIBUTING.md and the agents README say the shipped agents' images are published, not only Claude Code's, and name pi and OpenHands by their aliases.

Checked

• Unit: 1,354 passed after the rebase (published images, both release scripts, protocol pins, the bundle tests, alias and a2a-agent list tests, the agents' own tests).
• Both images built locally on arm64 (pi 48 s, OpenHands 35 s), and infra_build.py smoke passes on each: pi --version prints 1.1.0, and both servers import and build their agent cards.

After the release: v0.9.1349 published agentenv-pi and agentenv-openhands, and both pull anonymously, like agentenv-claude-code: no admin step was needed. The 0.9.1349 wheel records their digests.

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge.

Summary

Adds the openhands alias and publishes images for all three shipped agents.

• Releases publish an image for each shipped agent folder.
• Tasks can name the OpenHands agent as openhands.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Shipped agent folders] --> B[Discover published images]
  B --> C[Build and check amd64 and arm64]
  C --> D[Publish multi-platform images]
  D --> E[Record image digests in release wheel]
  E --> F[Deploy matching agent sources]
  F --> G[Pull by digest]
  G -->|Pull fails| H[Build from saved context]

Loading

_{Reviews (2) · Last reviewed commit: "feat(agents): alias OpenHands and publis..." · Reviewed by Greptile}