OpenHands 1.7.0 moves WebSocket authentication out of URLs and adds a persistent agent memory toggle

GitHub (OpenHands/OpenHands)·medium signalXBlueskyLinkedInCopy link

The July 29 release includes a security fix (PR #16095) authenticating WebSockets outside the URL, where credentials leak into proxy logs, browser history and referrer headers — a common failure mode in agent UIs that stream over sockets. It also adds a persistent agent memory toggle, always-visible LLM selection with agent-profile switching moved to the tools menu, and the ability to overwrite a secret value from the edit form. Two patch releases followed within 12 hours (1.7.1, 1.7.2), the latter adding Stryker mutation testing to the repo.