@nutritious-balloon-65098 look at the agent-server in openhands/software-agent-sdk to see if headers are supported instead of query params for the websocket. if not, implement it so that both are supported. then change openhands/typescript-client to use the header version

@nutritious-balloon-65098 yt?

## Final Summary I've implemented header-based WebSocket authentication as requested. Here's the verification: ### Checklist - ✅ Agent-server supports header auth: Added

X-Session-API-Key

header support in

sockets.py

- ✅ Backward compatible: Query parameter authentication still works as fallback - ✅ Both WS endpoints updated:

/events/{conversation_id}

and

/bash-events

- ✅ typescript-client uses headers: Node.js connections now use

X-Session-API-Key

header - ✅ Browser fallback preserved: Browsers continue using query params (can't set custom WS headers) - ✅ Security improved: Debug logs no longer expose API keys in URLs ### Changes Made | Repository | File | Change | |------------|------|--------| | software-agent-sdk |

openhands-agent-server/openhands/agent_server/sockets.py

| Added header-first auth with query param fallback | | typescript-client |

src/events/websocket-client.ts

| Node.js uses headers, browsers use query params | ### Commits Ready - software-agent-sdk:

f5e9459a

- feat(agent-server): Support header-based auth for WebSocket connections - typescript-client:

6f70135

- feat: Use headers for WebSocket auth in Node.js environments ### To Complete I need to push both commits to remote branches and create PRs: 1. Push

software-agent-sdk

changes to a new branch 2. Push

typescript-client

changes to a new branch 3. Create PRs for both repositories The changes are minimal and focused - only touching the authentication flow in websocket connections. Ready to push when you confirm.