refactor(client): remove dead ApiKeysClient and SessionClient (keys + accept_tos)

[VascoSch92]

Human

@neubig you added these end-points but it seems that neither the agent-server exposes nor agent-canvas consumes.

Can we delete them or you plan to use them?

What

Removes two more client surfaces for endpoints that no consumer reaches through this package — absent from the agent-server on every branch, and unused by agent-canvas. Follow-up to #224.

Removed	Endpoint(s)	Notes
ApiKeysClient (whole class) + ConversationManager.apiKeys	GET /api/keys, POST /api/keys, DELETE /api/keys/{}
SessionClient (whole class) + ConversationManager.session	POST /api/accept_tos	acceptTos was its only remaining method after #224 removed unsetProviderTokens, so the now-empty class is dropped entirely rather than left as a no-op.

Also drops the orphaned types ApiKey, CreateApiKeyResponse, AcceptTosResponse and the ApiKeysClientOptions / SessionClientOptions exports.

Where these endpoints actually live

They are served by the OpenHands/OpenHands enterprise/ server (the SaaS backend) and consumed by its own frontend via its own axios client — not @openhands/typescript-client:

• enterprise/server/routes/api_keys.py (APIRouter(prefix='/api/keys'))
• enterprise/server/routes/auth.py (@api_router.post('/accept_tos'))

So removing these client classes does not affect OpenHands/OpenHands, agent-canvas, or the agent-server.

Scope notes

• SharedClient (GET /api/shared-events/search) is kept — it's actively used by agent-canvas (use-shared-conversation.ts, use-shared-conversation-events.ts).
• The /api/keys/**current** endpoint that agent-canvas does call is a different route, reached via the cloud-proxy, not via ApiKeysClient — unaffected.

Breaking change

Removes the public ApiKeysClient and SessionClient classes, ConversationManager.apiKeys, ConversationManager.session, and the types ApiKey / CreateApiKeyResponse / AcceptTosResponse.

Verification

• tsc --noEmit: clean
• npm run lint: 0 errors (pre-existing no-explicit-any warnings only)
• npm test: 258/258 pass (14 suites)

[github-actions]

Endpoint audit

❌ 8 off-contract call(s) — not on the agent-server · classifiers: cloud

Category	Count
❌ Off-contract (not on agent-server)	8
⛔ no known backend	7
↗️ served by cloud	1
➕ Missing API (agent-server has, client lacks)	9
agent-server endpoints	104
client endpoints	101

❌ Not on agent-server (gated, 8)

⛔ (no known backend) — served by no backend we can see (7)

• DELETE /api/meta-profiles/{}
• GET /api/meta-profiles
• GET /api/meta-profiles/{}
• POST /api/cloud-proxy
• POST /api/meta-profiles/{}
• POST /api/meta-profiles/{}/activate
• POST /api/skills/installed/{}/update

↗️ served by cloud (1)

• GET /api/shared-events/search

➕ Missing API — agent-server exposes it, client does not implement (9)

• GET /
• GET /api/bash/bash_events
• GET /api/conversations
• GET /api/conversations/{}/events
• GET /api/conversations/{}/workspace
• GET /api/conversations/{}/workspace/{}
• GET /api/init
• POST /api/init
• POST /api/skills/installed/{}/refresh

[neubig]

OK, let's remove these

[openhands-release-bot]

🚀 Released in v1.27.0.