diff --git a/.github/workflows/ghcr-build.yml b/.github/workflows/ghcr-build.yml
index addfd9610427..6ec93e78d1db 100644
--- a/.github/workflows/ghcr-build.yml
+++ b/.github/workflows/ghcr-build.yml
@@ -56,7 +56,7 @@ jobs:
           docker-images: false
           swap-storage: true
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.2.0
+        uses: docker/setup-qemu-action@v3.3.0
         with:
           image: tonistiigi/binfmt:latest
       - name: Login to GHCR
@@ -119,7 +119,7 @@ jobs:
           docker-images: false
           swap-storage: true
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.2.0
+        uses: docker/setup-qemu-action@v3.3.0
         with:
           image: tonistiigi/binfmt:latest
       - name: Login to GHCR
diff --git a/.github/workflows/openhands-resolver.yml b/.github/workflows/openhands-resolver.yml
index a9d90c38b139..028316ee05d5 100644
--- a/.github/workflows/openhands-resolver.yml
+++ b/.github/workflows/openhands-resolver.yml
@@ -184,7 +184,6 @@ jobs:
             });
 
       - name: Install OpenHands
-        id: install_openhands
         uses: actions/github-script@v7
         env:
           COMMENT_BODY: ${{ github.event.comment.body || '' }}
@@ -197,6 +196,7 @@ jobs:
             const reviewBody = process.env.REVIEW_BODY.trim();
             const labelName = process.env.LABEL_NAME.trim();
             const eventName = process.env.EVENT_NAME.trim();
+
             // Check conditions
             const isExperimentalLabel = labelName === "fix-me-experimental";
             const isIssueCommentExperimental =
@@ -205,9 +205,6 @@ jobs:
             const isReviewCommentExperimental =
               eventName === "pull_request_review" && reviewBody.includes("@openhands-agent-exp");
 
-            // Set output variable
-            core.setOutput('isExperimental', isExperimentalLabel || isIssueCommentExperimental || isReviewCommentExperimental);
-
             // Perform package installation
             if (isExperimentalLabel || isIssueCommentExperimental || isReviewCommentExperimental) {
               console.log("Installing experimental OpenHands...");
@@ -233,8 +230,7 @@ jobs:
             --issue-number ${{ env.ISSUE_NUMBER }} \
             --issue-type ${{ env.ISSUE_TYPE }} \
             --max-iterations ${{ env.MAX_ITERATIONS }} \
-            --comment-id ${{ env.COMMENT_ID }} \
-            --is-experimental ${{ steps.install_openhands.outputs.isExperimental }}
+            --comment-id ${{ env.COMMENT_ID }}
 
       - name: Check resolution result
         id: check_result
diff --git a/Development.md b/Development.md
index 3ac856c2cea6..2fa18cfa91c1 100644
--- a/Development.md
+++ b/Development.md
@@ -100,7 +100,7 @@ poetry run pytest ./tests/unit/test_*.py
 To reduce build time (e.g., if no changes were made to the client-runtime component), you can use an existing Docker container image by
 setting the SANDBOX_RUNTIME_CONTAINER_IMAGE environment variable to the desired Docker image.
 
-Example: `export SANDBOX_RUNTIME_CONTAINER_IMAGE=ghcr.io/all-hands-ai/runtime:0.19-nikolaik`
+Example: `export SANDBOX_RUNTIME_CONTAINER_IMAGE=ghcr.io/all-hands-ai/runtime:0.20-nikolaik`
 
 ## Develop inside Docker container
 
diff --git a/README.md b/README.md
index b4f8384be94e..cdc8694815a6 100644
--- a/README.md
+++ b/README.md
@@ -43,17 +43,17 @@ See the [Installation](https://docs.all-hands.dev/modules/usage/installation) gu
 system requirements and more information.
 
 ```bash
-docker pull docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik
+docker pull docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik
 
 docker run -it --rm --pull=always \
-    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik \
+    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik \
     -e LOG_ALL_EVENTS=true \
     -v /var/run/docker.sock:/var/run/docker.sock \
     -v ~/.openhands-state:/.openhands-state \
     -p 3000:3000 \
     --add-host host.docker.internal:host-gateway \
     --name openhands-app \
-    docker.all-hands.dev/all-hands-ai/openhands:0.19
+    docker.all-hands.dev/all-hands-ai/openhands:0.20
 ```
 
 You'll find OpenHands running at [http://localhost:3000](http://localhost:3000)!
diff --git a/containers/dev/compose.yml b/containers/dev/compose.yml
index 582774206e44..f12593cd33f4 100644
--- a/containers/dev/compose.yml
+++ b/containers/dev/compose.yml
@@ -11,7 +11,7 @@ services:
       - BACKEND_HOST=${BACKEND_HOST:-"0.0.0.0"}
       - SANDBOX_API_HOSTNAME=host.docker.internal
       #
-      - SANDBOX_RUNTIME_CONTAINER_IMAGE=${SANDBOX_RUNTIME_CONTAINER_IMAGE:-ghcr.io/all-hands-ai/runtime:0.19-nikolaik}
+      - SANDBOX_RUNTIME_CONTAINER_IMAGE=${SANDBOX_RUNTIME_CONTAINER_IMAGE:-ghcr.io/all-hands-ai/runtime:0.20-nikolaik}
       - SANDBOX_USER_ID=${SANDBOX_USER_ID:-1234}
       - WORKSPACE_MOUNT_PATH=${WORKSPACE_BASE:-$PWD/workspace}
     ports:
diff --git a/docker-compose.yml b/docker-compose.yml
index f5b3b55583bc..b330a7228eae 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,7 +7,7 @@ services:
     image: openhands:latest
     container_name: openhands-app-${DATE:-}
     environment:
-      - SANDBOX_RUNTIME_CONTAINER_IMAGE=${SANDBOX_RUNTIME_CONTAINER_IMAGE:-docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik}
+      - SANDBOX_RUNTIME_CONTAINER_IMAGE=${SANDBOX_RUNTIME_CONTAINER_IMAGE:-docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik}
       #- SANDBOX_USER_ID=${SANDBOX_USER_ID:-1234} # enable this only if you want a specific non-root sandbox user but you will have to manually adjust permissions of openhands-state for this user
       - WORKSPACE_MOUNT_PATH=${WORKSPACE_BASE:-$PWD/workspace}
     ports:
diff --git a/docs/i18n/fr/docusaurus-plugin-content-docs/current/usage/how-to/cli-mode.md b/docs/i18n/fr/docusaurus-plugin-content-docs/current/usage/how-to/cli-mode.md
index 7883ddb1050b..e91f8050b016 100644
--- a/docs/i18n/fr/docusaurus-plugin-content-docs/current/usage/how-to/cli-mode.md
+++ b/docs/i18n/fr/docusaurus-plugin-content-docs/current/usage/how-to/cli-mode.md
@@ -52,7 +52,7 @@ LLM_API_KEY="sk_test_12345"
 ```bash
 docker run -it \
     --pull=always \
-    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik \
+    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik \
     -e SANDBOX_USER_ID=$(id -u) \
     -e WORKSPACE_MOUNT_PATH=$WORKSPACE_BASE \
     -e LLM_API_KEY=$LLM_API_KEY \
@@ -61,7 +61,7 @@ docker run -it \
     -v /var/run/docker.sock:/var/run/docker.sock \
     --add-host host.docker.internal:host-gateway \
     --name openhands-app-$(date +%Y%m%d%H%M%S) \
-    docker.all-hands.dev/all-hands-ai/openhands:0.19 \
+    docker.all-hands.dev/all-hands-ai/openhands:0.20 \
     python -m openhands.core.cli
 ```
 
diff --git a/docs/i18n/fr/docusaurus-plugin-content-docs/current/usage/how-to/headless-mode.md b/docs/i18n/fr/docusaurus-plugin-content-docs/current/usage/how-to/headless-mode.md
index debe50e6253c..6341b9bdd91f 100644
--- a/docs/i18n/fr/docusaurus-plugin-content-docs/current/usage/how-to/headless-mode.md
+++ b/docs/i18n/fr/docusaurus-plugin-content-docs/current/usage/how-to/headless-mode.md
@@ -46,7 +46,7 @@ LLM_API_KEY="sk_test_12345"
 ```bash
 docker run -it \
     --pull=always \
-    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik \
+    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik \
     -e SANDBOX_USER_ID=$(id -u) \
     -e WORKSPACE_MOUNT_PATH=$WORKSPACE_BASE \
     -e LLM_API_KEY=$LLM_API_KEY \
@@ -56,6 +56,6 @@ docker run -it \
     -v /var/run/docker.sock:/var/run/docker.sock \
     --add-host host.docker.internal:host-gateway \
     --name openhands-app-$(date +%Y%m%d%H%M%S) \
-    docker.all-hands.dev/all-hands-ai/openhands:0.19 \
+    docker.all-hands.dev/all-hands-ai/openhands:0.20 \
     python -m openhands.core.main -t "write a bash script that prints hi" --no-auto-continue
 ```
diff --git a/docs/i18n/fr/docusaurus-plugin-content-docs/current/usage/installation.mdx b/docs/i18n/fr/docusaurus-plugin-content-docs/current/usage/installation.mdx
index 733a39c5c3ae..7c7057f7217d 100644
--- a/docs/i18n/fr/docusaurus-plugin-content-docs/current/usage/installation.mdx
+++ b/docs/i18n/fr/docusaurus-plugin-content-docs/current/usage/installation.mdx
@@ -13,16 +13,16 @@
 La façon la plus simple d'exécuter OpenHands est avec Docker.
 
 ```bash
-docker pull docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik
+docker pull docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik
 
 docker run -it --rm --pull=always \
-    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik \
+    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik \
     -e LOG_ALL_EVENTS=true \
     -v /var/run/docker.sock:/var/run/docker.sock \
     -p 3000:3000 \
     --add-host host.docker.internal:host-gateway \
     --name openhands-app \
-    docker.all-hands.dev/all-hands-ai/openhands:0.19
+    docker.all-hands.dev/all-hands-ai/openhands:0.20
 ```
 
 Vous pouvez également exécuter OpenHands en mode [headless scriptable](https://docs.all-hands.dev/modules/usage/how-to/headless-mode), en tant que [CLI interactive](https://docs.all-hands.dev/modules/usage/how-to/cli-mode), ou en utilisant l'[Action GitHub OpenHands](https://docs.all-hands.dev/modules/usage/how-to/github-action).
diff --git a/docs/i18n/fr/docusaurus-plugin-content-docs/current/usage/runtimes.md b/docs/i18n/fr/docusaurus-plugin-content-docs/current/usage/runtimes.md
index c9662bfc9f4d..53035ee400fb 100644
--- a/docs/i18n/fr/docusaurus-plugin-content-docs/current/usage/runtimes.md
+++ b/docs/i18n/fr/docusaurus-plugin-content-docs/current/usage/runtimes.md
@@ -13,7 +13,7 @@ C'est le Runtime par défaut qui est utilisé lorsque vous démarrez OpenHands.
 
 ```
 docker run # ...
-    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik \
+    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik \
     -v /var/run/docker.sock:/var/run/docker.sock \
     # ...
 ```
diff --git a/docs/i18n/zh-Hans/docusaurus-plugin-content-docs/current/usage/how-to/cli-mode.md b/docs/i18n/zh-Hans/docusaurus-plugin-content-docs/current/usage/how-to/cli-mode.md
index 2bec7449c35b..955073185f87 100644
--- a/docs/i18n/zh-Hans/docusaurus-plugin-content-docs/current/usage/how-to/cli-mode.md
+++ b/docs/i18n/zh-Hans/docusaurus-plugin-content-docs/current/usage/how-to/cli-mode.md
@@ -50,7 +50,7 @@ LLM_API_KEY="sk_test_12345"
 ```bash
 docker run -it \
     --pull=always \
-    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik \
+    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik \
     -e SANDBOX_USER_ID=$(id -u) \
     -e WORKSPACE_MOUNT_PATH=$WORKSPACE_BASE \
     -e LLM_API_KEY=$LLM_API_KEY \
@@ -59,7 +59,7 @@ docker run -it \
     -v /var/run/docker.sock:/var/run/docker.sock \
     --add-host host.docker.internal:host-gateway \
     --name openhands-app-$(date +%Y%m%d%H%M%S) \
-    docker.all-hands.dev/all-hands-ai/openhands:0.19 \
+    docker.all-hands.dev/all-hands-ai/openhands:0.20 \
     python -m openhands.core.cli
 ```
 
diff --git a/docs/i18n/zh-Hans/docusaurus-plugin-content-docs/current/usage/how-to/headless-mode.md b/docs/i18n/zh-Hans/docusaurus-plugin-content-docs/current/usage/how-to/headless-mode.md
index 606d7c1184bd..3a507dc91cdf 100644
--- a/docs/i18n/zh-Hans/docusaurus-plugin-content-docs/current/usage/how-to/headless-mode.md
+++ b/docs/i18n/zh-Hans/docusaurus-plugin-content-docs/current/usage/how-to/headless-mode.md
@@ -47,7 +47,7 @@ LLM_API_KEY="sk_test_12345"
 ```bash
 docker run -it \
     --pull=always \
-    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik \
+    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik \
     -e SANDBOX_USER_ID=$(id -u) \
     -e WORKSPACE_MOUNT_PATH=$WORKSPACE_BASE \
     -e LLM_API_KEY=$LLM_API_KEY \
@@ -57,6 +57,6 @@ docker run -it \
     -v /var/run/docker.sock:/var/run/docker.sock \
     --add-host host.docker.internal:host-gateway \
     --name openhands-app-$(date +%Y%m%d%H%M%S) \
-    docker.all-hands.dev/all-hands-ai/openhands:0.19 \
+    docker.all-hands.dev/all-hands-ai/openhands:0.20 \
     python -m openhands.core.main -t "write a bash script that prints hi" --no-auto-continue
 ```
diff --git a/docs/i18n/zh-Hans/docusaurus-plugin-content-docs/current/usage/installation.mdx b/docs/i18n/zh-Hans/docusaurus-plugin-content-docs/current/usage/installation.mdx
index f49e1270e7d5..ff126b10120c 100644
--- a/docs/i18n/zh-Hans/docusaurus-plugin-content-docs/current/usage/installation.mdx
+++ b/docs/i18n/zh-Hans/docusaurus-plugin-content-docs/current/usage/installation.mdx
@@ -11,16 +11,16 @@
 在 Docker 中运行 OpenHands 是最简单的方式。
 
 ```bash
-docker pull docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik
+docker pull docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik
 
 docker run -it --rm --pull=always \
-    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik \
+    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik \
     -e LOG_ALL_EVENTS=true \
     -v /var/run/docker.sock:/var/run/docker.sock \
     -p 3000:3000 \
     --add-host host.docker.internal:host-gateway \
     --name openhands-app \
-    docker.all-hands.dev/all-hands-ai/openhands:0.19
+    docker.all-hands.dev/all-hands-ai/openhands:0.20
 ```
 
 你也可以在可脚本化的[无头模式](https://docs.all-hands.dev/modules/usage/how-to/headless-mode)下运行 OpenHands，作为[交互式 CLI](https://docs.all-hands.dev/modules/usage/how-to/cli-mode)，或使用 [OpenHands GitHub Action](https://docs.all-hands.dev/modules/usage/how-to/github-action)。
diff --git a/docs/i18n/zh-Hans/docusaurus-plugin-content-docs/current/usage/runtimes.md b/docs/i18n/zh-Hans/docusaurus-plugin-content-docs/current/usage/runtimes.md
index ec6d3152e754..3f59e491417d 100644
--- a/docs/i18n/zh-Hans/docusaurus-plugin-content-docs/current/usage/runtimes.md
+++ b/docs/i18n/zh-Hans/docusaurus-plugin-content-docs/current/usage/runtimes.md
@@ -11,7 +11,7 @@
 
 ```
 docker run # ...
-    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik \
+    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik \
     -v /var/run/docker.sock:/var/run/docker.sock \
     # ...
 ```
diff --git a/docs/modules/usage/configuration-options.md b/docs/modules/usage/configuration-options.md
index d097c6b51147..d3281a235b84 100644
--- a/docs/modules/usage/configuration-options.md
+++ b/docs/modules/usage/configuration-options.md
@@ -7,53 +7,11 @@ If you are running in [GUI Mode](https://docs.all-hands.dev/modules/usage/how-to
 take precedence.
 :::
 
----
-
-# Table of Contents
-
-- [Core Configuration](#core-configuration)
-   - [API Keys](#api-keys)
-   - [Workspace](#workspace)
-   - [Debugging and Logging](#debugging-and-logging)
-   - [Session Management](#session-management)
-   - [Trajectories](#trajectories)
-   - [File Store](#file-store)
-   - [Task Management](#task-management)
-   - [Sandbox Configuration](#sandbox-configuration)
-   - [Miscellaneous](#miscellaneous)
-- [LLM Configuration](#llm-configuration)
-   - [AWS Credentials](#aws-credentials)
-   - [API Configuration](#api-configuration)
-   - [Custom LLM Provider](#custom-llm-provider)
-   - [Embeddings](#embeddings)
-   - [Message Handling](#message-handling)
-   - [Model Selection](#model-selection)
-   - [Retrying](#retrying)
-   - [Advanced Options](#advanced-options)
-- [Agent Configuration](#agent-configuration)
-   - [Microagent Configuration](#microagent-configuration)
-   - [Memory Configuration](#memory-configuration)
-   - [LLM Configuration](#llm-configuration-2)
-   - [ActionSpace Configuration](#actionspace-configuration)
-   - [Microagent Usage](#microagent-usage)
-- [Sandbox Configuration](#sandbox-configuration)
-   - [Execution](#execution)
-   - [Container Image](#container-image)
-   - [Networking](#networking)
-   - [Linting and Plugins](#linting-and-plugins)
-   - [Dependencies and Environment](#dependencies-and-environment)
-   - [Evaluation](#evaluation)
-- [Security Configuration](#security-configuration)
-   - [Confirmation Mode](#confirmation-mode)
-   - [Security Analyzer](#security-analyzer)
-
----
-
 ## Core Configuration
 
 The core configuration options are defined in the `[core]` section of the `config.toml` file.
 
-**API Keys**
+### API Keys
 - `e2b_api_key`
   - Type: `str`
   - Default: `""`
@@ -69,7 +27,7 @@ The core configuration options are defined in the `[core]` section of the `confi
   - Default: `""`
   - Description: API token secret for Modal
 
-**Workspace**
+### Workspace
 - `workspace_base`
   - Type: `str`
   - Default: `"./workspace"`
@@ -80,7 +38,7 @@ The core configuration options are defined in the `[core]` section of the `confi
   - Default: `"/tmp/cache"`
   - Description: Cache directory path
 
-**Debugging and Logging**
+### Debugging and Logging
 - `debug`
   - Type: `bool`
   - Default: `false`
@@ -91,19 +49,18 @@ The core configuration options are defined in the `[core]` section of the `confi
   - Default: `false`
   - Description: Disable color in terminal output
 
-**Trajectories**
+### Trajectories
 - `save_trajectory_path`
   - Type: `str`
   - Default: `"./trajectories"`
   - Description: Path to store trajectories (can be a folder or a file). If it's a folder, the trajectories will be saved in a file named with the session id name and .json extension, in that folder.
 
-**Trajectories**
 - `replay_trajectory_path`
   - Type: `str`
   - Default: `""`
   - Description: Path to load a trajectory and replay. If given, must be a path to the trajectory file in JSON format. The actions in the trajectory file would be replayed first before any user instruction is executed.
 
-**File Store**
+### File Store
 - `file_store_path`
   - Type: `str`
   - Default: `"/tmp/file_store"`
@@ -134,7 +91,7 @@ The core configuration options are defined in the `[core]` section of the `confi
   - Default: `[".*"]`
   - Description: List of allowed file extensions for uploads
 
-**Task Management**
+### Task Management
 - `max_budget_per_task`
   - Type: `float`
   - Default: `0.0`
@@ -145,7 +102,7 @@ The core configuration options are defined in the `[core]` section of the `confi
   - Default: `100`
   - Description: Maximum number of iterations
 
-**Sandbox Configuration**
+### Sandbox Configuration
 - `workspace_mount_path_in_sandbox`
   - Type: `str`
   - Default: `"/workspace"`
@@ -161,7 +118,7 @@ The core configuration options are defined in the `[core]` section of the `confi
   - Default: `""`
   - Description: Path to rewrite the workspace mount path to. You can usually ignore this, it refers to special cases of running inside another container.
 
-**Miscellaneous**
+### Miscellaneous
 - `run_as_openhands`
   - Type: `bool`
   - Default: `true`
@@ -188,7 +145,7 @@ The LLM (Large Language Model) configuration options are defined in the `[llm]`
 
 To use these with the docker command, pass in `-e LLM_<option>`. Example: `-e LLM_NUM_RETRIES`.
 
-**AWS Credentials**
+### AWS Credentials
 - `aws_access_key_id`
   - Type: `str`
   - Default: `""`
@@ -204,7 +161,7 @@ To use these with the docker command, pass in `-e LLM_<option>`. Example: `-e LL
   - Default: `""`
   - Description: AWS secret access key
 
-**API Configuration**
+### API Configuration
 - `api_key`
   - Type: `str`
   - Default: `None`
@@ -230,13 +187,13 @@ To use these with the docker command, pass in `-e LLM_<option>`. Example: `-e LL
   - Default: `0.0`
   - Description: Cost per output token
 
-**Custom LLM Provider**
+### Custom LLM Provider
 - `custom_llm_provider`
   - Type: `str`
   - Default: `""`
   - Description: Custom LLM provider
 
-**Embeddings**
+### Embeddings
 - `embedding_base_url`
   - Type: `str`
   - Default: `""`
@@ -252,7 +209,7 @@ To use these with the docker command, pass in `-e LLM_<option>`. Example: `-e LL
   - Default: `"local"`
   - Description: Embedding model to use
 
-**Message Handling**
+### Message Handling
 - `max_message_chars`
   - Type: `int`
   - Default: `30000`
@@ -268,13 +225,13 @@ To use these with the docker command, pass in `-e LLM_<option>`. Example: `-e LL
   - Default: `0`
   - Description: Maximum number of output tokens
 
-**Model Selection**
+### Model Selection
 - `model`
   - Type: `str`
   - Default: `"claude-3-5-sonnet-20241022"`
   - Description: Model to use
 
-**Retrying**
+### Retrying
 - `num_retries`
   - Type: `int`
   - Default: `8`
@@ -295,7 +252,7 @@ To use these with the docker command, pass in `-e LLM_<option>`. Example: `-e LL
   - Default: `2.0`
   - Description: Multiplier for exponential backoff calculation
 
-**Advanced Options**
+### Advanced Options
 - `drop_params`
   - Type: `bool`
   - Default: `false`
@@ -335,13 +292,13 @@ To use these with the docker command, pass in `-e LLM_<option>`. Example: `-e LL
 
 The agent configuration options are defined in the `[agent]` and `[agent.<agent_name>]` sections of the `config.toml` file.
 
-**Microagent Configuration**
+### Microagent Configuration
 - `micro_agent_name`
   - Type: `str`
   - Default: `""`
   - Description: Name of the micro agent to use for this agent
 
-**Memory Configuration**
+### Memory Configuration
 - `memory_enabled`
   - Type: `bool`
   - Default: `false`
@@ -352,13 +309,13 @@ The agent configuration options are defined in the `[agent]` and `[agent.<agent_
   - Default: `3`
   - Description: The maximum number of threads indexing at the same time for embeddings
 
-**LLM Configuration**
+### LLM Configuration
 - `llm_config`
   - Type: `str`
   - Default: `'your-llm-config-group'`
   - Description: The name of the LLM config to use
 
-**ActionSpace Configuration**
+### ActionSpace Configuration
 - `function_calling`
   - Type: `bool`
   - Default: `true`
@@ -379,7 +336,7 @@ The agent configuration options are defined in the `[agent]` and `[agent.<agent_
   - Default: `false`
   - Description: Whether Jupyter is enabled in the action space
 
-**Microagent Usage**
+### Microagent Usage
 - `use_microagents`
   - Type: `bool`
   - Default: `true`
@@ -396,7 +353,7 @@ The sandbox configuration options are defined in the `[sandbox]` section of the
 
 To use these with the docker command, pass in `-e SANDBOX_<option>`. Example: `-e SANDBOX_TIMEOUT`.
 
-**Execution**
+### Execution
 - `timeout`
   - Type: `int`
   - Default: `120`
@@ -407,19 +364,19 @@ To use these with the docker command, pass in `-e SANDBOX_<option>`. Example: `-
   - Default: `1000`
   - Description: Sandbox user ID
 
-**Container Image**
+### Container Image
 - `base_container_image`
   - Type: `str`
   - Default: `"nikolaik/python-nodejs:python3.12-nodejs22"`
   - Description: Container image to use for the sandbox
 
-**Networking**
+### Networking
 - `use_host_network`
   - Type: `bool`
   - Default: `false`
   - Description: Use host network
 
-**Linting and Plugins**
+### Linting and Plugins
 - `enable_auto_lint`
   - Type: `bool`
   - Default: `false`
@@ -430,7 +387,7 @@ To use these with the docker command, pass in `-e SANDBOX_<option>`. Example: `-
   - Default: `true`
   - Description: Whether to initialize plugins
 
-**Dependencies and Environment**
+### Dependencies and Environment
 - `runtime_extra_deps`
   - Type: `str`
   - Default: `""`
@@ -441,7 +398,7 @@ To use these with the docker command, pass in `-e SANDBOX_<option>`. Example: `-
   - Default: `{}`
   - Description: Environment variables to set at the launch of the runtime
 
-**Evaluation**
+### Evaluation
 - `browsergym_eval_env`
   - Type: `str`
   - Default: `""`
@@ -453,13 +410,13 @@ The security configuration options are defined in the `[security]` section of th
 
 To use these with the docker command, pass in `-e SECURITY_<option>`. Example: `-e SECURITY_CONFIRMATION_MODE`.
 
-**Confirmation Mode**
+### Confirmation Mode
 - `confirmation_mode`
   - Type: `bool`
   - Default: `false`
   - Description: Enable confirmation mode
 
-**Security Analyzer**
+### Security Analyzer
 - `security_analyzer`
   - Type: `str`
   - Default: `""`
diff --git a/docs/modules/usage/how-to/cli-mode.md b/docs/modules/usage/how-to/cli-mode.md
index 0bb888c4ff95..b54e46343fb8 100644
--- a/docs/modules/usage/how-to/cli-mode.md
+++ b/docs/modules/usage/how-to/cli-mode.md
@@ -35,7 +35,7 @@ To run OpenHands in CLI mode with Docker:
 ```bash
 docker run -it \
     --pull=always \
-    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik \
+    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik \
     -e SANDBOX_USER_ID=$(id -u) \
     -e WORKSPACE_MOUNT_PATH=$WORKSPACE_BASE \
     -e LLM_API_KEY=$LLM_API_KEY \
@@ -45,7 +45,7 @@ docker run -it \
     -v ~/.openhands-state:/.openhands-state \
     --add-host host.docker.internal:host-gateway \
     --name openhands-app-$(date +%Y%m%d%H%M%S) \
-    docker.all-hands.dev/all-hands-ai/openhands:0.19 \
+    docker.all-hands.dev/all-hands-ai/openhands:0.20 \
     python -m openhands.core.cli
 ```
 
@@ -58,7 +58,7 @@ Here are some examples of CLI commands and their expected outputs:
 ### Example 1: Simple Task
 
 ```bash
-How can I help? >> Write a Python script that prints "Hello, World!"
+>> Write a Python script that prints "Hello, World!"
 ```
 
 Expected Output:
@@ -72,7 +72,7 @@ Expected Output:
 ### Example 2: Bash Command
 
 ```bash
-How can I help? >> Create a directory named "test_dir"
+>> Create a directory named "test_dir"
 ```
 
 Expected Output:
@@ -86,7 +86,7 @@ Expected Output:
 ### Example 3: Error Handling
 
 ```bash
-How can I help? >> Delete a non-existent file
+>> Delete a non-existent file
 ```
 
 Expected Output:
diff --git a/docs/modules/usage/how-to/gui-mode.md b/docs/modules/usage/how-to/gui-mode.md
index 11feafb7609d..483f8869e9eb 100644
--- a/docs/modules/usage/how-to/gui-mode.md
+++ b/docs/modules/usage/how-to/gui-mode.md
@@ -76,18 +76,18 @@ When using OpenHands in online mode, the GitHub OAuth flow:
 
 Common issues and solutions:
 
-1. **Token Not Recognized**:
+- **Token Not Recognized**:
    - Ensure the token is properly saved in settings.
    - Check that the token hasn't expired.
    - Verify the token has the required scopes.
    - Try regenerating the token.
 
-2. **Organization Access Denied**:
+- **Organization Access Denied**:
    - Check if SSO is required but not enabled.
    - Verify organization membership.
    - Contact organization admin if token policies are blocking access.
 
-3. **Verifying Token Works**:
+- **Verifying Token Works**:
    - The app will show a green checkmark if the token is valid.
    - Try accessing a repository to confirm permissions.
    - Check the browser console for any error messages.
diff --git a/docs/modules/usage/how-to/headless-mode.md b/docs/modules/usage/how-to/headless-mode.md
index e1d064d7f4bc..5b40dc969e87 100644
--- a/docs/modules/usage/how-to/headless-mode.md
+++ b/docs/modules/usage/how-to/headless-mode.md
@@ -32,7 +32,7 @@ To run OpenHands in Headless mode with Docker:
 ```bash
 docker run -it \
     --pull=always \
-    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik \
+    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik \
     -e SANDBOX_USER_ID=$(id -u) \
     -e WORKSPACE_MOUNT_PATH=$WORKSPACE_BASE \
     -e LLM_API_KEY=$LLM_API_KEY \
@@ -43,7 +43,7 @@ docker run -it \
     -v ~/.openhands-state:/.openhands-state \
     --add-host host.docker.internal:host-gateway \
     --name openhands-app-$(date +%Y%m%d%H%M%S) \
-    docker.all-hands.dev/all-hands-ai/openhands:0.19 \
+    docker.all-hands.dev/all-hands-ai/openhands:0.20 \
     python -m openhands.core.main -t "write a bash script that prints hi"
 ```
 
diff --git a/docs/modules/usage/how-to/persist-session-data.md b/docs/modules/usage/how-to/persist-session-data.md
deleted file mode 100644
index fcdfab504c27..000000000000
--- a/docs/modules/usage/how-to/persist-session-data.md
+++ /dev/null
@@ -1,16 +0,0 @@
-# Persisting Session Data
-
-Using the standard Development Workflow, the session data is stored in memory. Currently, if OpenHands' service is restarted,
-previous sessions become invalid (a new secret is generated) and thus not recoverable.
-
-## How to Persist Session Data
-
-### Development Workflow
-In the `config.toml` file, specify the following:
-```
-[core]
-...
-file_store="local"
-file_store_path="/absolute/path/to/openhands/cache/directory"
-jwt_secret="secretpass"
-```
diff --git a/docs/modules/usage/installation.mdx b/docs/modules/usage/installation.mdx
index 7ce09c3c890d..d35eeb409fa8 100644
--- a/docs/modules/usage/installation.mdx
+++ b/docs/modules/usage/installation.mdx
@@ -11,17 +11,17 @@
 The easiest way to run OpenHands is in Docker.
 
 ```bash
-docker pull docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik
+docker pull docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik
 
 docker run -it --rm --pull=always \
-    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik \
+    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik \
     -e LOG_ALL_EVENTS=true \
     -v /var/run/docker.sock:/var/run/docker.sock \
     -v ~/.openhands-state:/.openhands-state \
     -p 3000:3000 \
     --add-host host.docker.internal:host-gateway \
     --name openhands-app \
-    docker.all-hands.dev/all-hands-ai/openhands:0.19
+    docker.all-hands.dev/all-hands-ai/openhands:0.20
 ```
 
 You'll find OpenHands running at http://localhost:3000!
diff --git a/docs/modules/usage/prompting/microagents-overview.md b/docs/modules/usage/prompting/microagents-overview.md
new file mode 100644
index 000000000000..acfe4a1ed7c8
--- /dev/null
+++ b/docs/modules/usage/prompting/microagents-overview.md
@@ -0,0 +1,36 @@
+# Microagents Overview
+
+Microagents are specialized prompts that enhance OpenHands with domain-specific knowledge, repository-specific context
+and task-specific workflows. They help by providing expert guidance, automating common tasks, and ensuring
+consistent practices across projects.
+
+## Microagent Types
+
+Currently OpenHands supports the following types of microagents:
+
+* [Repository Microagents](./microagents-repo): Repository-specific context and guidelines for OpenHands.
+* [Public Microagents](./microagents-public): General guidelines triggered by keywords for all OpenHands users.
+
+When OpenHands works with a repository, it:
+
+1. Loads repository-specific instructions from `.openhands/microagents/` if present in the repository.
+2. Loads general guidelines triggered by keywords in conversations.
+See current [Public Microagents](https://github.com/All-Hands-AI/OpenHands/tree/main/microagents/knowledge).
+
+## Microagent Format
+
+All microagents use markdown files with YAML frontmatter that have special instructions to help OpenHands accomplish
+tasks:
+```
+---
+name: <Name of the microagent>
+type: <MicroAgent type>
+version: <MicroAgent version>
+agent: <The agent type (Typically CodeActAgent)>
+triggers:
+- <Optional keywords triggering the microagent. If triggers are removed, it will always be included>
+---
+
+<Markdown with any special guidelines, instructions, and prompts that OpenHands should follow.
+Check out the specific documentation for each microagent on best practices for more information.>
+```
diff --git a/docs/modules/usage/prompting/microagents-public.md b/docs/modules/usage/prompting/microagents-public.md
index f966977bf202..0902ab443383 100644
--- a/docs/modules/usage/prompting/microagents-public.md
+++ b/docs/modules/usage/prompting/microagents-public.md
@@ -1,31 +1,21 @@
-# Public Micro-Agents
-
-OpenHands uses specialized micro-agents to handle specific tasks and contexts efficiently. These micro-agents are small,
-focused components that provide specialized behavior and knowledge for particular scenarios.
+# Public Microagents
 
 ## Overview
 
-Public micro-agents are defined in markdown files under the
+Public microagents are specialized guidelines triggered by keywords for all OpenHands users.
+They are defined in markdown files under the
 [`microagents/knowledge/`](https://github.com/All-Hands-AI/OpenHands/tree/main/microagents/knowledge) directory.
-Each micro-agent is configured with:
-
-- A unique name.
-- The agent type (typically CodeActAgent).
-- Trigger keywords that activate the agent.
-- Specific instructions and capabilities.
 
-### Integration
-
-Public micro-agents are automatically integrated into OpenHands' workflow. They:
+Public microagents:
 - Monitor incoming commands for their trigger words.
 - Activate when relevant triggers are detected.
 - Apply their specialized knowledge and capabilities.
 - Follow their specific guidelines and restrictions.
 
-## Available Public Micro-Agents
+## Current Public Microagents
 
-For more information about specific micro-agents, refer to their individual documentation files in
-the [`micro-agents`](https://github.com/All-Hands-AI/OpenHands/tree/main/microagents) directory.
+For more information about specific microagents, refer to their individual documentation files in
+the [`microagents/knowledge/`](https://github.com/All-Hands-AI/OpenHands/tree/main/microagents/knowledge/) directory.
 
 ### GitHub Agent
 **File**: `github.md`
@@ -66,105 +56,54 @@ Usage Example:
 yes | npm install package-name
 ```
 
-### Custom Public Micro-Agents
+## Contributing a Public Microagent
 
-You can create your own public micro-agents by adding new markdown files to the `microagents/knowledge/` directory.
-Each file should follow this structure:
+You can create your own public microagents by adding new markdown files to the
+[`microagents/knowledge/`](https://github.com/All-Hands-AI/OpenHands/tree/main/microagents/knowledge/) directory.
 
-```markdown
----
-name: agent_name
-agent: CodeActAgent
-triggers:
-- trigger_word1
-- trigger_word2
----
+### Public Microagents Best Practices
 
-Instructions and capabilities for the micro-agent...
-```
-
-## Working With Public Micro-Agents
-
-When working with public micro-agents:
-- **Use Appropriate Triggers**: Ensure your commands include the relevant trigger words to activate the correct micro-agent.
-- **Follow Agent Guidelines**: Each agent has specific instructions and limitations. Respect these for optimal results.
-- **API-First Approach**: When available, use API endpoints rather than web interfaces.
-- **Automation Friendly**: Design commands that work well in non-interactive environments.
-
-## Contributing a Public Micro-Agent
-
-Best practices for creating public micro-agents:
-
-- **Clear Scope**: Keep the micro-agent focused on a specific domain or task.
+- **Clear Scope**: Keep the microagent focused on a specific domain or task.
 - **Explicit Instructions**: Provide clear, unambiguous guidelines.
 - **Useful Examples**: Include practical examples of common use cases.
 - **Safety First**: Include necessary warnings and constraints.
-- **Integration Awareness**: Consider how the micro-agent interacts with other components.
+- **Integration Awareness**: Consider how the microagent interacts with other components.
 
-To contribute a new micro-agent to OpenHands:
+### Steps to Contribute a Public Microagent
 
-### 1. Plan the Public Micro-Agent
+#### 1. Plan the Public Microagent
 
-Before creating a public micro-agent, consider:
+Before creating a public microagent, consider:
 - What specific problem or use case will it address?
 - What unique capabilities or knowledge should it have?
 - What trigger words make sense for activating it?
 - What constraints or guidelines should it follow?
 
-### 2. File Structure
-
-Create a new markdown file in `microagents/knowledge/` with a descriptive name (e.g., `docker.md` for a Docker-focused agent).
+#### 2. Create File
 
-### 3. Required Components
+Create a new markdown file in [`microagents/knowledge/`](https://github.com/All-Hands-AI/OpenHands/tree/main/microagents/knowledge/)
+with a descriptive name (e.g., `docker.md` for a Docker-focused agent).
 
-The micro-agent file must include:
-
-- **Front Matter**: YAML metadata at the start of the file:
-```markdown
----
-name: your_agent_name
-agent: CodeActAgent
-triggers:
-- trigger_word1
-- trigger_word2
----
-```
-
-- **Instructions**: Clear, specific guidelines for the agent's behavior:
-```markdown
-You are responsible for [specific task/domain].
-
-Key responsibilities:
-1. [Responsibility 1]
-2. [Responsibility 2]
-
-Guidelines:
-- [Guideline 1]
-- [Guideline 2]
-
-Examples of usage:
-[Example 1]
-[Example 2]
-```
+Update the file with the required frontmatter [according to the required format](./microagents-overview#microagent-format)
+and the required specialized guidelines while following the [best practices above](#public-microagents-best-practices).
 
-### 4. Testing the Public Micro-Agent
+#### 3. Testing the Public Microagent
 
-Before submitting:
 - Test the agent with various prompts.
 - Verify trigger words activate the agent correctly.
 - Ensure instructions are clear and comprehensive.
 - Check for potential conflicts with existing agents.
 
-### 5. Submission Process
+#### 4. Submission Process
 
 Submit a pull request with:
-- The new micro-agent file.
+- The new microagent file.
 - Updated documentation if needed.
 - Description of the agent's purpose and capabilities.
 
-### Example Public Micro-Agent Implementation
+### Example Public Microagent Implementation
 
-Here's a template for a new micro-agent:
+Here's a template for a new microagent:
 
 ```markdown
 ---
@@ -210,5 +149,5 @@ Remember to:
 - Optimize for build time and image size
 ```
 
-Remember that micro-agents are a powerful way to extend OpenHands' capabilities in specific domains. Well-designed
-agents can significantly improve the system's ability to handle specialized tasks.
+See the [current public micro-agents](https://github.com/All-Hands-AI/OpenHands/tree/main/microagents/knowledge) for
+more examples.
diff --git a/docs/modules/usage/prompting/microagents-repo.md b/docs/modules/usage/prompting/microagents-repo.md
index 3d294f22d4fe..0eecee761845 100644
--- a/docs/modules/usage/prompting/microagents-repo.md
+++ b/docs/modules/usage/prompting/microagents-repo.md
@@ -1,25 +1,51 @@
-# Repository Micro-Agents
+# Repository Microagents
+
+## Overview
 
 OpenHands can be customized to work more effectively with specific repositories by providing repository-specific context
 and guidelines. This section explains how to optimize OpenHands for your project.
 
-## Repository Configuration
+## Creating a Repository Micro-Agent
 
 You can customize OpenHands' behavior for your repository by creating a `.openhands/microagents/` directory in your repository's root.
-At minimum, it should contain the file
+At minimum it should contain the file
 `.openhands/microagents/repo.md`, which includes instructions that will
 be given to the agent every time it works with this repository.
 
-We suggest including the following information:
+### Repository Microagents Best Practices
+
+- **Keep Instructions Updated**: Regularly update your `.openhands/microagents/` directory as your project evolves.
+- **Be Specific**: Include specific paths, patterns, and requirements unique to your project.
+- **Document Dependencies**: List all tools and dependencies required for development.
+- **Include Examples**: Provide examples of good code patterns from your project.
+- **Specify Conventions**: Document naming conventions, file organization, and code style preferences.
+
+### Steps to Create a Repository Microagent
+
+#### 1. Plan the Repository Microagent
+When creating a repository-specific micro-agent, we suggest including the following information:
 - **Repository Overview**: A brief description of your project's purpose and architecture.
 - **Directory Structure**: Key directories and their purposes.
 - **Development Guidelines**: Project-specific coding standards and practices.
 - **Testing Requirements**: How to run tests and what types of tests are required.
 - **Setup Instructions**: Steps needed to build and run the project.
 
-### Example Repository Configuration
-Example `.openhands/microagents/repo.md` file:
+#### 2. Create File
+
+Create a file in your repository under `.openhands/microagents/` (Example: `.openhands/microagents/repo.md`)
+
+Update the file with the required frontmatter [according to the required format](./microagents-overview#microagent-format)
+and the required specialized guidelines for your repository.
+
+### Example Repository Microagent
+
 ```
+---
+name: repo
+type: repo
+agent: CodeActAgent
+---
+
 Repository: MyProject
 Description: A web application for task management
 
@@ -37,30 +63,6 @@ Guidelines:
 - Follow ESLint configuration
 - Write tests for all new features
 - Use TypeScript for new code
-```
-
-### Customizing Prompts
-
-You may also add customized prompts to the `.openhands/microagents/repo.md` file when working with a repository.
-These could:
-
-- **Reference Project Standards**: Mention specific coding standards or patterns used in your project.
-- **Include Context**: Reference relevant documentation or existing implementations.
-- **Specify Testing Requirements**: Include project-specific testing requirements in your prompts.
 
-Example customized prompt:
+If adding a new component in src/components, always add appropriate unit tests in tests/components/.
 ```
-Add a new task completion feature to src/components/TaskList.tsx following our existing component patterns.
-Include unit tests in tests/components/ and update the documentation in docs/features/.
-The component should use our shared styling from src/styles/components.
-```
-
-### Best Practices for Repository Customization
-
-- **Keep Instructions Updated**: Regularly update your `.openhands/microagents/` directory as your project evolves.
-- **Be Specific**: Include specific paths, patterns, and requirements unique to your project.
-- **Document Dependencies**: List all tools and dependencies required for development.
-- **Include Examples**: Provide examples of good code patterns from your project.
-- **Specify Conventions**: Document naming conventions, file organization, and code style preferences.
-
-By customizing OpenHands for your repository, you'll get more accurate and consistent results that align with your project's standards and requirements.
diff --git a/docs/modules/usage/runtimes.md b/docs/modules/usage/runtimes.md
index 90752efc1f08..b59dad7cca38 100644
--- a/docs/modules/usage/runtimes.md
+++ b/docs/modules/usage/runtimes.md
@@ -16,7 +16,7 @@ some flags being passed to `docker run` that make this possible:
 
 ```
 docker run # ...
-    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.19-nikolaik \
+    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:0.20-nikolaik \
     -v /var/run/docker.sock:/var/run/docker.sock \
     # ...
 ```
diff --git a/docs/sidebars.ts b/docs/sidebars.ts
index 12911c317227..b7def32dd68f 100644
--- a/docs/sidebars.ts
+++ b/docs/sidebars.ts
@@ -24,18 +24,23 @@ const sidebars: SidebarsConfig = {
         },
         {
           type: 'category',
-          label: 'Micro-Agents',
+          label: 'Microagents',
           items: [
             {
               type: 'doc',
-              label: 'Public',
-              id: 'usage/prompting/microagents-public',
+              label: 'Overview',
+              id: 'usage/prompting/microagents-overview',
             },
             {
               type: 'doc',
               label: 'Repository',
               id: 'usage/prompting/microagents-repo',
             },
+            {
+              type: 'doc',
+              label: 'Public',
+              id: 'usage/prompting/microagents-public',
+            },
           ],
         }
       ],
@@ -132,11 +137,6 @@ const sidebars: SidebarsConfig = {
           label: 'Custom Sandbox',
           id: 'usage/how-to/custom-sandbox-guide',
         },
-        {
-          type: 'doc',
-          label: 'Persist Session Data',
-          id: 'usage/how-to/persist-session-data',
-        },
       ],
     },
     {
diff --git a/evaluation/benchmarks/the_agent_company/run_infer.py b/evaluation/benchmarks/the_agent_company/run_infer.py
index f93439c678e9..a82db6d56081 100644
--- a/evaluation/benchmarks/the_agent_company/run_infer.py
+++ b/evaluation/benchmarks/the_agent_company/run_infer.py
@@ -80,7 +80,7 @@ def load_dependencies(runtime: Runtime) -> List[str]:
 def init_task_env(runtime: Runtime, hostname: str, env_llm_config: LLMConfig):
     command = (
         f'SERVER_HOSTNAME={hostname} '
-        f'LITELLM_API_KEY={env_llm_config.api_key.get_secret_value() if env_llm_config.api_key else None} '
+        f'LITELLM_API_KEY={env_llm_config.api_key} '
         f'LITELLM_BASE_URL={env_llm_config.base_url} '
         f'LITELLM_MODEL={env_llm_config.model} '
         'bash /utils/init.sh'
@@ -165,7 +165,7 @@ def run_evaluator(
     runtime: Runtime, env_llm_config: LLMConfig, trajectory_path: str, result_path: str
 ):
     command = (
-        f'LITELLM_API_KEY={env_llm_config.api_key.get_secret_value() if env_llm_config.api_key else None} '
+        f'LITELLM_API_KEY={env_llm_config.api_key} '
         f'LITELLM_BASE_URL={env_llm_config.base_url} '
         f'LITELLM_MODEL={env_llm_config.model} '
         f"DECRYPTION_KEY='theagentcompany is all you need' "  # Hardcoded Key
diff --git a/evaluation/utils/shared.py b/evaluation/utils/shared.py
index 86de1a01d2cd..23c5b319d3c2 100644
--- a/evaluation/utils/shared.py
+++ b/evaluation/utils/shared.py
@@ -52,6 +52,30 @@ class EvalMetadata(BaseModel):
     details: dict[str, Any] | None = None
     condenser_config: CondenserConfig | None = None
 
+    def model_dump(self, *args, **kwargs):
+        dumped_dict = super().model_dump(*args, **kwargs)
+        # avoid leaking sensitive information
+        dumped_dict['llm_config'] = self.llm_config.to_safe_dict()
+        if hasattr(self.condenser_config, 'llm_config'):
+            dumped_dict['condenser_config']['llm_config'] = (
+                self.condenser_config.llm_config.to_safe_dict()
+            )
+
+        return dumped_dict
+
+    def model_dump_json(self, *args, **kwargs):
+        dumped = super().model_dump_json(*args, **kwargs)
+        dumped_dict = json.loads(dumped)
+        # avoid leaking sensitive information
+        dumped_dict['llm_config'] = self.llm_config.to_safe_dict()
+        if hasattr(self.condenser_config, 'llm_config'):
+            dumped_dict['condenser_config']['llm_config'] = (
+                self.condenser_config.llm_config.to_safe_dict()
+            )
+
+        logger.debug(f'Dumped metadata: {dumped_dict}')
+        return json.dumps(dumped_dict)
+
 
 class EvalOutput(BaseModel):
     # NOTE: User-specified
@@ -74,6 +98,23 @@ class EvalOutput(BaseModel):
     # Optionally save the input test instance
     instance: dict[str, Any] | None = None
 
+    def model_dump(self, *args, **kwargs):
+        dumped_dict = super().model_dump(*args, **kwargs)
+        # Remove None values
+        dumped_dict = {k: v for k, v in dumped_dict.items() if v is not None}
+        # Apply custom serialization for metadata (to avoid leaking sensitive information)
+        if self.metadata is not None:
+            dumped_dict['metadata'] = self.metadata.model_dump()
+        return dumped_dict
+
+    def model_dump_json(self, *args, **kwargs):
+        dumped = super().model_dump_json(*args, **kwargs)
+        dumped_dict = json.loads(dumped)
+        # Apply custom serialization for metadata (to avoid leaking sensitive information)
+        if 'metadata' in dumped_dict:
+            dumped_dict['metadata'] = json.loads(self.metadata.model_dump_json())
+        return json.dumps(dumped_dict)
+
 
 class EvalException(Exception):
     pass
@@ -273,7 +314,7 @@ def update_progress(
     logger.info(
         f'Finished evaluation for instance {result.instance_id}: {str(result.test_result)[:300]}...\n'
     )
-    output_fp.write(result.model_dump_json() + '\n')
+    output_fp.write(json.dumps(result.model_dump()) + '\n')
     output_fp.flush()
 
 
diff --git a/frontend/__tests__/api/github.test.ts b/frontend/__tests__/api/github.test.ts
deleted file mode 100644
index 5a659d4b71e6..000000000000
--- a/frontend/__tests__/api/github.test.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import { retrieveLatestGitHubCommit } from "../../src/api/github";
-
-describe("retrieveLatestGitHubCommit", () => {
-  const { githubGetMock } = vi.hoisted(() => ({
-    githubGetMock: vi.fn(),
-  }));
-
-  vi.mock("../../src/api/github-axios-instance", () => ({
-    github: {
-      get: githubGetMock,
-    },
-  }));
-
-  it("should return the latest commit when repository has commits", async () => {
-    const mockCommit = {
-      sha: "123abc",
-      commit: {
-        message: "Initial commit",
-      },
-    };
-
-    githubGetMock.mockResolvedValueOnce({
-      data: [mockCommit],
-    });
-
-    const result = await retrieveLatestGitHubCommit("user/repo");
-    expect(result).toEqual(mockCommit);
-  });
-
-  it("should return null when repository is empty", async () => {
-    const error = new Error("Repository is empty");
-    (error as any).response = { status: 409 };
-    githubGetMock.mockRejectedValueOnce(error);
-
-    const result = await retrieveLatestGitHubCommit("user/empty-repo");
-    expect(result).toBeNull();
-  });
-
-  it("should throw error for other error cases", async () => {
-    const error = new Error("Network error");
-    (error as any).response = { status: 500 };
-    githubGetMock.mockRejectedValueOnce(error);
-
-    await expect(retrieveLatestGitHubCommit("user/repo")).rejects.toThrow();
-  });
-});
diff --git a/frontend/__tests__/components/features/github/github-repo-selector.test.tsx b/frontend/__tests__/components/features/github/github-repo-selector.test.tsx
index 8d507294d9c1..5ef98b251af9 100644
--- a/frontend/__tests__/components/features/github/github-repo-selector.test.tsx
+++ b/frontend/__tests__/components/features/github/github-repo-selector.test.tsx
@@ -3,7 +3,6 @@ import { describe, expect, it, vi } from "vitest";
 import { renderWithProviders } from "test-utils";
 import { GitHubRepositorySelector } from "#/components/features/github/github-repo-selector";
 import OpenHands from "#/api/open-hands";
-import * as GitHubAPI from "#/api/github";
 
 describe("GitHubRepositorySelector", () => {
   const onInputChangeMock = vi.fn();
@@ -60,8 +59,8 @@ describe("GitHubRepositorySelector", () => {
     ];
 
     const searchPublicRepositoriesSpy = vi.spyOn(
-      GitHubAPI,
-      "searchPublicRepositories",
+      OpenHands,
+      "searchGitHubRepositories",
     );
     searchPublicRepositoriesSpy.mockResolvedValue(mockSearchedRepos);
 
diff --git a/frontend/__tests__/components/features/sidebar/sidebar.test.tsx b/frontend/__tests__/components/features/sidebar/sidebar.test.tsx
index 9d96e7a49bdc..3b7a2a275ecc 100644
--- a/frontend/__tests__/components/features/sidebar/sidebar.test.tsx
+++ b/frontend/__tests__/components/features/sidebar/sidebar.test.tsx
@@ -141,5 +141,30 @@ describe("Sidebar", () => {
         llm_api_key: undefined, // null or undefined
       });
     });
+
+    it("should not send the api key if its SET", async () => {
+      const user = userEvent.setup();
+      renderSidebar();
+
+      const settingsButton = screen.getByTestId("settings-button");
+      await user.click(settingsButton);
+
+      const settingsModal = screen.getByTestId("ai-config-modal");
+
+      const apiKeyInput = within(settingsModal).getByLabelText(/api key/i);
+      await user.type(apiKeyInput, "SET");
+
+      const saveButton = within(settingsModal).getByTestId(
+        "save-settings-button",
+      );
+      await user.click(saveButton);
+
+      expect(saveSettingsSpy).toHaveBeenCalledWith({
+        ...MOCK_USER_PREFERENCES.settings,
+        llm_api_key: undefined,
+        llm_base_url: undefined,
+        security_analyzer: undefined,
+      });
+    });
   });
 });
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 1d283196738f..d3c1caf6550a 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "openhands-frontend",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "openhands-frontend",
-      "version": "0.19.0",
+      "version": "0.20.0",
       "dependencies": {
         "@monaco-editor/react": "^4.7.0-rc.0",
         "@nextui-org/react": "^2.6.11",
@@ -38,7 +38,7 @@
         "react-redux": "^9.2.0",
         "react-router": "^7.1.1",
         "react-syntax-highlighter": "^15.6.1",
-        "react-textarea-autosize": "^8.5.4",
+        "react-textarea-autosize": "^8.5.7",
         "remark-gfm": "^4.0.0",
         "sirv-cli": "^3.0.0",
         "socket.io-client": "^4.8.1",
@@ -70,11 +70,11 @@
         "eslint": "^8.57.0",
         "eslint-config-airbnb": "^19.0.4",
         "eslint-config-airbnb-typescript": "^18.0.0",
-        "eslint-config-prettier": "^9.1.0",
+        "eslint-config-prettier": "^10.0.1",
         "eslint-plugin-import": "^2.29.1",
         "eslint-plugin-jsx-a11y": "^6.10.2",
         "eslint-plugin-prettier": "^5.2.1",
-        "eslint-plugin-react": "^7.37.3",
+        "eslint-plugin-react": "^7.37.4",
         "eslint-plugin-react-hooks": "^4.6.2",
         "husky": "^9.1.6",
         "jsdom": "^26.0.0",
@@ -8448,13 +8448,12 @@
       }
     },
     "node_modules/eslint-config-prettier": {
-      "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-9.1.0.tgz",
-      "integrity": "sha512-NSWl5BFQWEPi1j4TjVNItzYV7dZXZ+wP6I6ZhrBGpChQhZRUaElihE9uRRkcbRnNb76UMKDF3r+WTmNcGPKsqw==",
+      "version": "10.0.1",
+      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-10.0.1.tgz",
+      "integrity": "sha512-lZBts941cyJyeaooiKxAtzoPHTN+GbQTJFAIdQbRhA4/8whaAraEh47Whw/ZFfrjNSnlAxqfm9i0XVAEkULjCw==",
       "dev": true,
-      "license": "MIT",
       "bin": {
-        "eslint-config-prettier": "bin/cli.js"
+        "eslint-config-prettier": "build/bin/cli.js"
       },
       "peerDependencies": {
         "eslint": ">=7.0.0"
@@ -8697,11 +8696,10 @@
       }
     },
     "node_modules/eslint-plugin-react": {
-      "version": "7.37.3",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-react/-/eslint-plugin-react-7.37.3.tgz",
-      "integrity": "sha512-DomWuTQPFYZwF/7c9W2fkKkStqZmBd3uugfqBYLdkZ3Hii23WzZuOLUskGxB8qkSKqftxEeGL1TB2kMhrce0jA==",
+      "version": "7.37.4",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-react/-/eslint-plugin-react-7.37.4.tgz",
+      "integrity": "sha512-BGP0jRmfYyvOyvMoRX/uoUeW+GqNj9y16bPQzqAHf3AYII/tDs+jMN0dBVkl88/OZwNGwrVFxE7riHsXVfy/LQ==",
       "dev": true,
-      "license": "MIT",
       "dependencies": {
         "array-includes": "^3.1.8",
         "array.prototype.findlast": "^1.2.5",
@@ -14234,10 +14232,9 @@
       }
     },
     "node_modules/react-textarea-autosize": {
-      "version": "8.5.6",
-      "resolved": "https://registry.npmjs.org/react-textarea-autosize/-/react-textarea-autosize-8.5.6.tgz",
-      "integrity": "sha512-aT3ioKXMa8f6zHYGebhbdMD2L00tKeRX1zuVuDx9YQK/JLLRSaSxq3ugECEmUB9z2kvk6bFSIoRHLkkUv0RJiw==",
-      "license": "MIT",
+      "version": "8.5.7",
+      "resolved": "https://registry.npmjs.org/react-textarea-autosize/-/react-textarea-autosize-8.5.7.tgz",
+      "integrity": "sha512-2MqJ3p0Jh69yt9ktFIaZmORHXw4c4bxSIhCeWiFwmJ9EYKgLmuNII3e9c9b2UO+ijl4StnpZdqpxNIhTdHvqtQ==",
       "dependencies": {
         "@babel/runtime": "^7.20.13",
         "use-composed-ref": "^1.3.0",
diff --git a/frontend/package.json b/frontend/package.json
index 2ae180c2061f..dff2a8c17e57 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "openhands-frontend",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "private": true,
   "type": "module",
   "engines": {
@@ -37,7 +37,7 @@
     "react-redux": "^9.2.0",
     "react-router": "^7.1.1",
     "react-syntax-highlighter": "^15.6.1",
-    "react-textarea-autosize": "^8.5.4",
+    "react-textarea-autosize": "^8.5.7",
     "remark-gfm": "^4.0.0",
     "sirv-cli": "^3.0.0",
     "socket.io-client": "^4.8.1",
@@ -97,11 +97,11 @@
     "eslint": "^8.57.0",
     "eslint-config-airbnb": "^19.0.4",
     "eslint-config-airbnb-typescript": "^18.0.0",
-    "eslint-config-prettier": "^9.1.0",
+    "eslint-config-prettier": "^10.0.1",
     "eslint-plugin-import": "^2.29.1",
     "eslint-plugin-jsx-a11y": "^6.10.2",
     "eslint-plugin-prettier": "^5.2.1",
-    "eslint-plugin-react": "^7.37.3",
+    "eslint-plugin-react": "^7.37.4",
     "eslint-plugin-react-hooks": "^4.6.2",
     "husky": "^9.1.6",
     "jsdom": "^26.0.0",
diff --git a/frontend/src/api/github.ts b/frontend/src/api/github.ts
index 256968536c9b..c69ca870d751 100644
--- a/frontend/src/api/github.ts
+++ b/frontend/src/api/github.ts
@@ -1,19 +1,6 @@
 import { extractNextPageFromLink } from "#/utils/extract-next-page-from-link";
-import { github } from "./github-axios-instance";
 import { openHands } from "./open-hands-axios";
 
-/**
- * Given the user, retrieves app installations IDs for OpenHands Github App
- * Uses user access token for Github App
- */
-export const retrieveGitHubAppInstallations = async (): Promise<number[]> => {
-  const response = await github.get<GithubAppInstallation>(
-    "/user/installations",
-  );
-
-  return response.data.installations.map((installation) => installation.id);
-};
-
 /**
  * Retrieves repositories where OpenHands Github App has been installed
  * @param installationIndex Pagination cursor position for app installation IDs
@@ -82,72 +69,3 @@ export const retrieveGitHubUserRepositories = async (
 
   return { data: response.data, nextPage };
 };
-
-/**
- * Given a GitHub token, retrieves the authenticated user
- * @returns The authenticated user or an error response
- */
-export const retrieveGitHubUser = async () => {
-  const response = await github.get<GitHubUser>("/user");
-
-  const { data } = response;
-
-  const user: GitHubUser = {
-    id: data.id,
-    login: data.login,
-    avatar_url: data.avatar_url,
-    company: data.company,
-    name: data.name,
-    email: data.email,
-  };
-
-  return user;
-};
-
-export const searchPublicRepositories = async (
-  query: string,
-  per_page = 5,
-  sort: "" | "updated" | "stars" | "forks" = "stars",
-  order: "desc" | "asc" = "desc",
-): Promise<GitHubRepository[]> => {
-  const response = await github.get<{ items: GitHubRepository[] }>(
-    "/search/repositories",
-    {
-      params: {
-        q: query,
-        per_page,
-        sort,
-        order,
-      },
-    },
-  );
-  return response.data.items;
-};
-
-export const retrieveLatestGitHubCommit = async (
-  repository: string,
-): Promise<GitHubCommit | null> => {
-  try {
-    const response = await github.get<GitHubCommit[]>(
-      `/repos/${repository}/commits`,
-      {
-        params: {
-          per_page: 1,
-        },
-      },
-    );
-    return response.data[0] || null;
-  } catch (error) {
-    if (!error || typeof error !== "object") {
-      throw new Error("Unknown error occurred");
-    }
-    const axiosError = error as { response?: { status: number } };
-    if (axiosError.response?.status === 409) {
-      // Repository is empty, no commits yet
-      return null;
-    }
-    throw new Error(
-      error instanceof Error ? error.message : "Unknown error occurred",
-    );
-  }
-};
diff --git a/frontend/src/api/open-hands.ts b/frontend/src/api/open-hands.ts
index 08dec1ebe258..bcb183a106a7 100644
--- a/frontend/src/api/open-hands.ts
+++ b/frontend/src/api/open-hands.ts
@@ -315,6 +315,45 @@ class OpenHands {
     const data = await openHands.post("/api/settings", settings);
     return data.status === 200;
   }
+
+  static async getGitHubUser(): Promise<GitHubUser> {
+    const response = await openHands.get<GitHubUser>("/api/github/user");
+
+    const { data } = response;
+
+    const user: GitHubUser = {
+      id: data.id,
+      login: data.login,
+      avatar_url: data.avatar_url,
+      company: data.company,
+      name: data.name,
+      email: data.email,
+    };
+
+    return user;
+  }
+
+  static async getGitHubUserInstallationIds(): Promise<number[]> {
+    const response = await openHands.get<number[]>("/api/github/installations");
+    return response.data;
+  }
+
+  static async searchGitHubRepositories(
+    query: string,
+    per_page = 5,
+  ): Promise<GitHubRepository[]> {
+    const response = await openHands.get<{ items: GitHubRepository[] }>(
+      "/api/github/search/repositories",
+      {
+        params: {
+          query,
+          per_page,
+        },
+      },
+    );
+
+    return response.data.items;
+  }
 }
 
 export default OpenHands;
diff --git a/frontend/src/components/features/github/github-repositories-suggestion-box.tsx b/frontend/src/components/features/github/github-repositories-suggestion-box.tsx
index 3ad3f65a2196..d2a246dbab69 100644
--- a/frontend/src/components/features/github/github-repositories-suggestion-box.tsx
+++ b/frontend/src/components/features/github/github-repositories-suggestion-box.tsx
@@ -59,7 +59,7 @@ export function GitHubRepositoriesSuggestionBox({
             <GitHubRepositorySelector
               onInputChange={setSearchQuery}
               onSelect={handleSubmit}
-              publicRepositories={searchedRepos}
+              publicRepositories={searchedRepos || []}
               userRepositories={repositories}
             />
           ) : (
diff --git a/frontend/src/context/settings-context.tsx b/frontend/src/context/settings-context.tsx
index 4b85d2e27784..bbbaa3ecbbae 100644
--- a/frontend/src/context/settings-context.tsx
+++ b/frontend/src/context/settings-context.tsx
@@ -33,6 +33,11 @@ export function SettingsProvider({ children }: SettingsProviderProps) {
       ...userSettings,
       ...newSettings,
     };
+
+    if (updatedSettings.LLM_API_KEY === "SET") {
+      delete updatedSettings.LLM_API_KEY;
+    }
+
     await saveSettings(updatedSettings, {
       onSuccess: () => {
         if (!isUpToDate) {
diff --git a/frontend/src/hooks/query/use-app-installations.ts b/frontend/src/hooks/query/use-app-installations.ts
index 861ed4bd27a1..e22bd7805e0c 100644
--- a/frontend/src/hooks/query/use-app-installations.ts
+++ b/frontend/src/hooks/query/use-app-installations.ts
@@ -1,7 +1,7 @@
 import { useQuery } from "@tanstack/react-query";
 import { useAuth } from "#/context/auth-context";
 import { useConfig } from "./use-config";
-import { retrieveGitHubAppInstallations } from "#/api/github";
+import OpenHands from "#/api/open-hands";
 
 export const useAppInstallations = () => {
   const { data: config } = useConfig();
@@ -9,10 +9,7 @@ export const useAppInstallations = () => {
 
   return useQuery({
     queryKey: ["installations", gitHubToken, config?.GITHUB_CLIENT_ID],
-    queryFn: async () => {
-      const data = await retrieveGitHubAppInstallations();
-      return data;
-    },
+    queryFn: OpenHands.getGitHubUserInstallationIds,
     enabled:
       !!gitHubToken &&
       !!config?.GITHUB_CLIENT_ID &&
diff --git a/frontend/src/hooks/query/use-github-user.ts b/frontend/src/hooks/query/use-github-user.ts
index ff7cd18457fc..9841f6524cda 100644
--- a/frontend/src/hooks/query/use-github-user.ts
+++ b/frontend/src/hooks/query/use-github-user.ts
@@ -1,9 +1,9 @@
 import { useQuery } from "@tanstack/react-query";
 import React from "react";
 import posthog from "posthog-js";
-import { retrieveGitHubUser } from "#/api/github";
 import { useAuth } from "#/context/auth-context";
 import { useConfig } from "./use-config";
+import OpenHands from "#/api/open-hands";
 
 export const useGitHubUser = () => {
   const { gitHubToken, setUserId } = useAuth();
@@ -11,7 +11,7 @@ export const useGitHubUser = () => {
 
   const user = useQuery({
     queryKey: ["user", gitHubToken],
-    queryFn: retrieveGitHubUser,
+    queryFn: OpenHands.getGitHubUser,
     enabled: !!gitHubToken && !!config?.APP_MODE,
     retry: false,
   });
diff --git a/frontend/src/hooks/query/use-latest-repo-commit.ts b/frontend/src/hooks/query/use-latest-repo-commit.ts
deleted file mode 100644
index 9a9b8a961157..000000000000
--- a/frontend/src/hooks/query/use-latest-repo-commit.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import { useQuery } from "@tanstack/react-query";
-import { retrieveLatestGitHubCommit } from "#/api/github";
-import { useAuth } from "#/context/auth-context";
-
-interface UseLatestRepoCommitConfig {
-  repository: string | null;
-}
-
-export const useLatestRepoCommit = (config: UseLatestRepoCommitConfig) => {
-  const { gitHubToken } = useAuth();
-
-  return useQuery({
-    queryKey: ["latest_commit", gitHubToken, config.repository],
-    queryFn: () => retrieveLatestGitHubCommit(config.repository!),
-    enabled: !!gitHubToken && !!config.repository,
-  });
-};
diff --git a/frontend/src/hooks/query/use-search-repositories.ts b/frontend/src/hooks/query/use-search-repositories.ts
index 4cd343c0a55a..27d6e2be9d1e 100644
--- a/frontend/src/hooks/query/use-search-repositories.ts
+++ b/frontend/src/hooks/query/use-search-repositories.ts
@@ -1,12 +1,11 @@
 import { useQuery } from "@tanstack/react-query";
-import { searchPublicRepositories } from "#/api/github";
+import OpenHands from "#/api/open-hands";
 
 export function useSearchRepositories(query: string) {
   return useQuery({
     queryKey: ["repositories", query],
-    queryFn: () => searchPublicRepositories(query, 3),
+    queryFn: () => OpenHands.searchGitHubRepositories(query, 3),
     enabled: !!query,
     select: (data) => data.map((repo) => ({ ...repo, is_public: true })),
-    initialData: [],
   });
 }
diff --git a/openhands/core/config/README.md b/openhands/core/config/README.md
index c612a0824403..5e3abae5b13a 100644
--- a/openhands/core/config/README.md
+++ b/openhands/core/config/README.md
@@ -37,17 +37,21 @@ export SANDBOX_TIMEOUT='300'
 
 ## Type Handling
 
-The `load_from_env` function attempts to cast environment variable values to the types specified in the models. It handles:
+The `load_from_env` function attempts to cast environment variable values to the types specified in the dataclasses. It handles:
 
 - Basic types (str, int, bool)
 - Optional types (e.g., `str | None`)
-- Nested models
+- Nested dataclasses
 
 If type casting fails, an error is logged, and the default value is retained.
 
 ## Default Values
 
-If an environment variable is not set, the default value specified in the model is used.
+If an environment variable is not set, the default value specified in the dataclass is used.
+
+## Nested Configurations
+
+The `AppConfig` class contains nested configurations like `LLMConfig` and `AgentConfig`. The `load_from_env` function handles these by recursively processing nested dataclasses with updated prefixes.
 
 ## Security Considerations
 
diff --git a/openhands/core/config/agent_config.py b/openhands/core/config/agent_config.py
index 268ae1c5a81d..77e9dbc1e32d 100644
--- a/openhands/core/config/agent_config.py
+++ b/openhands/core/config/agent_config.py
@@ -1,9 +1,11 @@
-from pydantic import BaseModel, Field
+from dataclasses import dataclass, field, fields
 
 from openhands.core.config.condenser_config import CondenserConfig, NoOpCondenserConfig
+from openhands.core.config.config_utils import get_field_info
 
 
-class AgentConfig(BaseModel):
+@dataclass
+class AgentConfig:
     """Configuration for the agent.
 
     Attributes:
@@ -20,13 +22,20 @@ class AgentConfig(BaseModel):
         condenser: Configuration for the memory condenser. Default is NoOpCondenserConfig.
     """
 
-    codeact_enable_browsing: bool = Field(default=True)
-    codeact_enable_llm_editor: bool = Field(default=False)
-    codeact_enable_jupyter: bool = Field(default=True)
-    micro_agent_name: str | None = Field(default=None)
-    memory_enabled: bool = Field(default=False)
-    memory_max_threads: int = Field(default=3)
-    llm_config: str | None = Field(default=None)
-    use_microagents: bool = Field(default=True)
-    disabled_microagents: list[str] | None = Field(default=None)
-    condenser: CondenserConfig = Field(default_factory=NoOpCondenserConfig)
+    codeact_enable_browsing: bool = True
+    codeact_enable_llm_editor: bool = False
+    codeact_enable_jupyter: bool = True
+    micro_agent_name: str | None = None
+    memory_enabled: bool = False
+    memory_max_threads: int = 3
+    llm_config: str | None = None
+    use_microagents: bool = True
+    disabled_microagents: list[str] | None = None
+    condenser: CondenserConfig = field(default_factory=NoOpCondenserConfig)  # type: ignore
+
+    def defaults_to_dict(self) -> dict:
+        """Serialize fields to a dict for the frontend, including type hints, defaults, and whether it's optional."""
+        result = {}
+        for f in fields(self):
+            result[f.name] = get_field_info(f)
+        return result
diff --git a/openhands/core/config/app_config.py b/openhands/core/config/app_config.py
index 5a0c875ffa86..d0eca61a8055 100644
--- a/openhands/core/config/app_config.py
+++ b/openhands/core/config/app_config.py
@@ -1,20 +1,20 @@
+from dataclasses import dataclass, field, fields, is_dataclass
 from typing import ClassVar
 
-from pydantic import BaseModel, Field, SecretStr
-
 from openhands.core import logger
 from openhands.core.config.agent_config import AgentConfig
 from openhands.core.config.config_utils import (
     OH_DEFAULT_AGENT,
     OH_MAX_ITERATIONS,
-    model_defaults_to_dict,
+    get_field_info,
 )
 from openhands.core.config.llm_config import LLMConfig
 from openhands.core.config.sandbox_config import SandboxConfig
 from openhands.core.config.security_config import SecurityConfig
 
 
-class AppConfig(BaseModel):
+@dataclass
+class AppConfig:
     """Configuration for the app.
 
     Attributes:
@@ -27,7 +27,7 @@ class AppConfig(BaseModel):
         runtime: Runtime environment identifier.
         file_store: Type of file store to use.
         file_store_path: Path to the file store.
-        save_trajectory_path: Either a folder path to store trajectories with auto-generated filenames, or a desinated trajectory file path.
+        save_trajectory_path: Either a folder path to store trajectories with auto-generated filenames, or a designated trajectory file path.
         replay_trajectory_path: Path to load trajectory and replay. If provided, trajectory would be replayed first before user's instruction.
         workspace_base: Base path for the workspace. Defaults to `./workspace` as absolute path.
         workspace_mount_path: Path to mount the workspace. Defaults to `workspace_base`.
@@ -47,40 +47,38 @@ class AppConfig(BaseModel):
             input is read line by line. When enabled, input continues until /exit command.
     """
 
-    llms: dict[str, LLMConfig] = Field(default_factory=dict)
-    agents: dict = Field(default_factory=dict)
-    default_agent: str = Field(default=OH_DEFAULT_AGENT)
-    sandbox: SandboxConfig = Field(default_factory=SandboxConfig)
-    security: SecurityConfig = Field(default_factory=SecurityConfig)
-    runtime: str = Field(default='docker')
-    file_store: str = Field(default='local')
-    file_store_path: str = Field(default='/tmp/openhands_file_store')
+    llms: dict[str, LLMConfig] = field(default_factory=dict)
+    agents: dict = field(default_factory=dict)
+    default_agent: str = OH_DEFAULT_AGENT
+    sandbox: SandboxConfig = field(default_factory=SandboxConfig)
+    security: SecurityConfig = field(default_factory=SecurityConfig)
+    runtime: str = 'docker'
+    file_store: str = 'local'
+    file_store_path: str = '/tmp/openhands_file_store'
     save_trajectory_path: str | None = None
-    replay_trajectory_path: str | None = Field(default=None)
-    workspace_base: str | None = Field(default=None)
-    workspace_mount_path: str | None = Field(default=None)
-    workspace_mount_path_in_sandbox: str = Field(default='/workspace')
-    workspace_mount_rewrite: str | None = Field(default=None)
-    cache_dir: str = Field(default='/tmp/cache')
-    run_as_openhands: bool = Field(default=True)
-    max_iterations: int = Field(default=OH_MAX_ITERATIONS)
-    max_budget_per_task: float | None = Field(default=None)
-    e2b_api_key: SecretStr | None = Field(default=None)
-    modal_api_token_id: SecretStr | None = Field(default=None)
-    modal_api_token_secret: SecretStr | None = Field(default=None)
-    disable_color: bool = Field(default=False)
-    jwt_secret: SecretStr | None = Field(default=None)
-    debug: bool = Field(default=False)
-    file_uploads_max_file_size_mb: int = Field(default=0)
-    file_uploads_restrict_file_types: bool = Field(default=False)
-    file_uploads_allowed_extensions: list[str] = Field(default_factory=lambda: ['.*'])
-    runloop_api_key: SecretStr | None = Field(default=None)
-    cli_multiline_input: bool = Field(default=False)
+    replay_trajectory_path: str | None = None
+    workspace_base: str | None = None
+    workspace_mount_path: str | None = None
+    workspace_mount_path_in_sandbox: str = '/workspace'
+    workspace_mount_rewrite: str | None = None
+    cache_dir: str = '/tmp/cache'
+    run_as_openhands: bool = True
+    max_iterations: int = OH_MAX_ITERATIONS
+    max_budget_per_task: float | None = None
+    e2b_api_key: str = ''
+    modal_api_token_id: str = ''
+    modal_api_token_secret: str = ''
+    disable_color: bool = False
+    jwt_secret: str = ''
+    debug: bool = False
+    file_uploads_max_file_size_mb: int = 0
+    file_uploads_restrict_file_types: bool = False
+    file_uploads_allowed_extensions: list[str] = field(default_factory=lambda: ['.*'])
+    runloop_api_key: str | None = None
+    cli_multiline_input: bool = False
 
     defaults_dict: ClassVar[dict] = {}
 
-    model_config = {'extra': 'forbid'}
-
     def get_llm_config(self, name='llm') -> LLMConfig:
         """'llm' is the name for default config (for backward compatibility prior to 0.8)."""
         if name in self.llms:
@@ -119,7 +117,42 @@ def get_llm_config_from_agent(self, name='agent') -> LLMConfig:
     def get_agent_configs(self) -> dict[str, AgentConfig]:
         return self.agents
 
-    def model_post_init(self, __context):
+    def __post_init__(self):
         """Post-initialization hook, called when the instance is created with only default values."""
-        super().model_post_init(__context)
-        AppConfig.defaults_dict = model_defaults_to_dict(self)
+        AppConfig.defaults_dict = self.defaults_to_dict()
+
+    def defaults_to_dict(self) -> dict:
+        """Serialize fields to a dict for the frontend, including type hints, defaults, and whether it's optional."""
+        result = {}
+        for f in fields(self):
+            field_value = getattr(self, f.name)
+
+            # dataclasses compute their defaults themselves
+            if is_dataclass(type(field_value)):
+                result[f.name] = field_value.defaults_to_dict()
+            else:
+                result[f.name] = get_field_info(f)
+        return result
+
+    def __str__(self):
+        attr_str = []
+        for f in fields(self):
+            attr_name = f.name
+            attr_value = getattr(self, f.name)
+
+            if attr_name in [
+                'e2b_api_key',
+                'github_token',
+                'jwt_secret',
+                'modal_api_token_id',
+                'modal_api_token_secret',
+                'runloop_api_key',
+            ]:
+                attr_value = '******' if attr_value else None
+
+            attr_str.append(f'{attr_name}={repr(attr_value)}')
+
+        return f"AppConfig({', '.join(attr_str)}"
+
+    def __repr__(self):
+        return self.__str__()
diff --git a/openhands/core/config/config_utils.py b/openhands/core/config/config_utils.py
index 44893e119b5a..38c3c1d03df5 100644
--- a/openhands/core/config/config_utils.py
+++ b/openhands/core/config/config_utils.py
@@ -1,22 +1,19 @@
 from types import UnionType
-from typing import Any, get_args, get_origin
-
-from pydantic import BaseModel
-from pydantic.fields import FieldInfo
+from typing import get_args, get_origin
 
 OH_DEFAULT_AGENT = 'CodeActAgent'
 OH_MAX_ITERATIONS = 500
 
 
-def get_field_info(field: FieldInfo) -> dict[str, Any]:
+def get_field_info(f):
     """Extract information about a dataclass field: type, optional, and default.
 
     Args:
-        field: The field to extract information from.
+        f: The field to extract information from.
 
     Returns: A dict with the field's type, whether it's optional, and its default value.
     """
-    field_type = field.annotation
+    field_type = f.type
     optional = False
 
     # for types like str | None, find the non-None type and set optional to True
@@ -36,21 +33,7 @@ def get_field_info(field: FieldInfo) -> dict[str, Any]:
     )
 
     # default is always present
-    default = field.default
+    default = f.default
 
     # return a schema with the useful info for frontend
     return {'type': type_name.lower(), 'optional': optional, 'default': default}
-
-
-def model_defaults_to_dict(model: BaseModel) -> dict[str, Any]:
-    """Serialize field information in a dict for the frontend, including type hints, defaults, and whether it's optional."""
-    result = {}
-    for name, field in model.model_fields.items():
-        field_value = getattr(model, name)
-
-        if isinstance(field_value, BaseModel):
-            result[name] = model_defaults_to_dict(field_value)
-        else:
-            result[name] = get_field_info(field)
-
-    return result
diff --git a/openhands/core/config/llm_config.py b/openhands/core/config/llm_config.py
index 81705beeb6e2..1d7dfb8f1797 100644
--- a/openhands/core/config/llm_config.py
+++ b/openhands/core/config/llm_config.py
@@ -1,14 +1,15 @@
-from __future__ import annotations
-
 import os
-from typing import Any
-
-from pydantic import BaseModel, Field, SecretStr
+from dataclasses import dataclass, fields
+from typing import Optional
 
+from openhands.core.config.config_utils import get_field_info
 from openhands.core.logger import LOG_DIR
 
+LLM_SENSITIVE_FIELDS = ['api_key', 'aws_access_key_id', 'aws_secret_access_key']
 
-class LLMConfig(BaseModel):
+
+@dataclass
+class LLMConfig:
     """Configuration for the LLM model.
 
     Attributes:
@@ -47,57 +48,98 @@ class LLMConfig(BaseModel):
         native_tool_calling: Whether to use native tool calling if supported by the model. Can be True, False, or not set.
     """
 
-    model: str = Field(default='claude-3-5-sonnet-20241022')
-    api_key: SecretStr | None = Field(default=None)
-    base_url: str | None = Field(default=None)
-    api_version: str | None = Field(default=None)
-    embedding_model: str = Field(default='local')
-    embedding_base_url: str | None = Field(default=None)
-    embedding_deployment_name: str | None = Field(default=None)
-    aws_access_key_id: SecretStr | None = Field(default=None)
-    aws_secret_access_key: SecretStr | None = Field(default=None)
-    aws_region_name: str | None = Field(default=None)
-    openrouter_site_url: str = Field(default='https://docs.all-hands.dev/')
-    openrouter_app_name: str = Field(default='OpenHands')
-    num_retries: int = Field(default=8)
-    retry_multiplier: float = Field(default=2)
-    retry_min_wait: int = Field(default=15)
-    retry_max_wait: int = Field(default=120)
-    timeout: int | None = Field(default=None)
-    max_message_chars: int = Field(
-        default=30_000
-    )  # maximum number of characters in an observation's content when sent to the llm
-    temperature: float = Field(default=0.0)
-    top_p: float = Field(default=1.0)
-    custom_llm_provider: str | None = Field(default=None)
-    max_input_tokens: int | None = Field(default=None)
-    max_output_tokens: int | None = Field(default=None)
-    input_cost_per_token: float | None = Field(default=None)
-    output_cost_per_token: float | None = Field(default=None)
-    ollama_base_url: str | None = Field(default=None)
+    model: str = 'claude-3-5-sonnet-20241022'
+    api_key: str | None = None
+    base_url: str | None = None
+    api_version: str | None = None
+    embedding_model: str = 'local'
+    embedding_base_url: str | None = None
+    embedding_deployment_name: str | None = None
+    aws_access_key_id: str | None = None
+    aws_secret_access_key: str | None = None
+    aws_region_name: str | None = None
+    openrouter_site_url: str = 'https://docs.all-hands.dev/'
+    openrouter_app_name: str = 'OpenHands'
+    num_retries: int = 8
+    retry_multiplier: float = 2
+    retry_min_wait: int = 15
+    retry_max_wait: int = 120
+    timeout: int | None = None
+    max_message_chars: int = 30_000  # maximum number of characters in an observation's content when sent to the llm
+    temperature: float = 0.0
+    top_p: float = 1.0
+    custom_llm_provider: str | None = None
+    max_input_tokens: int | None = None
+    max_output_tokens: int | None = None
+    input_cost_per_token: float | None = None
+    output_cost_per_token: float | None = None
+    ollama_base_url: str | None = None
     # This setting can be sent in each call to litellm
-    drop_params: bool = Field(default=True)
+    drop_params: bool = True
     # Note: this setting is actually global, unlike drop_params
-    modify_params: bool = Field(default=True)
-    disable_vision: bool | None = Field(default=None)
-    caching_prompt: bool = Field(default=True)
-    log_completions: bool = Field(default=False)
-    log_completions_folder: str = Field(default=os.path.join(LOG_DIR, 'completions'))
-    draft_editor: LLMConfig | None = Field(default=None)
-    custom_tokenizer: str | None = Field(default=None)
-    native_tool_calling: bool | None = Field(default=None)
-
-    model_config = {'extra': 'forbid'}
+    modify_params: bool = True
+    disable_vision: bool | None = None
+    caching_prompt: bool = True
+    log_completions: bool = False
+    log_completions_folder: str = os.path.join(LOG_DIR, 'completions')
+    draft_editor: Optional['LLMConfig'] = None
+    custom_tokenizer: str | None = None
+    native_tool_calling: bool | None = None
 
-    def model_post_init(self, __context: Any):
-        """Post-initialization hook to assign OpenRouter-related variables to environment variables.
+    def defaults_to_dict(self) -> dict:
+        """Serialize fields to a dict for the frontend, including type hints, defaults, and whether it's optional."""
+        result = {}
+        for f in fields(self):
+            result[f.name] = get_field_info(f)
+        return result
 
+    def __post_init__(self):
+        """
+        Post-initialization hook to assign OpenRouter-related variables to environment variables.
         This ensures that these values are accessible to litellm at runtime.
         """
-        super().model_post_init(__context)
 
         # Assign OpenRouter-specific variables to environment variables
         if self.openrouter_site_url:
             os.environ['OR_SITE_URL'] = self.openrouter_site_url
         if self.openrouter_app_name:
             os.environ['OR_APP_NAME'] = self.openrouter_app_name
+
+    def __str__(self):
+        attr_str = []
+        for f in fields(self):
+            attr_name = f.name
+            attr_value = getattr(self, f.name)
+
+            if attr_name in LLM_SENSITIVE_FIELDS:
+                attr_value = '******' if attr_value else None
+
+            attr_str.append(f'{attr_name}={repr(attr_value)}')
+
+        return f"LLMConfig({', '.join(attr_str)})"
+
+    def __repr__(self):
+        return self.__str__()
+
+    def to_safe_dict(self):
+        """Return a dict with the sensitive fields replaced with ******."""
+        ret = self.__dict__.copy()
+        for k, v in ret.items():
+            if k in LLM_SENSITIVE_FIELDS:
+                ret[k] = '******' if v else None
+            elif isinstance(v, LLMConfig):
+                ret[k] = v.to_safe_dict()
+        return ret
+
+    @classmethod
+    def from_dict(cls, llm_config_dict: dict) -> 'LLMConfig':
+        """Create an LLMConfig object from a dictionary.
+
+        This function is used to create an LLMConfig object from a dictionary,
+        with the exception of the 'draft_editor' key, which is a nested LLMConfig object.
+        """
+        args = {k: v for k, v in llm_config_dict.items() if not isinstance(v, dict)}
+        if 'draft_editor' in llm_config_dict:
+            draft_editor_config = LLMConfig(**llm_config_dict['draft_editor'])
+            args['draft_editor'] = draft_editor_config
+        return cls(**args)
diff --git a/openhands/core/config/sandbox_config.py b/openhands/core/config/sandbox_config.py
index c7d6f7369bdc..3a0b705dd02d 100644
--- a/openhands/core/config/sandbox_config.py
+++ b/openhands/core/config/sandbox_config.py
@@ -1,9 +1,11 @@
 import os
+from dataclasses import dataclass, field, fields
 
-from pydantic import BaseModel, Field
+from openhands.core.config.config_utils import get_field_info
 
 
-class SandboxConfig(BaseModel):
+@dataclass
+class SandboxConfig:
     """Configuration for the sandbox.
 
     Attributes:
@@ -37,32 +39,48 @@ class SandboxConfig(BaseModel):
             This should be a JSON string that will be parsed into a dictionary.
     """
 
-    remote_runtime_api_url: str = Field(default='http://localhost:8000')
-    local_runtime_url: str = Field(default='http://localhost')
-    keep_runtime_alive: bool = Field(default=True)
-    rm_all_containers: bool = Field(default=False)
-    api_key: str | None = Field(default=None)
-    base_container_image: str = Field(
-        default='nikolaik/python-nodejs:python3.12-nodejs22'
+    remote_runtime_api_url: str = 'http://localhost:8000'
+    local_runtime_url: str = 'http://localhost'
+    keep_runtime_alive: bool = True
+    rm_all_containers: bool = False
+    api_key: str | None = None
+    base_container_image: str = 'nikolaik/python-nodejs:python3.12-nodejs22'  # default to nikolaik/python-nodejs:python3.12-nodejs22 for eventstream runtime
+    runtime_container_image: str | None = None
+    user_id: int = os.getuid() if hasattr(os, 'getuid') else 1000
+    timeout: int = 120
+    remote_runtime_init_timeout: int = 180
+    enable_auto_lint: bool = (
+        False  # once enabled, OpenHands would lint files after editing
     )
-    runtime_container_image: str | None = Field(default=None)
-    user_id: int = Field(default=os.getuid() if hasattr(os, 'getuid') else 1000)
-    timeout: int = Field(default=120)
-    remote_runtime_init_timeout: int = Field(default=180)
-    enable_auto_lint: bool = Field(
-        default=False  # once enabled, OpenHands would lint files after editing
-    )
-    use_host_network: bool = Field(default=False)
-    runtime_extra_build_args: list[str] | None = Field(default=None)
-    initialize_plugins: bool = Field(default=True)
-    force_rebuild_runtime: bool = Field(default=False)
-    runtime_extra_deps: str | None = Field(default=None)
-    runtime_startup_env_vars: dict[str, str] = Field(default_factory=dict)
-    browsergym_eval_env: str | None = Field(default=None)
-    platform: str | None = Field(default=None)
-    close_delay: int = Field(default=900)
-    remote_runtime_resource_factor: int = Field(default=1)
-    enable_gpu: bool = Field(default=False)
-    docker_runtime_kwargs: str | None = Field(default=None)
+    use_host_network: bool = False
+    runtime_extra_build_args: list[str] | None = None
+    initialize_plugins: bool = True
+    force_rebuild_runtime: bool = False
+    runtime_extra_deps: str | None = None
+    runtime_startup_env_vars: dict[str, str] = field(default_factory=dict)
+    browsergym_eval_env: str | None = None
+    platform: str | None = None
+    close_delay: int = 900
+    remote_runtime_resource_factor: int = 1
+    enable_gpu: bool = False
+    docker_runtime_kwargs: str | None = None
+
+    def defaults_to_dict(self) -> dict:
+        """Serialize fields to a dict for the frontend, including type hints, defaults, and whether it's optional."""
+        dict = {}
+        for f in fields(self):
+            dict[f.name] = get_field_info(f)
+        return dict
+
+    def __str__(self):
+        attr_str = []
+        for f in fields(self):
+            attr_name = f.name
+            attr_value = getattr(self, f.name)
+
+            attr_str.append(f'{attr_name}={repr(attr_value)}')
+
+        return f"SandboxConfig({', '.join(attr_str)})"
 
-    model_config = {'extra': 'forbid'}
+    def __repr__(self):
+        return self.__str__()
diff --git a/openhands/core/config/security_config.py b/openhands/core/config/security_config.py
index a4805e3ab85f..60645f305736 100644
--- a/openhands/core/config/security_config.py
+++ b/openhands/core/config/security_config.py
@@ -1,7 +1,10 @@
-from pydantic import BaseModel, Field
+from dataclasses import dataclass, fields
 
+from openhands.core.config.config_utils import get_field_info
 
-class SecurityConfig(BaseModel):
+
+@dataclass
+class SecurityConfig:
     """Configuration for security related functionalities.
 
     Attributes:
@@ -9,5 +12,29 @@ class SecurityConfig(BaseModel):
         security_analyzer: The security analyzer to use.
     """
 
-    confirmation_mode: bool = Field(default=False)
-    security_analyzer: str | None = Field(default=None)
+    confirmation_mode: bool = False
+    security_analyzer: str | None = None
+
+    def defaults_to_dict(self) -> dict:
+        """Serialize fields to a dict for the frontend, including type hints, defaults, and whether it's optional."""
+        dict = {}
+        for f in fields(self):
+            dict[f.name] = get_field_info(f)
+        return dict
+
+    def __str__(self):
+        attr_str = []
+        for f in fields(self):
+            attr_name = f.name
+            attr_value = getattr(self, f.name)
+
+            attr_str.append(f'{attr_name}={repr(attr_value)}')
+
+        return f"SecurityConfig({', '.join(attr_str)})"
+
+    @classmethod
+    def from_dict(cls, security_config_dict: dict) -> 'SecurityConfig':
+        return cls(**security_config_dict)
+
+    def __repr__(self):
+        return self.__str__()
diff --git a/openhands/core/config/utils.py b/openhands/core/config/utils.py
index b8461b420d73..7719ce0d59b1 100644
--- a/openhands/core/config/utils.py
+++ b/openhands/core/config/utils.py
@@ -3,13 +3,13 @@
 import pathlib
 import platform
 import sys
+from dataclasses import is_dataclass
 from types import UnionType
 from typing import Any, MutableMapping, get_args, get_origin
 from uuid import uuid4
 
 import toml
 from dotenv import load_dotenv
-from pydantic import BaseModel, ValidationError
 
 from openhands.core import logger
 from openhands.core.config.agent_config import AgentConfig
@@ -43,19 +43,17 @@ def get_optional_type(union_type: UnionType) -> Any:
         return next((t for t in types if t is not type(None)), None)
 
     # helper function to set attributes based on env vars
-    def set_attr_from_env(sub_config: BaseModel, prefix=''):
-        """Set attributes of a config model based on environment variables."""
-        for field_name, field_info in sub_config.model_fields.items():
-            field_value = getattr(sub_config, field_name)
-            field_type = field_info.annotation
-
+    def set_attr_from_env(sub_config: Any, prefix=''):
+        """Set attributes of a config dataclass based on environment variables."""
+        for field_name, field_type in sub_config.__annotations__.items():
             # compute the expected env var name from the prefix and field name
             # e.g. LLM_BASE_URL
             env_var_name = (prefix + field_name).upper()
 
-            if isinstance(field_value, BaseModel):
-                set_attr_from_env(field_value, prefix=field_name + '_')
-
+            if is_dataclass(field_type):
+                # nested dataclass
+                nested_sub_config = getattr(sub_config, field_name)
+                set_attr_from_env(nested_sub_config, prefix=field_name + '_')
             elif env_var_name in env_or_toml_dict:
                 # convert the env var to the correct type and set it
                 value = env_or_toml_dict[env_var_name]
@@ -128,60 +126,45 @@ def load_from_toml(cfg: AppConfig, toml_file: str = 'config.toml'):
         if isinstance(value, dict):
             try:
                 if key is not None and key.lower() == 'agent':
-                    # Every entry here is either a field for the default `agent` config group, or itself a group
-                    # The best way to tell the difference is to try to parse it as an AgentConfig object
-                    agent_group_ids: set[str] = set()
-                    for nested_key, nested_value in value.items():
-                        if isinstance(nested_value, dict):
-                            try:
-                                agent_config = AgentConfig(**nested_value)
-                            except ValidationError:
-                                continue
-                            agent_group_ids.add(nested_key)
-                            cfg.set_agent_config(agent_config, nested_key)
-
                     logger.openhands_logger.debug(
                         'Attempt to load default agent config from config toml'
                     )
-                    value_without_groups = {
-                        k: v for k, v in value.items() if k not in agent_group_ids
+                    non_dict_fields = {
+                        k: v for k, v in value.items() if not isinstance(v, dict)
                     }
-                    agent_config = AgentConfig(**value_without_groups)
+                    agent_config = AgentConfig(**non_dict_fields)
                     cfg.set_agent_config(agent_config, 'agent')
-
-                elif key is not None and key.lower() == 'llm':
-                    # Every entry here is either a field for the default `llm` config group, or itself a group
-                    # The best way to tell the difference is to try to parse it as an LLMConfig object
-                    llm_group_ids: set[str] = set()
                     for nested_key, nested_value in value.items():
                         if isinstance(nested_value, dict):
-                            try:
-                                llm_config = LLMConfig(**nested_value)
-                            except ValidationError:
-                                continue
-                            llm_group_ids.add(nested_key)
-                            cfg.set_llm_config(llm_config, nested_key)
-
+                            logger.openhands_logger.debug(
+                                f'Attempt to load group {nested_key} from config toml as agent config'
+                            )
+                            agent_config = AgentConfig(**nested_value)
+                            cfg.set_agent_config(agent_config, nested_key)
+                elif key is not None and key.lower() == 'llm':
                     logger.openhands_logger.debug(
                         'Attempt to load default LLM config from config toml'
                     )
-                    value_without_groups = {
-                        k: v for k, v in value.items() if k not in llm_group_ids
-                    }
-                    llm_config = LLMConfig(**value_without_groups)
+                    llm_config = LLMConfig.from_dict(value)
                     cfg.set_llm_config(llm_config, 'llm')
-
+                    for nested_key, nested_value in value.items():
+                        if isinstance(nested_value, dict):
+                            logger.openhands_logger.debug(
+                                f'Attempt to load group {nested_key} from config toml as llm config'
+                            )
+                            llm_config = LLMConfig.from_dict(nested_value)
+                            cfg.set_llm_config(llm_config, nested_key)
                 elif key is not None and key.lower() == 'security':
                     logger.openhands_logger.debug(
                         'Attempt to load security config from config toml'
                     )
-                    security_config = SecurityConfig(**value)
+                    security_config = SecurityConfig.from_dict(value)
                     cfg.security = security_config
                 elif not key.startswith('sandbox') and key.lower() != 'core':
                     logger.openhands_logger.warning(
                         f'Unknown key in {toml_file}: "{key}"'
                     )
-            except (TypeError, KeyError, ValidationError) as e:
+            except (TypeError, KeyError) as e:
                 logger.openhands_logger.warning(
                     f'Cannot parse [{key}] config from toml, values have not been applied.\nError: {e}',
                     exc_info=False,
@@ -218,7 +201,7 @@ def load_from_toml(cfg: AppConfig, toml_file: str = 'config.toml'):
                 logger.openhands_logger.warning(
                     f'Unknown config key "{key}" in [core] section'
                 )
-    except (TypeError, KeyError, ValidationError) as e:
+    except (TypeError, KeyError) as e:
         logger.openhands_logger.warning(
             f'Cannot parse [sandbox] config from toml, values have not been applied.\nError: {e}',
             exc_info=False,
@@ -322,7 +305,7 @@ def get_llm_config_arg(
 
     # update the llm config with the specified section
     if 'llm' in toml_config and llm_config_arg in toml_config['llm']:
-        return LLMConfig(**toml_config['llm'][llm_config_arg])
+        return LLMConfig.from_dict(toml_config['llm'][llm_config_arg])
     logger.openhands_logger.debug(f'Loading from toml failed for {llm_config_arg}')
     return None
 
diff --git a/openhands/llm/async_llm.py b/openhands/llm/async_llm.py
index 97b2f9874829..ed84273c737b 100644
--- a/openhands/llm/async_llm.py
+++ b/openhands/llm/async_llm.py
@@ -19,9 +19,7 @@ def __init__(self, *args, **kwargs):
         self._async_completion = partial(
             self._call_acompletion,
             model=self.config.model,
-            api_key=self.config.api_key.get_secret_value()
-            if self.config.api_key
-            else None,
+            api_key=self.config.api_key,
             base_url=self.config.base_url,
             api_version=self.config.api_version,
             custom_llm_provider=self.config.custom_llm_provider,
diff --git a/openhands/llm/llm.py b/openhands/llm/llm.py
index 552d631b0201..743d6535ba3b 100644
--- a/openhands/llm/llm.py
+++ b/openhands/llm/llm.py
@@ -132,9 +132,7 @@ def __init__(
         self._completion = partial(
             litellm_completion,
             model=self.config.model,
-            api_key=self.config.api_key.get_secret_value()
-            if self.config.api_key
-            else None,
+            api_key=self.config.api_key,
             base_url=self.config.base_url,
             api_version=self.config.api_version,
             custom_llm_provider=self.config.custom_llm_provider,
@@ -320,9 +318,7 @@ def init_model_info(self):
             # GET {base_url}/v1/model/info with litellm_model_id as path param
             response = requests.get(
                 f'{self.config.base_url}/v1/model/info',
-                headers={
-                    'Authorization': f'Bearer {self.config.api_key.get_secret_value() if self.config.api_key else None}'
-                },
+                headers={'Authorization': f'Bearer {self.config.api_key}'},
             )
             resp_json = response.json()
             if 'data' not in resp_json:
diff --git a/openhands/llm/streaming_llm.py b/openhands/llm/streaming_llm.py
index f91eb3203dfd..77d999fadcd3 100644
--- a/openhands/llm/streaming_llm.py
+++ b/openhands/llm/streaming_llm.py
@@ -16,9 +16,7 @@ def __init__(self, *args, **kwargs):
         self._async_streaming_completion = partial(
             self._call_acompletion,
             model=self.config.model,
-            api_key=self.config.api_key.get_secret_value()
-            if self.config.api_key
-            else None,
+            api_key=self.config.api_key,
             base_url=self.config.base_url,
             api_version=self.config.api_version,
             custom_llm_provider=self.config.custom_llm_provider,
diff --git a/openhands/resolver/issue_definitions.py b/openhands/resolver/issue_definitions.py
index d8b181de3961..b9d7e83a3071 100644
--- a/openhands/resolver/issue_definitions.py
+++ b/openhands/resolver/issue_definitions.py
@@ -45,6 +45,7 @@ def guess_success(
 
 class IssueHandler(IssueHandlerInterface):
     issue_type: ClassVar[str] = 'issue'
+    default_git_patch: ClassVar[str] = 'No changes made yet'
 
     def __init__(self, owner: str, repo: str, token: str, llm_config: LLMConfig):
         self.download_url = 'https://api.github.com/repos/{}/{}/issues'
@@ -276,7 +277,11 @@ def guess_success(
             'r',
         ) as f:
             template = jinja2.Template(f.read())
-        prompt = template.render(issue_context=issue_context, last_message=last_message)
+        prompt = template.render(
+            issue_context=issue_context,
+            last_message=last_message,
+            git_patch=git_patch or self.default_git_patch,
+        )
 
         # Get the LLM response and check for 'success' and 'explanation' in the answer
         response = self.llm.completion(messages=[{'role': 'user', 'content': prompt}])
@@ -685,7 +690,7 @@ def _check_review_thread(
             feedback=review_thread.comment,
             files_context=files_context,
             last_message=last_message,
-            git_patch=git_patch or 'No changes made yet',
+            git_patch=git_patch or self.default_git_patch,
         )
 
         return self._check_feedback_with_llm(prompt)
@@ -712,7 +717,7 @@ def _check_thread_comments(
             issue_context=issues_context,
             thread_context=thread_context,
             last_message=last_message,
-            git_patch=git_patch or 'No changes made yet',
+            git_patch=git_patch or self.default_git_patch,
         )
 
         return self._check_feedback_with_llm(prompt)
@@ -739,7 +744,7 @@ def _check_review_comments(
             issue_context=issues_context,
             review_context=review_context,
             last_message=last_message,
-            git_patch=git_patch or 'No changes made yet',
+            git_patch=git_patch or self.default_git_patch,
         )
 
         return self._check_feedback_with_llm(prompt)
diff --git a/openhands/resolver/prompts/guess_success/issue-success-check.jinja b/openhands/resolver/prompts/guess_success/issue-success-check.jinja
index a2588c456298..cfc8e3685463 100644
--- a/openhands/resolver/prompts/guess_success/issue-success-check.jinja
+++ b/openhands/resolver/prompts/guess_success/issue-success-check.jinja
@@ -3,6 +3,9 @@ Given the following issue description and the last message from an AI agent atte
 Issue description:
 {{ issue_context }}
 
+Changes made (git patch):
+{{ git_patch }}
+
 Last message from AI agent:
 {{ last_message }}
 
diff --git a/openhands/runtime/builder/remote.py b/openhands/runtime/builder/remote.py
index 2e2c67c5a8f3..b2e869eca3bf 100644
--- a/openhands/runtime/builder/remote.py
+++ b/openhands/runtime/builder/remote.py
@@ -18,10 +18,12 @@
 class RemoteRuntimeBuilder(RuntimeBuilder):
     """This class interacts with the remote Runtime API for building and managing container images."""
 
-    def __init__(self, api_url: str, api_key: str):
+    def __init__(
+        self, api_url: str, api_key: str, session: requests.Session | None = None
+    ):
         self.api_url = api_url
         self.api_key = api_key
-        self.session = requests.Session()
+        self.session = session or requests.Session()
         self.session.headers.update({'X-API-Key': self.api_key})
 
     def build(
@@ -116,9 +118,7 @@ def build(
             # Wait before polling again
             sleep_if_should_continue(30)
 
-        raise AgentRuntimeBuildError(
-            'Build interrupted (likely received SIGTERM or SIGINT).'
-        )
+        raise AgentRuntimeBuildError('Build interrupted')
 
     def image_exists(self, image_name: str, pull_from_repo: bool = True) -> bool:
         """Checks if an image exists in the remote registry using the /image_exists endpoint."""
diff --git a/openhands/runtime/impl/modal/modal_runtime.py b/openhands/runtime/impl/modal/modal_runtime.py
index 61e72205a7f8..6c2be0739615 100644
--- a/openhands/runtime/impl/modal/modal_runtime.py
+++ b/openhands/runtime/impl/modal/modal_runtime.py
@@ -59,8 +59,7 @@ def __init__(
         self.sandbox = None
 
         self.modal_client = modal.Client.from_credentials(
-            config.modal_api_token_id.get_secret_value(),
-            config.modal_api_token_secret.get_secret_value(),
+            config.modal_api_token_id, config.modal_api_token_secret
         )
         self.app = modal.App.lookup(
             'openhands', create_if_missing=True, client=self.modal_client
diff --git a/openhands/runtime/impl/remote/remote_runtime.py b/openhands/runtime/impl/remote/remote_runtime.py
index ebc1a86b384b..bb5135dff530 100644
--- a/openhands/runtime/impl/remote/remote_runtime.py
+++ b/openhands/runtime/impl/remote/remote_runtime.py
@@ -66,7 +66,9 @@ def __init__(
             )
 
         self.runtime_builder = RemoteRuntimeBuilder(
-            self.config.sandbox.remote_runtime_api_url, self.config.sandbox.api_key
+            self.config.sandbox.remote_runtime_api_url,
+            self.config.sandbox.api_key,
+            self.session,
         )
         self.runtime_id: str | None = None
         self.runtime_url: str | None = None
diff --git a/openhands/runtime/impl/runloop/runloop_runtime.py b/openhands/runtime/impl/runloop/runloop_runtime.py
index add4619aea81..51628f54056d 100644
--- a/openhands/runtime/impl/runloop/runloop_runtime.py
+++ b/openhands/runtime/impl/runloop/runloop_runtime.py
@@ -40,7 +40,7 @@ def __init__(
         self.devbox: DevboxView | None = None
         self.config = config
         self.runloop_api_client = Runloop(
-            bearer_token=config.runloop_api_key.get_secret_value(),
+            bearer_token=config.runloop_api_key,
         )
         self.container_name = CONTAINER_NAME_PREFIX + sid
         super().__init__(
diff --git a/openhands/runtime/utils/request.py b/openhands/runtime/utils/request.py
index 2a0e17aa0fba..e05a083e7b0d 100644
--- a/openhands/runtime/utils/request.py
+++ b/openhands/runtime/utils/request.py
@@ -48,6 +48,8 @@ def send_request(
             _json = response.json()
         except (requests.exceptions.JSONDecodeError, json.decoder.JSONDecodeError):
             _json = None
+        finally:
+            response.close()
         raise RequestHTTPError(
             e,
             response=e.response,
diff --git a/openhands/server/app.py b/openhands/server/app.py
index 1ece8476151a..7387892d08dc 100644
--- a/openhands/server/app.py
+++ b/openhands/server/app.py
@@ -11,6 +11,7 @@
 import openhands.agenthub  # noqa F401 (we import this to get the agents registered)
 from openhands.server.middleware import (
     AttachConversationMiddleware,
+    GitHubTokenMiddleware,
     InMemoryRateLimiter,
     LocalhostCORSMiddleware,
     NoCacheMiddleware,
@@ -44,6 +45,7 @@ async def _lifespan(app: FastAPI):
     allow_headers=['*'],
 )
 
+app.add_middleware(GitHubTokenMiddleware)
 app.add_middleware(NoCacheMiddleware)
 app.add_middleware(
     RateLimitMiddleware, rate_limiter=InMemoryRateLimiter(requests=10, seconds=1)
diff --git a/openhands/server/listen_socket.py b/openhands/server/listen_socket.py
index 884b7e3b7cef..81816a1325e1 100644
--- a/openhands/server/listen_socket.py
+++ b/openhands/server/listen_socket.py
@@ -15,7 +15,6 @@
 from openhands.events.serialization import event_to_dict
 from openhands.events.stream import AsyncEventStreamWrapper
 from openhands.server.routes.settings import ConversationStoreImpl, SettingsStoreImpl
-from openhands.server.session.manager import ConversationDoesNotExistError
 from openhands.server.shared import config, openhands_config, session_manager, sio
 from openhands.server.types import AppMode
 
@@ -30,7 +29,7 @@ async def connect(connection_id: str, environ, auth):
         logger.error('No conversation_id in query params')
         raise ConnectionRefusedError('No conversation_id in query params')
 
-    user_id = -1
+    user_id = None
     if openhands_config.app_mode != AppMode.OSS:
         cookies_str = environ.get('HTTP_COOKIE', '')
         cookies = dict(cookie.split('=', 1) for cookie in cookies_str.split('; '))
@@ -61,13 +60,9 @@ async def connect(connection_id: str, environ, auth):
             'Settings not found', {'msg_id': 'CONFIGURATION$SETTINGS_NOT_FOUND'}
         )
 
-    try:
-        event_stream = await session_manager.join_conversation(
-            conversation_id, connection_id, settings
-        )
-    except ConversationDoesNotExistError:
-        logger.error(f'Conversation {conversation_id} does not exist')
-        raise ConnectionRefusedError(f'Conversation {conversation_id} does not exist')
+    event_stream = await session_manager.join_conversation(
+        conversation_id, connection_id, settings, user_id
+    )
 
     agent_state_changed = None
     async_stream = AsyncEventStreamWrapper(event_stream, latest_event_id + 1)
diff --git a/openhands/server/middleware.py b/openhands/server/middleware.py
index a7b30e479bbc..4b50344e33ce 100644
--- a/openhands/server/middleware.py
+++ b/openhands/server/middleware.py
@@ -166,3 +166,16 @@ async def __call__(self, request: Request, call_next: Callable):
             await self._detach_session(request)
 
         return response
+
+
+class GitHubTokenMiddleware(BaseHTTPMiddleware):
+    async def dispatch(self, request: Request, call_next):
+        if request.url.path.startswith('/api/github'):
+            github_token = request.headers.get('X-GitHub-Token')
+            if not github_token:
+                return JSONResponse(
+                    status_code=400,
+                    content={'error': 'Missing X-GitHub-Token header'},
+                )
+            request.state.github_token = github_token
+        return await call_next(request)
diff --git a/openhands/server/routes/github.py b/openhands/server/routes/github.py
index 7ec225767b44..7e7accde40a5 100644
--- a/openhands/server/routes/github.py
+++ b/openhands/server/routes/github.py
@@ -5,10 +5,10 @@
 from openhands.server.shared import openhands_config
 from openhands.utils.async_utils import call_sync_from_async
 
-app = APIRouter(prefix='/api')
+app = APIRouter(prefix='/api/github')
 
 
-@app.get('/github/repositories')
+@app.get('/repositories')
 async def get_github_repositories(
     request: Request,
     page: int = 1,
@@ -16,11 +16,6 @@ async def get_github_repositories(
     sort: str = 'pushed',
     installation_id: int | None = None,
 ):
-    # Extract the GitHub token from the headers
-    github_token = request.headers.get('X-GitHub-Token')
-    if not github_token:
-        raise HTTPException(status_code=400, detail='Missing X-GitHub-Token header')
-
     openhands_config.verify_github_repo_list(installation_id)
 
     # Add query parameters
@@ -38,10 +33,7 @@ async def get_github_repositories(
         params['sort'] = sort
 
     # Set the authorization header with the GitHub token
-    headers = {
-        'Authorization': f'Bearer {github_token}',
-        'Accept': 'application/vnd.github.v3+json',
-    }
+    headers = generate_github_headers(request.state.github_token)
 
     # Fetch repositories from GitHub
     try:
@@ -64,3 +56,88 @@ async def get_github_repositories(
         json_response.headers['Link'] = response.headers['Link']
 
     return json_response
+
+
+@app.get('/user')
+async def get_github_user(request: Request):
+    headers = generate_github_headers(request.state.github_token)
+    try:
+        response = await call_sync_from_async(
+            requests.get, 'https://api.github.com/user', headers=headers
+        )
+        response.raise_for_status()
+    except requests.exceptions.RequestException as e:
+        raise HTTPException(
+            status_code=response.status_code if response else 500,
+            detail=f'Error fetching user: {str(e)}',
+        )
+
+    json_response = JSONResponse(content=response.json())
+    response.close()
+
+    return json_response
+
+
+@app.get('/installations')
+async def get_github_installation_ids(request: Request):
+    headers = generate_github_headers(request.state.github_token)
+    try:
+        response = await call_sync_from_async(
+            requests.get, 'https://api.github.com/user/installations', headers=headers
+        )
+        response.raise_for_status()
+    except requests.exceptions.RequestException as e:
+        raise HTTPException(
+            status_code=response.status_code if response else 500,
+            detail=f'Error fetching installations: {str(e)}',
+        )
+
+    data = response.json()
+    ids = [installation['id'] for installation in data['installations']]
+    json_response = JSONResponse(content=ids)
+    response.close()
+
+    return json_response
+
+
+@app.get('/search/repositories')
+async def search_github_repositories(
+    request: Request,
+    query: str,
+    per_page: int = 5,
+    sort: str = 'stars',
+    order: str = 'desc',
+):
+    headers = generate_github_headers(request.state.github_token)
+    params = {
+        'q': query,
+        'per_page': per_page,
+        'sort': sort,
+        'order': order,
+    }
+
+    try:
+        response = await call_sync_from_async(
+            requests.get,
+            'https://api.github.com/search/repositories',
+            headers=headers,
+            params=params,
+        )
+        response.raise_for_status()
+    except requests.exceptions.RequestException as e:
+        raise HTTPException(
+            status_code=response.status_code if response else 500,
+            detail=f'Error searching repositories: {str(e)}',
+        )
+
+    json_response = JSONResponse(content=response.json())
+    response.close()
+
+    return json_response
+
+
+def generate_github_headers(token: str) -> dict[str, str]:
+    return {
+        'Authorization': f'Bearer {token}',
+        'Accept': 'application/vnd.github.v3+json',
+    }
diff --git a/openhands/server/routes/manage_conversations.py b/openhands/server/routes/manage_conversations.py
index 8b788e23c99e..c1f3d75e3faa 100644
--- a/openhands/server/routes/manage_conversations.py
+++ b/openhands/server/routes/manage_conversations.py
@@ -1,5 +1,5 @@
 import uuid
-from datetime import datetime
+from datetime import datetime, timezone
 from typing import Callable
 
 from fastapi import APIRouter, Body, Request
@@ -42,22 +42,40 @@ async def new_conversation(request: Request, data: InitSessionRequest):
     logger.info('Initializing new conversation')
 
     logger.info('Loading settings')
-    settings_store = await SettingsStoreImpl.get_instance(config, get_user_id(request))
+    user_id = get_user_id(request)
+    settings_store = await SettingsStoreImpl.get_instance(config, user_id)
     settings = await settings_store.load()
     logger.info('Settings loaded')
 
     session_init_args: dict = {}
     if settings:
         session_init_args = {**settings.__dict__, **session_init_args}
-
+        # We could use litellm.check_valid_key for a more accurate check,
+        # but that would run a tiny inference.
+        if not settings.llm_api_key or settings.llm_api_key.isspace():
+            logger.warn(f'Missing api key for model {settings.llm_model}')
+            return JSONResponse(
+                content={
+                    'status': 'error',
+                    'message': 'Error authenticating with the LLM provider. Please check your API key',
+                    'msg_id': 'STATUS$ERROR_LLM_AUTHENTICATION',
+                }
+            )
+    else:
+        logger.warn('Settings not present, not starting conversation')
+        return JSONResponse(
+            content={
+                'status': 'error',
+                'message': 'Settings not found',
+                'msg_id': 'CONFIGURATION$SETTINGS_NOT_FOUND',
+            }
+        )
     github_token = getattr(request.state, 'github_token', '')
     session_init_args['github_token'] = github_token or data.github_token or ''
     session_init_args['selected_repository'] = data.selected_repository
     conversation_init_data = ConversationInitData(**session_init_args)
     logger.info('Loading conversation store')
-    conversation_store = await ConversationStoreImpl.get_instance(
-        config, get_user_id(request)
-    )
+    conversation_store = await ConversationStoreImpl.get_instance(config, user_id)
     logger.info('Conversation store loaded')
 
     conversation_id = uuid.uuid4().hex
@@ -76,19 +94,19 @@ async def new_conversation(request: Request, data: InitSessionRequest):
         ConversationMetadata(
             conversation_id=conversation_id,
             title=conversation_title,
-            github_user_id=get_user_id(request),
+            github_user_id=user_id,
             selected_repository=data.selected_repository,
         )
     )
 
     logger.info(f'Starting agent loop for conversation {conversation_id}')
     event_stream = await session_manager.maybe_start_agent_loop(
-        conversation_id, conversation_init_data
+        conversation_id, conversation_init_data, user_id
     )
     try:
         event_stream.subscribe(
             EventStreamSubscriber.SERVER,
-            _create_conversation_update_callback(get_user_id(request), conversation_id),
+            _create_conversation_update_callback(user_id, conversation_id),
             UPDATED_AT_CALLBACK_ID,
         )
     except ValueError:
@@ -113,7 +131,7 @@ async def search_conversations(
         if hasattr(conversation, 'created_at')
     )
     running_conversations = await session_manager.get_agent_loop_running(
-        set(conversation_ids)
+        get_user_id(request), set(conversation_ids)
     )
     result = ConversationInfoResultSet(
         results=await wait_all(
@@ -222,5 +240,5 @@ def callback(*args, **kwargs):
 async def _update_timestamp_for_conversation(user_id: int, conversation_id: str):
     conversation_store = await ConversationStoreImpl.get_instance(config, user_id)
     conversation = await conversation_store.get_metadata(conversation_id)
-    conversation.last_updated_at = datetime.now()
+    conversation.last_updated_at = datetime.now(timezone.utc)
     await conversation_store.save_metadata(conversation)
diff --git a/openhands/server/routes/public.py b/openhands/server/routes/public.py
index fcdb1e52cef7..5a8925b741b4 100644
--- a/openhands/server/routes/public.py
+++ b/openhands/server/routes/public.py
@@ -51,8 +51,8 @@ async def get_litellm_models() -> list[str]:
     ):
         bedrock_model_list = bedrock.list_foundation_models(
             llm_config.aws_region_name,
-            llm_config.aws_access_key_id.get_secret_value(),
-            llm_config.aws_secret_access_key.get_secret_value(),
+            llm_config.aws_access_key_id,
+            llm_config.aws_secret_access_key,
         )
     model_list = litellm_model_list_without_bedrock + bedrock_model_list
     for llm_config in config.llms.values():
diff --git a/openhands/server/session/manager.py b/openhands/server/session/manager.py
index 9e7f7d8b8d7f..45b75805e412 100644
--- a/openhands/server/session/manager.py
+++ b/openhands/server/session/manager.py
@@ -24,10 +24,6 @@
 _CLEANUP_EXCEPTION_WAIT_TIME = 15
 
 
-class ConversationDoesNotExistError(Exception):
-    pass
-
-
 @dataclass
 class _SessionIsRunningCheck:
     request_id: str
@@ -209,13 +205,15 @@ async def attach_to_conversation(self, sid: str) -> Conversation | None:
             self._active_conversations[sid] = (c, 1)
             return c
 
-    async def join_conversation(self, sid: str, connection_id: str, settings: Settings):
+    async def join_conversation(
+        self, sid: str, connection_id: str, settings: Settings, user_id: int | None
+    ):
         logger.info(f'join_conversation:{sid}:{connection_id}')
         await self.sio.enter_room(connection_id, ROOM_KEY.format(sid=sid))
         self.local_connection_id_to_session_id[connection_id] = sid
         event_stream = await self._get_event_stream(sid)
         if not event_stream:
-            return await self.maybe_start_agent_loop(sid, settings)
+            return await self.maybe_start_agent_loop(sid, settings, user_id)
         return event_stream
 
     async def detach_from_conversation(self, conversation: Conversation):
@@ -265,7 +263,7 @@ async def _cleanup_detached_conversations(self):
                 logger.warning('error_cleaning_detached_conversations', exc_info=True)
                 await asyncio.sleep(_CLEANUP_EXCEPTION_WAIT_TIME)
 
-    async def get_agent_loop_running(self, sids: set[str]) -> set[str]:
+    async def get_agent_loop_running(self, user_id, sids: set[str]) -> set[str]:
         running_sids = set(sid for sid in sids if sid in self._local_agent_loops_by_sid)
         check_cluster_sids = [sid for sid in sids if sid not in running_sids]
         running_cluster_sids = await self.get_agent_loop_running_in_cluster(
@@ -346,7 +344,9 @@ async def _has_remote_connections(self, sid: str) -> bool:
         finally:
             self._has_remote_connections_flags.pop(sid, None)
 
-    async def maybe_start_agent_loop(self, sid: str, settings: Settings) -> EventStream:
+    async def maybe_start_agent_loop(
+        self, sid: str, settings: Settings, user_id: int | None
+    ) -> EventStream:
         logger.info(f'maybe_start_agent_loop:{sid}')
         session: Session | None = None
         if not await self.is_agent_loop_running(sid):
diff --git a/openhands/server/session/session.py b/openhands/server/session/session.py
index a481fbd27078..b8aff5a76009 100644
--- a/openhands/server/session/session.py
+++ b/openhands/server/session/session.py
@@ -37,6 +37,7 @@ class Session:
     loop: asyncio.AbstractEventLoop
     config: AppConfig
     file_store: FileStore
+    user_id: int | None
 
     def __init__(
         self,
@@ -44,6 +45,7 @@ def __init__(
         config: AppConfig,
         file_store: FileStore,
         sio: socketio.AsyncServer | None,
+        user_id: int | None = None,
     ):
         self.sid = sid
         self.sio = sio
@@ -58,6 +60,7 @@ def __init__(
         # Copying this means that when we update variables they are not applied to the shared global configuration!
         self.config = deepcopy(config)
         self.loop = asyncio.get_event_loop()
+        self.user_id = user_id
 
     def close(self):
         self.is_alive = False
@@ -113,9 +116,9 @@ async def initialize_agent(
                 selected_repository=selected_repository,
             )
         except Exception as e:
-            logger.exception(f'Error creating controller: {e}')
+            logger.exception(f'Error creating agent_session: {e}')
             await self.send_error(
-                f'Error creating controller. Please check Docker is running and visit `{TROUBLESHOOTING_URL}` for more debugging information..'
+                f'Error creating agent_session. Please check Docker is running and visit `{TROUBLESHOOTING_URL}` for more debugging information..'
             )
             return
 
diff --git a/openhands/storage/conversation/conversation_store.py b/openhands/storage/conversation/conversation_store.py
index 1f0b41ea6c87..40b5a23f1251 100644
--- a/openhands/storage/conversation/conversation_store.py
+++ b/openhands/storage/conversation/conversation_store.py
@@ -40,5 +40,7 @@ async def search(
 
     @classmethod
     @abstractmethod
-    async def get_instance(cls, config: AppConfig, user_id: int) -> ConversationStore:
+    async def get_instance(
+        cls, config: AppConfig, user_id: int | None
+    ) -> ConversationStore:
         """Get a store for the user represented by the token given"""
diff --git a/openhands/storage/conversation/file_conversation_store.py b/openhands/storage/conversation/file_conversation_store.py
index 15679f404903..c51ab3219db3 100644
--- a/openhands/storage/conversation/file_conversation_store.py
+++ b/openhands/storage/conversation/file_conversation_store.py
@@ -94,7 +94,7 @@ def get_conversation_metadata_filename(self, conversation_id: str) -> str:
 
     @classmethod
     async def get_instance(
-        cls, config: AppConfig, user_id: int
+        cls, config: AppConfig, user_id: int | None
     ) -> FileConversationStore:
         file_store = get_file_store(config.file_store, config.file_store_path)
         return FileConversationStore(file_store)
diff --git a/openhands/storage/data_models/conversation_info.py b/openhands/storage/data_models/conversation_info.py
index 52464ec30f85..9bbeacd73d43 100644
--- a/openhands/storage/data_models/conversation_info.py
+++ b/openhands/storage/data_models/conversation_info.py
@@ -1,5 +1,5 @@
 from dataclasses import dataclass, field
-from datetime import datetime
+from datetime import datetime, timezone
 
 from openhands.storage.data_models.conversation_status import ConversationStatus
 
@@ -13,4 +13,4 @@ class ConversationInfo:
     last_updated_at: datetime | None = None
     status: ConversationStatus = ConversationStatus.STOPPED
     selected_repository: str | None = None
-    created_at: datetime = field(default_factory=datetime.now)
+    created_at: datetime = field(default_factory=lambda: datetime.now(timezone.utc))
diff --git a/openhands/storage/data_models/conversation_metadata.py b/openhands/storage/data_models/conversation_metadata.py
index e75bbf21f8d5..d19183b23376 100644
--- a/openhands/storage/data_models/conversation_metadata.py
+++ b/openhands/storage/data_models/conversation_metadata.py
@@ -1,5 +1,5 @@
 from dataclasses import dataclass, field
-from datetime import datetime
+from datetime import datetime, timezone
 
 
 @dataclass
@@ -9,4 +9,4 @@ class ConversationMetadata:
     selected_repository: str | None
     title: str | None = None
     last_updated_at: datetime | None = None
-    created_at: datetime = field(default_factory=datetime.now)
+    created_at: datetime = field(default_factory=lambda: datetime.now(timezone.utc))
diff --git a/openhands/storage/s3.py b/openhands/storage/s3.py
index b571d4288c89..76db87dc638a 100644
--- a/openhands/storage/s3.py
+++ b/openhands/storage/s3.py
@@ -41,6 +41,10 @@ def list(self, path: str) -> list[str]:
 
     def delete(self, path: str) -> None:
         try:
-            self.client.remove_object(self.bucket, path)
+            client = self.client
+            bucket = self.bucket
+            objects_to_delete = client.list_objects(bucket, prefix=path, recursive=True)
+            for obj in objects_to_delete:
+                client.remove_object(bucket, obj.object_name)
         except Exception as e:
             raise FileNotFoundError(f'Failed to delete S3 object at path {path}: {e}')
diff --git a/openhands/storage/settings/file_settings_store.py b/openhands/storage/settings/file_settings_store.py
index c8703b304c11..1b4d4b6b0b67 100644
--- a/openhands/storage/settings/file_settings_store.py
+++ b/openhands/storage/settings/file_settings_store.py
@@ -30,6 +30,8 @@ async def store(self, settings: Settings):
         await call_sync_from_async(self.file_store.write, self.path, json_str)
 
     @classmethod
-    async def get_instance(cls, config: AppConfig, user_id: int) -> FileSettingsStore:
+    async def get_instance(
+        cls, config: AppConfig, user_id: int | None
+    ) -> FileSettingsStore:
         file_store = get_file_store(config.file_store, config.file_store_path)
         return FileSettingsStore(file_store)
diff --git a/openhands/storage/settings/settings_store.py b/openhands/storage/settings/settings_store.py
index a371720600ac..1ff1aa85c34a 100644
--- a/openhands/storage/settings/settings_store.py
+++ b/openhands/storage/settings/settings_store.py
@@ -21,5 +21,7 @@ async def store(self, settings: Settings):
 
     @classmethod
     @abstractmethod
-    async def get_instance(cls, config: AppConfig, user_id: int) -> SettingsStore:
+    async def get_instance(
+        cls, config: AppConfig, user_id: int | None
+    ) -> SettingsStore:
         """Get a store for the user represented by the token given"""
diff --git a/openhands/utils/embeddings.py b/openhands/utils/embeddings.py
index 6791787d3204..7e251f0e5022 100644
--- a/openhands/utils/embeddings.py
+++ b/openhands/utils/embeddings.py
@@ -90,9 +90,7 @@ def get_embedding_model(strategy: str, llm_config: LLMConfig) -> 'BaseEmbedding'
 
             return OpenAIEmbedding(
                 model='text-embedding-ada-002',
-                api_key=llm_config.api_key.get_secret_value()
-                if llm_config.api_key
-                else None,
+                api_key=llm_config.api_key,
             )
         elif strategy == 'azureopenai':
             from llama_index.embeddings.azure_openai import AzureOpenAIEmbedding
diff --git a/poetry.lock b/poetry.lock
index 51f9746cac06..2fca323cda1b 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 1.8.4 and should not be changed by hand.
+# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.
 
 [[package]]
 name = "aiohappyeyeballs"
@@ -552,17 +552,17 @@ files = [
 
 [[package]]
 name = "boto3"
-version = "1.35.95"
+version = "1.35.97"
 description = "The AWS SDK for Python"
 optional = false
 python-versions = ">=3.8"
 files = [
-    {file = "boto3-1.35.95-py3-none-any.whl", hash = "sha256:c81223488607457dacb7829ee0c99803c664593b34a2b0f86c71d421e7c3469a"},
-    {file = "boto3-1.35.95.tar.gz", hash = "sha256:d5671226819f6a78e31b1f37bd60f194afb8203254a543d06bdfb76de7d79236"},
+    {file = "boto3-1.35.97-py3-none-any.whl", hash = "sha256:8e49416216a6e3a62c2a0c44fba4dd2852c85472e7b702516605b1363867d220"},
+    {file = "boto3-1.35.97.tar.gz", hash = "sha256:7d398f66a11e67777c189d1f58c0a75d9d60f98d0ee51b8817e828930bf19e4e"},
 ]
 
 [package.dependencies]
-botocore = ">=1.35.95,<1.36.0"
+botocore = ">=1.35.97,<1.36.0"
 jmespath = ">=0.7.1,<2.0.0"
 s3transfer = ">=0.10.0,<0.11.0"
 
@@ -571,13 +571,13 @@ crt = ["botocore[crt] (>=1.21.0,<2.0a0)"]
 
 [[package]]
 name = "botocore"
-version = "1.35.95"
+version = "1.35.97"
 description = "Low-level, data-driven core of boto 3."
 optional = false
 python-versions = ">=3.8"
 files = [
-    {file = "botocore-1.35.95-py3-none-any.whl", hash = "sha256:a672406f748ad6a5b2fb7ea0d8394539eb4fda5332fc5373467d232c4bb27b12"},
-    {file = "botocore-1.35.95.tar.gz", hash = "sha256:b03d2d7cc58a16aa96a7e8f21941b766e98abc6ea74f61a63de7dc26c03641d3"},
+    {file = "botocore-1.35.97-py3-none-any.whl", hash = "sha256:fed4f156b1a9b8ece53738f702ba5851b8c6216b4952de326547f349cc494f14"},
+    {file = "botocore-1.35.97.tar.gz", hash = "sha256:88f2fab29192ffe2f2115d5bafbbd823ff4b6eb2774296e03ec8b5b0fe074f61"},
 ]
 
 [package.dependencies]
@@ -2161,13 +2161,13 @@ grpcio-gcp = ["grpcio-gcp (>=0.2.2,<1.0.dev0)"]
 
 [[package]]
 name = "google-api-python-client"
-version = "2.157.0"
+version = "2.158.0"
 description = "Google API Client Library for Python"
 optional = false
 python-versions = ">=3.7"
 files = [
-    {file = "google_api_python_client-2.157.0-py2.py3-none-any.whl", hash = "sha256:0b0231db106324c659bf8b85f390391c00da57a60ebc4271e33def7aac198c75"},
-    {file = "google_api_python_client-2.157.0.tar.gz", hash = "sha256:2ee342d0967ad1cedec43ccd7699671d94bff151e1f06833ea81303f9a6d86fd"},
+    {file = "google_api_python_client-2.158.0-py2.py3-none-any.whl", hash = "sha256:36f8c8d2e79e50f76790ca5946d2f3f8333e210dc8539a6c88e0742416474ad2"},
+    {file = "google_api_python_client-2.158.0.tar.gz", hash = "sha256:b6664597a9955e04977a62752e33fe44cb35c580e190c1cb08a041893172bd67"},
 ]
 
 [package.dependencies]
@@ -3707,13 +3707,13 @@ types-tqdm = "*"
 
 [[package]]
 name = "litellm"
-version = "1.57.4"
+version = "1.58.0"
 description = "Library to easily interface with LLM API providers"
 optional = false
 python-versions = "!=2.7.*,!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,!=3.7.*,>=3.8"
 files = [
-    {file = "litellm-1.57.4-py3-none-any.whl", hash = "sha256:afe48924d8a36db801018970a101622fce33d117fe9c54441c0095c491511abb"},
-    {file = "litellm-1.57.4.tar.gz", hash = "sha256:747a870ddee9c71f9560fc68ad02485bc1008fcad7d7a43e87867a59b8ed0669"},
+    {file = "litellm-1.58.0-py3-none-any.whl", hash = "sha256:1fc07646f6419f1d7b7d06fe2f5c72b3e6e3407423b50cbf45b58dc9740e7a03"},
+    {file = "litellm-1.58.0.tar.gz", hash = "sha256:db4512e987809e04e59d5b4240bdef3a4bfe575c332397f80cc6b4403c68120a"},
 ]
 
 [package.dependencies]
@@ -3731,7 +3731,7 @@ tokenizers = "*"
 
 [package.extras]
 extra-proxy = ["azure-identity (>=1.15.0,<2.0.0)", "azure-keyvault-secrets (>=4.8.0,<5.0.0)", "google-cloud-kms (>=2.21.3,<3.0.0)", "prisma (==0.11.0)", "resend (>=0.8.0,<0.9.0)"]
-proxy = ["PyJWT (>=2.8.0,<3.0.0)", "apscheduler (>=3.10.4,<4.0.0)", "backoff", "cryptography (>=43.0.1,<44.0.0)", "fastapi (>=0.115.5,<0.116.0)", "fastapi-sso (>=0.16.0,<0.17.0)", "gunicorn (>=22.0.0,<23.0.0)", "orjson (>=3.9.7,<4.0.0)", "pynacl (>=1.5.0,<2.0.0)", "python-multipart (>=0.0.18,<0.0.19)", "pyyaml (>=6.0.1,<7.0.0)", "rq", "uvicorn (>=0.22.0,<0.23.0)"]
+proxy = ["PyJWT (>=2.8.0,<3.0.0)", "apscheduler (>=3.10.4,<4.0.0)", "backoff", "cryptography (>=43.0.1,<44.0.0)", "fastapi (>=0.115.5,<0.116.0)", "fastapi-sso (>=0.16.0,<0.17.0)", "gunicorn (>=22.0.0,<23.0.0)", "orjson (>=3.9.7,<4.0.0)", "pynacl (>=1.5.0,<2.0.0)", "python-multipart (>=0.0.18,<0.0.19)", "pyyaml (>=6.0.1,<7.0.0)", "rq", "uvicorn (>=0.22.0,<0.23.0)", "uvloop (>=0.21.0,<0.22.0)"]
 
 [[package]]
 name = "llama-cloud"
@@ -4583,12 +4583,12 @@ type = ["mypy (==1.11.2)"]
 
 [[package]]
 name = "modal"
-version = "0.72.0"
+version = "0.72.10"
 description = "Python client library for Modal"
 optional = false
 python-versions = ">=3.9"
 files = [
-    {file = "modal-0.72.0-py3-none-any.whl", hash = "sha256:d09952ac907357d30a314fbf0b759c781ab24677aaf338f5775c9bcab26e4b78"},
+    {file = "modal-0.72.10-py3-none-any.whl", hash = "sha256:eb67516660e00a9dca07378fb251275a913720162e98410f46c79924cb7cd509"},
 ]
 
 [package.dependencies]
@@ -5364,13 +5364,13 @@ sympy = "*"
 
 [[package]]
 name = "openai"
-version = "1.59.5"
+version = "1.59.7"
 description = "The official Python library for the openai API"
 optional = false
 python-versions = ">=3.8"
 files = [
-    {file = "openai-1.59.5-py3-none-any.whl", hash = "sha256:e646b44856b0dda9345d3c43639e056334d792d1690e99690313c0ef7ca4d8cc"},
-    {file = "openai-1.59.5.tar.gz", hash = "sha256:9886e77c02dad9dc6a7b67a11ab372a56842a9b5d376aa476672175ab10e83a0"},
+    {file = "openai-1.59.7-py3-none-any.whl", hash = "sha256:cfa806556226fa96df7380ab2e29814181d56fea44738c2b0e581b462c268692"},
+    {file = "openai-1.59.7.tar.gz", hash = "sha256:043603def78c00befb857df9f0a16ee76a3af5984ba40cb7ee5e2f40db4646bf"},
 ]
 
 [package.dependencies]
@@ -7627,29 +7627,29 @@ pyasn1 = ">=0.1.3"
 
 [[package]]
 name = "ruff"
-version = "0.9.0"
+version = "0.9.1"
 description = "An extremely fast Python linter and code formatter, written in Rust."
 optional = false
 python-versions = ">=3.7"
 files = [
-    {file = "ruff-0.9.0-py3-none-linux_armv6l.whl", hash = "sha256:949b3513f931741e006cf267bf89611edff04e1f012013424022add3ce78f319"},
-    {file = "ruff-0.9.0-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:99fbcb8c7fe94ae1e462ab2a1ef17cb20b25fb6438b9f198b1bcf5207a0a7916"},
-    {file = "ruff-0.9.0-py3-none-macosx_11_0_arm64.whl", hash = "sha256:0b022afd8eb0fcfce1e0adec84322abf4d6ce3cd285b3b99c4f17aae7decf749"},
-    {file = "ruff-0.9.0-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:336567ce92c9ca8ec62780d07b5fa11fbc881dc7bb40958f93a7d621e7ab4589"},
-    {file = "ruff-0.9.0-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:d338336c44bda602dc8e8766836ac0441e5b0dfeac3af1bd311a97ebaf087a75"},
-    {file = "ruff-0.9.0-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d9b3ececf523d733e90b540e7afcc0494189e8999847f8855747acd5a9a8c45f"},
-    {file = "ruff-0.9.0-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:a11c0872a31232e473e2e0e2107f3d294dbadd2f83fb281c3eb1c22a24866924"},
-    {file = "ruff-0.9.0-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:b5fd06220c17a9cc0dc7fc6552f2ac4db74e8e8bff9c401d160ac59d00566f54"},
-    {file = "ruff-0.9.0-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:0457e775c74bf3976243f910805242b7dcd389e1d440deccbd1194ca17a5728c"},
-    {file = "ruff-0.9.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:05415599bbcb318f730ea1b46a39e4fbf71f6a63fdbfa1dda92efb55f19d7ecf"},
-    {file = "ruff-0.9.0-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:fbf9864b009e43cfc1c8bed1a6a4c529156913105780af4141ca4342148517f5"},
-    {file = "ruff-0.9.0-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:37b3da222b12e2bb2ce628e02586ab4846b1ed7f31f42a5a0683b213453b2d49"},
-    {file = "ruff-0.9.0-py3-none-musllinux_1_2_i686.whl", hash = "sha256:733c0fcf2eb0c90055100b4ed1af9c9d87305b901a8feb6a0451fa53ed88199d"},
-    {file = "ruff-0.9.0-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:8221a454bfe5ccdf8017512fd6bb60e6ec30f9ea252b8a80e5b73619f6c3cefd"},
-    {file = "ruff-0.9.0-py3-none-win32.whl", hash = "sha256:d345f2178afd192c7991ddee59155c58145e12ad81310b509bd2e25c5b0247b3"},
-    {file = "ruff-0.9.0-py3-none-win_amd64.whl", hash = "sha256:0cbc0905d94d21305872f7f8224e30f4bbcd532bc21b2225b2446d8fc7220d19"},
-    {file = "ruff-0.9.0-py3-none-win_arm64.whl", hash = "sha256:7b1148771c6ca88f820d761350a053a5794bc58e0867739ea93eb5e41ad978cd"},
-    {file = "ruff-0.9.0.tar.gz", hash = "sha256:143f68fa5560ecf10fc49878b73cee3eab98b777fcf43b0e62d43d42f5ef9d8b"},
+    {file = "ruff-0.9.1-py3-none-linux_armv6l.whl", hash = "sha256:84330dda7abcc270e6055551aca93fdde1b0685fc4fd358f26410f9349cf1743"},
+    {file = "ruff-0.9.1-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:3cae39ba5d137054b0e5b472aee3b78a7c884e61591b100aeb544bcd1fc38d4f"},
+    {file = "ruff-0.9.1-py3-none-macosx_11_0_arm64.whl", hash = "sha256:50c647ff96f4ba288db0ad87048257753733763b409b2faf2ea78b45c8bb7fcb"},
+    {file = "ruff-0.9.1-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f0c8b149e9c7353cace7d698e1656ffcf1e36e50f8ea3b5d5f7f87ff9986a7ca"},
+    {file = "ruff-0.9.1-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:beb3298604540c884d8b282fe7625651378e1986c25df51dec5b2f60cafc31ce"},
+    {file = "ruff-0.9.1-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:39d0174ccc45c439093971cc06ed3ac4dc545f5e8bdacf9f067adf879544d969"},
+    {file = "ruff-0.9.1-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:69572926c0f0c9912288915214ca9b2809525ea263603370b9e00bed2ba56dbd"},
+    {file = "ruff-0.9.1-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:937267afce0c9170d6d29f01fcd1f4378172dec6760a9f4dface48cdabf9610a"},
+    {file = "ruff-0.9.1-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:186c2313de946f2c22bdf5954b8dd083e124bcfb685732cfb0beae0c47233d9b"},
+    {file = "ruff-0.9.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3f94942a3bb767675d9a051867c036655fe9f6c8a491539156a6f7e6b5f31831"},
+    {file = "ruff-0.9.1-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:728d791b769cc28c05f12c280f99e8896932e9833fef1dd8756a6af2261fd1ab"},
+    {file = "ruff-0.9.1-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:2f312c86fb40c5c02b44a29a750ee3b21002bd813b5233facdaf63a51d9a85e1"},
+    {file = "ruff-0.9.1-py3-none-musllinux_1_2_i686.whl", hash = "sha256:ae017c3a29bee341ba584f3823f805abbe5fe9cd97f87ed07ecbf533c4c88366"},
+    {file = "ruff-0.9.1-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:5dc40a378a0e21b4cfe2b8a0f1812a6572fc7b230ef12cd9fac9161aa91d807f"},
+    {file = "ruff-0.9.1-py3-none-win32.whl", hash = "sha256:46ebf5cc106cf7e7378ca3c28ce4293b61b449cd121b98699be727d40b79ba72"},
+    {file = "ruff-0.9.1-py3-none-win_amd64.whl", hash = "sha256:342a824b46ddbcdddd3abfbb332fa7fcaac5488bf18073e841236aadf4ad5c19"},
+    {file = "ruff-0.9.1-py3-none-win_arm64.whl", hash = "sha256:1cd76c7f9c679e6e8f2af8f778367dca82b95009bc7b1a85a47f1521ae524fa7"},
+    {file = "ruff-0.9.1.tar.gz", hash = "sha256:fd2b25ecaf907d6458fa842675382c8597b3c746a2dde6717fe3415425df0c17"},
 ]
 
 [[package]]
@@ -9857,4 +9857,4 @@ testing = ["coverage[toml]", "zope.event", "zope.testing"]
 [metadata]
 lock-version = "2.0"
 python-versions = "^3.12"
-content-hash = "8320b6c6bb05538516a965589ce03fec4d30df38fb7b47fc934258f1d8d47e30"
+content-hash = "e52dad7dccfc86a34dcba7fc68255dc4cdc62ba23cb0d6dce5740917bc5dcd78"
diff --git a/pyproject.toml b/pyproject.toml
index af177c2a6fd9..fb538d5aa3cc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "openhands-ai"
-version = "0.19.0"
+version = "0.20.0"
 description = "OpenHands: Code Less, Make More"
 authors = ["OpenHands"]
 license = "MIT"
@@ -82,7 +82,7 @@ voyageai = "*"
 llama-index-embeddings-voyageai = "*"
 
 [tool.poetry.group.dev.dependencies]
-ruff = "0.9.0"
+ruff = "0.9.1"
 mypy = "1.14.1"
 pre-commit = "4.0.1"
 build = "*"
@@ -101,7 +101,6 @@ reportlab = "*"
 [tool.coverage.run]
 concurrency = ["gevent"]
 
-
 [tool.poetry.group.runtime.dependencies]
 jupyterlab = "*"
 notebook = "*"
@@ -130,7 +129,6 @@ ignore = ["D1"]
 [tool.ruff.lint.pydocstyle]
 convention = "google"
 
-
 [tool.poetry.group.evaluation.dependencies]
 streamlit = "*"
 whatthepatch = "*"
diff --git a/tests/unit/test_acompletion.py b/tests/unit/test_acompletion.py
index cca18bbb5b29..b6753759be3d 100644
--- a/tests/unit/test_acompletion.py
+++ b/tests/unit/test_acompletion.py
@@ -109,6 +109,9 @@ async def mock_on_cancel_requested():
         print(f'Cancel requested: {is_set}')
         return is_set
 
+    config = load_app_config()
+    config.on_cancel_requested_fn = mock_on_cancel_requested
+
     async def mock_acompletion(*args, **kwargs):
         print('Starting mock_acompletion')
         for i in range(20):  # Increased iterations for longer running task
@@ -150,6 +153,13 @@ async def cancel_after_delay():
 async def test_async_streaming_completion_with_user_cancellation(cancel_after_chunks):
     cancel_requested = False
 
+    async def mock_on_cancel_requested():
+        nonlocal cancel_requested
+        return cancel_requested
+
+    config = load_app_config()
+    config.on_cancel_requested_fn = mock_on_cancel_requested
+
     test_messages = [
         'This is ',
         'a test ',
diff --git a/tests/unit/test_codeact_agent.py b/tests/unit/test_codeact_agent.py
index 82db18c1fd12..b1f5e420c3b4 100644
--- a/tests/unit/test_codeact_agent.py
+++ b/tests/unit/test_codeact_agent.py
@@ -60,6 +60,7 @@ def mock_state() -> State:
 
 
 def test_cmd_output_observation_message(agent: CodeActAgent):
+    agent.config.function_calling = False
     obs = CmdOutputObservation(
         command='echo hello',
         content='Command output',
@@ -81,6 +82,7 @@ def test_cmd_output_observation_message(agent: CodeActAgent):
 
 
 def test_ipython_run_cell_observation_message(agent: CodeActAgent):
+    agent.config.function_calling = False
     obs = IPythonRunCellObservation(
         code='plt.plot()',
         content='IPython output\n![image](data:image/png;base64,ABC123)',
@@ -103,6 +105,7 @@ def test_ipython_run_cell_observation_message(agent: CodeActAgent):
 
 
 def test_agent_delegate_observation_message(agent: CodeActAgent):
+    agent.config.function_calling = False
     obs = AgentDelegateObservation(
         content='Content', outputs={'content': 'Delegated agent output'}
     )
@@ -119,6 +122,7 @@ def test_agent_delegate_observation_message(agent: CodeActAgent):
 
 
 def test_error_observation_message(agent: CodeActAgent):
+    agent.config.function_calling = False
     obs = ErrorObservation('Error message')
 
     results = agent.get_observation_message(obs, tool_call_id_to_message={})
@@ -141,6 +145,7 @@ def test_unknown_observation_message(agent: CodeActAgent):
 
 
 def test_file_edit_observation_message(agent: CodeActAgent):
+    agent.config.function_calling = False
     obs = FileEditObservation(
         path='/test/file.txt',
         prev_exist=True,
@@ -162,6 +167,7 @@ def test_file_edit_observation_message(agent: CodeActAgent):
 
 
 def test_file_read_observation_message(agent: CodeActAgent):
+    agent.config.function_calling = False
     obs = FileReadObservation(
         path='/test/file.txt',
         content='File content',
@@ -180,6 +186,7 @@ def test_file_read_observation_message(agent: CodeActAgent):
 
 
 def test_browser_output_observation_message(agent: CodeActAgent):
+    agent.config.function_calling = False
     obs = BrowserOutputObservation(
         url='http://example.com',
         trigger_by_action='browse',
@@ -200,6 +207,7 @@ def test_browser_output_observation_message(agent: CodeActAgent):
 
 
 def test_user_reject_observation_message(agent: CodeActAgent):
+    agent.config.function_calling = False
     obs = UserRejectObservation('Action rejected')
 
     results = agent.get_observation_message(obs, tool_call_id_to_message={})
@@ -215,6 +223,7 @@ def test_user_reject_observation_message(agent: CodeActAgent):
 
 
 def test_function_calling_observation_message(agent: CodeActAgent):
+    agent.config.function_calling = True
     mock_response = {
         'id': 'mock_id',
         'total_calls_in_response': 1,
diff --git a/tests/unit/test_condenser.py b/tests/unit/test_condenser.py
index 91878c86baa1..4aa5afcf7543 100644
--- a/tests/unit/test_condenser.py
+++ b/tests/unit/test_condenser.py
@@ -226,7 +226,7 @@ def test_llm_condenser_from_config():
 
     assert isinstance(condenser, LLMSummarizingCondenser)
     assert condenser.llm.config.model == 'gpt-4o'
-    assert condenser.llm.config.api_key.get_secret_value() == 'test_key'
+    assert condenser.llm.config.api_key == 'test_key'
 
 
 def test_llm_condenser(mock_llm, mock_state):
@@ -381,7 +381,7 @@ def test_llm_attention_condenser_from_config():
 
     assert isinstance(condenser, LLMAttentionCondenser)
     assert condenser.llm.config.model == 'gpt-4o'
-    assert condenser.llm.config.api_key.get_secret_value() == 'test_key'
+    assert condenser.llm.config.api_key == 'test_key'
     assert condenser.max_size == 50
     assert condenser.keep_first == 10
 
diff --git a/tests/unit/test_config.py b/tests/unit/test_config.py
index 5edfd64cda90..44a76145cf6e 100644
--- a/tests/unit/test_config.py
+++ b/tests/unit/test_config.py
@@ -63,7 +63,7 @@ def test_compat_env_to_config(monkeypatch, setup_env):
 
     assert config.workspace_base == '/repos/openhands/workspace'
     assert isinstance(config.get_llm_config(), LLMConfig)
-    assert config.get_llm_config().api_key.get_secret_value() == 'sk-proj-rgMV0...'
+    assert config.get_llm_config().api_key == 'sk-proj-rgMV0...'
     assert config.get_llm_config().model == 'gpt-4o'
     assert isinstance(config.get_agent_config(), AgentConfig)
     assert isinstance(config.get_agent_config().memory_max_threads, int)
@@ -83,7 +83,7 @@ def test_load_from_old_style_env(monkeypatch, default_config):
 
     load_from_env(default_config, os.environ)
 
-    assert default_config.get_llm_config().api_key.get_secret_value() == 'test-api-key'
+    assert default_config.get_llm_config().api_key == 'test-api-key'
     assert default_config.get_agent_config().memory_enabled is True
     assert default_config.default_agent == 'BrowsingAgent'
     assert default_config.workspace_base == '/opt/files/workspace'
@@ -126,7 +126,7 @@ def test_load_from_new_style_toml(default_config, temp_toml_file):
     # default llm & agent configs
     assert default_config.default_agent == 'TestAgent'
     assert default_config.get_llm_config().model == 'test-model'
-    assert default_config.get_llm_config().api_key.get_secret_value() == 'toml-api-key'
+    assert default_config.get_llm_config().api_key == 'toml-api-key'
     assert default_config.get_agent_config().memory_enabled is True
 
     # undefined agent config inherits default ones
@@ -291,7 +291,7 @@ def test_env_overrides_compat_toml(monkeypatch, default_config, temp_toml_file):
     assert default_config.get_llm_config().model == 'test-model'
     assert default_config.get_llm_config('llm').model == 'test-model'
     assert default_config.get_llm_config_from_agent().model == 'test-model'
-    assert default_config.get_llm_config().api_key.get_secret_value() == 'env-api-key'
+    assert default_config.get_llm_config().api_key == 'env-api-key'
 
     # after we set workspace_base to 'UNDEFINED' in the environment,
     # workspace_base should be set to that
@@ -336,7 +336,7 @@ def test_env_overrides_sandbox_toml(monkeypatch, default_config, temp_toml_file)
     assert default_config.workspace_mount_path is None
 
     # before load_from_env, values are set to the values from the toml file
-    assert default_config.get_llm_config().api_key.get_secret_value() == 'toml-api-key'
+    assert default_config.get_llm_config().api_key == 'toml-api-key'
     assert default_config.sandbox.timeout == 500
     assert default_config.sandbox.user_id == 1001
 
@@ -345,7 +345,7 @@ def test_env_overrides_sandbox_toml(monkeypatch, default_config, temp_toml_file)
     # values from env override values from toml
     assert os.environ.get('LLM_MODEL') is None
     assert default_config.get_llm_config().model == 'test-model'
-    assert default_config.get_llm_config().api_key.get_secret_value() == 'env-api-key'
+    assert default_config.get_llm_config().api_key == 'env-api-key'
 
     assert default_config.sandbox.timeout == 1000
     assert default_config.sandbox.user_id == 1002
@@ -412,7 +412,7 @@ def test_security_config_from_dict():
     # Test with all fields
     config_dict = {'confirmation_mode': True, 'security_analyzer': 'some_analyzer'}
 
-    security_config = SecurityConfig(**config_dict)
+    security_config = SecurityConfig.from_dict(config_dict)
 
     # Verify all fields are correctly set
     assert security_config.confirmation_mode is True
@@ -560,7 +560,10 @@ def test_load_from_toml_partial_invalid(default_config, temp_toml_file, caplog):
         assert 'Cannot parse [llm] config from toml' in log_content
         assert 'values have not been applied' in log_content
         # Error: LLMConfig.__init__() got an unexpected keyword argume
-        assert 'Error: 1 validation error for LLMConfig' in log_content
+        assert (
+            'Error: LLMConfig.__init__() got an unexpected keyword argume'
+            in log_content
+        )
         assert 'invalid_field' in log_content
 
         # invalid [sandbox] config
@@ -632,14 +635,12 @@ def test_api_keys_repr_str():
         aws_access_key_id='my_access_key',
         aws_secret_access_key='my_secret_key',
     )
-
-    # Check that no secret keys are emitted in representations of the config object
-    assert 'my_api_key' not in repr(llm_config)
-    assert 'my_api_key' not in str(llm_config)
-    assert 'my_access_key' not in repr(llm_config)
-    assert 'my_access_key' not in str(llm_config)
-    assert 'my_secret_key' not in repr(llm_config)
-    assert 'my_secret_key' not in str(llm_config)
+    assert "api_key='******'" in repr(llm_config)
+    assert "aws_access_key_id='******'" in repr(llm_config)
+    assert "aws_secret_access_key='******'" in repr(llm_config)
+    assert "api_key='******'" in str(llm_config)
+    assert "aws_access_key_id='******'" in str(llm_config)
+    assert "aws_secret_access_key='******'" in str(llm_config)
 
     # Check that no other attrs in LLMConfig have 'key' or 'token' in their name
     # This will fail when new attrs are added, and attract attention
@@ -651,7 +652,7 @@ def test_api_keys_repr_str():
         'output_cost_per_token',
         'custom_tokenizer',
     ]
-    for attr_name in LLMConfig.model_fields.keys():
+    for attr_name in dir(LLMConfig):
         if (
             not attr_name.startswith('__')
             and attr_name not in known_key_token_attrs_llm
@@ -666,7 +667,7 @@ def test_api_keys_repr_str():
     # Test AgentConfig
     # No attrs in AgentConfig have 'key' or 'token' in their name
     agent_config = AgentConfig(memory_enabled=True, memory_max_threads=4)
-    for attr_name in AgentConfig.model_fields.keys():
+    for attr_name in dir(AgentConfig):
         if not attr_name.startswith('__'):
             assert (
                 'key' not in attr_name.lower()
@@ -685,16 +686,16 @@ def test_api_keys_repr_str():
         modal_api_token_secret='my_modal_api_token_secret',
         runloop_api_key='my_runloop_api_key',
     )
-    assert 'my_e2b_api_key' not in repr(app_config)
-    assert 'my_e2b_api_key' not in str(app_config)
-    assert 'my_jwt_secret' not in repr(app_config)
-    assert 'my_jwt_secret' not in str(app_config)
-    assert 'my_modal_api_token_id' not in repr(app_config)
-    assert 'my_modal_api_token_id' not in str(app_config)
-    assert 'my_modal_api_token_secret' not in repr(app_config)
-    assert 'my_modal_api_token_secret' not in str(app_config)
-    assert 'my_runloop_api_key' not in repr(app_config)
-    assert 'my_runloop_api_key' not in str(app_config)
+    assert "e2b_api_key='******'" in repr(app_config)
+    assert "e2b_api_key='******'" in str(app_config)
+    assert "jwt_secret='******'" in repr(app_config)
+    assert "jwt_secret='******'" in str(app_config)
+    assert "modal_api_token_id='******'" in repr(app_config)
+    assert "modal_api_token_id='******'" in str(app_config)
+    assert "modal_api_token_secret='******'" in repr(app_config)
+    assert "modal_api_token_secret='******'" in str(app_config)
+    assert "runloop_api_key='******'" in repr(app_config)
+    assert "runloop_api_key='******'" in str(app_config)
 
     # Check that no other attrs in AppConfig have 'key' or 'token' in their name
     # This will fail when new attrs are added, and attract attention
@@ -704,7 +705,7 @@ def test_api_keys_repr_str():
         'modal_api_token_secret',
         'runloop_api_key',
     ]
-    for attr_name in AppConfig.model_fields.keys():
+    for attr_name in dir(AppConfig):
         if (
             not attr_name.startswith('__')
             and attr_name not in known_key_token_attrs_app
diff --git a/tests/unit/test_llm.py b/tests/unit/test_llm.py
index 227b0006b020..edf82d8aa41b 100644
--- a/tests/unit/test_llm.py
+++ b/tests/unit/test_llm.py
@@ -40,7 +40,7 @@ def default_config():
 def test_llm_init_with_default_config(default_config):
     llm = LLM(default_config)
     assert llm.config.model == 'gpt-4o'
-    assert llm.config.api_key.get_secret_value() == 'test_key'
+    assert llm.config.api_key == 'test_key'
     assert isinstance(llm.metrics, Metrics)
     assert llm.metrics.model_name == 'gpt-4o'
 
@@ -77,7 +77,7 @@ def test_llm_init_with_custom_config():
     )
     llm = LLM(custom_config)
     assert llm.config.model == 'custom-model'
-    assert llm.config.api_key.get_secret_value() == 'custom_key'
+    assert llm.config.api_key == 'custom_key'
     assert llm.config.max_input_tokens == 5000
     assert llm.config.max_output_tokens == 1500
     assert llm.config.temperature == 0.8
diff --git a/tests/unit/test_manager.py b/tests/unit/test_manager.py
index 144f79f9f491..f0ac68ff8361 100644
--- a/tests/unit/test_manager.py
+++ b/tests/unit/test_manager.py
@@ -114,10 +114,10 @@ async def test_init_new_local_session():
             sio, AppConfig(), InMemoryFileStore()
         ) as session_manager:
             await session_manager.maybe_start_agent_loop(
-                'new-session-id', ConversationInitData()
+                'new-session-id', ConversationInitData(), 1
             )
             await session_manager.join_conversation(
-                'new-session-id', 'new-session-id', ConversationInitData()
+                'new-session-id', 'new-session-id', ConversationInitData(), 1
             )
     assert session_instance.initialize_agent.call_count == 1
     assert sio.enter_room.await_count == 1
@@ -148,13 +148,13 @@ async def test_join_local_session():
             sio, AppConfig(), InMemoryFileStore()
         ) as session_manager:
             await session_manager.maybe_start_agent_loop(
-                'new-session-id', ConversationInitData()
+                'new-session-id', ConversationInitData(), None
             )
             await session_manager.join_conversation(
-                'new-session-id', 'new-session-id', ConversationInitData()
+                'new-session-id', 'new-session-id', ConversationInitData(), None
             )
             await session_manager.join_conversation(
-                'new-session-id', 'new-session-id', ConversationInitData()
+                'new-session-id', 'new-session-id', ConversationInitData(), None
             )
     assert session_instance.initialize_agent.call_count == 1
     assert sio.enter_room.await_count == 2
@@ -185,7 +185,7 @@ async def test_join_cluster_session():
             sio, AppConfig(), InMemoryFileStore()
         ) as session_manager:
             await session_manager.join_conversation(
-                'new-session-id', 'new-session-id', ConversationInitData()
+                'new-session-id', 'new-session-id', ConversationInitData(), 1
             )
     assert session_instance.initialize_agent.call_count == 0
     assert sio.enter_room.await_count == 1
@@ -216,10 +216,10 @@ async def test_add_to_local_event_stream():
             sio, AppConfig(), InMemoryFileStore()
         ) as session_manager:
             await session_manager.maybe_start_agent_loop(
-                'new-session-id', ConversationInitData()
+                'new-session-id', ConversationInitData(), 1
             )
             await session_manager.join_conversation(
-                'new-session-id', 'connection-id', ConversationInitData()
+                'new-session-id', 'connection-id', ConversationInitData(), 1
             )
             await session_manager.send_to_event_stream(
                 'connection-id', {'event_type': 'some_event'}
@@ -252,7 +252,7 @@ async def test_add_to_cluster_event_stream():
             sio, AppConfig(), InMemoryFileStore()
         ) as session_manager:
             await session_manager.join_conversation(
-                'new-session-id', 'connection-id', ConversationInitData()
+                'new-session-id', 'connection-id', ConversationInitData(), 1
             )
             await session_manager.send_to_event_stream(
                 'connection-id', {'event_type': 'some_event'}