refactor(client): remove dead endpoint clients (security, unset-provider-tokens, generate_title)

[VascoSch92]

What

Removes client surfaces for endpoints that no consumer reaches — they are absent from the agent-server on every branch and unused by agent-canvas. Follow-up to the endpoint-audit.

Removed from client	Endpoint(s)	Why
SecurityClient (whole class) + ConversationManager.security	GET/POST /api/security/policy, GET/POST /api/security/settings, GET /api/security/export-trace	Legacy OpenHands monolith endpoints (Invariant analyzer). Served by the old backend, consumed only by the legacy frontend via its own client — never the agent-server (no /api/security/* route on any branch).
SessionClient.unsetProviderTokens	POST /api/unset-provider-tokens	Legacy-monolith endpoint, absent from the agent-server. SessionClient.acceptTos (/api/accept_tos) is retained.
RemoteConversation.generateTitle	POST /api/conversations/{id}/generate_title	Dropped server-side (added in agent-server #3100, removed in #3326). Only the internal Conversation.generate_title capability remains, for server-side auto-titling.

Also drops the now-orphaned exports/types: SecuritySettings, SecurityTraceResponse, SecurityClientOptions, GenerateTitleRequest, GenerateTitleResponse.

Scope notes

• SessionClient is kept — only unsetProviderTokens is removed; acceptTos stays.
• LocalConversation.generateTitle is kept — it generates a title from message history via the local LLM (no endpoint), so it's unrelated to the dropped server route. generateTitle is removed from the IConversation interface and from RemoteConversation (hence the Conversation class), making it a local-only capability.
• The security analyzer (SecurityAnalyzer, createSecurityAnalyzer, SetSecurityAnalyzerRequest) is a separate runtime feature and is untouched.
• No endpoint-audit.config.json change needed — the current config classifies gated calls dynamically against the live agent-server/cloud specs; there are no baseline entries for these to remove.

Breaking change

Removes the public SecurityClient, ConversationManager.security, SessionClient.unsetProviderTokens, generateTitle (from IConversation / RemoteConversation / Conversation), and the types SecuritySettings / SecurityTraceResponse / SecurityClientOptions / GenerateTitleRequest / GenerateTitleResponse.

Verification

• tsc --noEmit: clean
• npm run lint: 0 errors (pre-existing no-explicit-any warnings only, in untouched files)
• npm test: 254/254 pass (14 suites)
• The endpoint-audit gate runs in CI (it needs a live agent-server, so it isn't run locally)

Base branch

Stacked on vasco/endpoint-audit to keep the diff focused on just these deletions. Happy to retarget to main if preferred.

[github-actions]

Endpoint audit

❌ 12 off-contract call(s) — not on the agent-server · classifiers: cloud

Category	Count
❌ Off-contract (not on agent-server)	12
⛔ no known backend	7
↗️ served by cloud	5
➕ Missing API (agent-server has, client lacks)	12
agent-server endpoints	104
client endpoints	102

❌ Not on agent-server (gated, 12)

⛔ (no known backend) — served by no backend we can see (7)

• DELETE /api/meta-profiles/{}
• GET /api/meta-profiles
• GET /api/meta-profiles/{}
• POST /api/cloud-proxy
• POST /api/meta-profiles/{}
• POST /api/meta-profiles/{}/activate
• POST /api/skills/installed/{}/update

↗️ served by cloud (5)

• DELETE /api/keys/{}
• GET /api/keys
• GET /api/shared-events/search
• POST /api/accept_tos
• POST /api/keys

➕ Missing API — agent-server exposes it, client does not implement (12)

• GET /
• GET /api/bash/bash_events
• GET /api/conversations
• GET /api/conversations/{}/events
• GET /api/conversations/{}/workspace
• GET /api/conversations/{}/workspace/{}
• GET /api/init
• POST /api/conversations/{}/goal
• POST /api/conversations/{}/goal/resume
• POST /api/conversations/{}/goal/stop
• POST /api/init
• POST /api/skills/installed/{}/refresh

[openhands-release-bot]

🚀 Released in v1.27.0.