ci: add endpoint-audit workflow (report-only) on main

[VascoSch92]

What

Ports the endpoint audit from vasco/endpoint-audit to main so it runs on PRs (it currently lives only on that feature branch, which is why it doesn't run on #224/#225). Adds:

• .github/workflows/endpoint-audit.yml — boots the pinned agent-server image, runs the audit, comments the report on the PR, uploads the .audit/ artifact
• scripts/endpoint-audit.mjs — diffs the client's HTTP surface against the agent-server's live OpenAPI spec
• endpoint-audit.config.json — config (gate spec + cloud classify spec)
• package.json — config.agentServerImage pin (ghcr.io/openhands/agent-server:1.29.0-python) + audit:endpoints script

Report-only (not blocking)

This lands with gate.mismatch: false — the workflow runs, posts a drift report as a self-updating PR comment, and uploads the artifact, but never fails CI.

Why: the audit is a strict check that flags any client call not on the agent-server. The client still legitimately calls cloud/enterprise endpoints that are not (and won't be) on the agent-server — cloud-proxy, the 5 meta-profiles, and 2 shared-events. A blocking gate would therefore be red on main and every PR for reasons unrelated to the PR. (Confirmed: the gate fails on every run on the feature branches today.)

Running report-only surfaces the drift on every PR without blocking merges. To make it a blocking gate later — once the client is reconciled to agent-server-only calls (or cloud endpoints are split into a separate client) — flip gate.mismatch: true.

Notes

• The audit needs a live agent-server, so it only runs in CI (boots the container on port 8010); there's no local/offline mode.
• No dependency changes, so npm ci is unaffected; no src/ changes.

[github-actions]

Endpoint audit

❌ 12 off-contract call(s) — not on the agent-server · classifiers: cloud

Category	Count
❌ Off-contract (not on agent-server)	12
⛔ no known backend	7
↗️ served by cloud	5
➕ Missing API (agent-server has, client lacks)	12
agent-server endpoints	104
client endpoints	102

❌ Not on agent-server (gated, 12)

⛔ (no known backend) — served by no backend we can see (7)

• DELETE /api/meta-profiles/{}
• GET /api/meta-profiles
• GET /api/meta-profiles/{}
• POST /api/cloud-proxy
• POST /api/meta-profiles/{}
• POST /api/meta-profiles/{}/activate
• POST /api/skills/installed/{}/update

↗️ served by cloud (5)

• DELETE /api/keys/{}
• GET /api/keys
• GET /api/shared-events/search
• POST /api/accept_tos
• POST /api/keys

➕ Missing API — agent-server exposes it, client does not implement (12)

• GET /
• GET /api/bash/bash_events
• GET /api/conversations
• GET /api/conversations/{}/events
• GET /api/conversations/{}/workspace
• GET /api/conversations/{}/workspace/{}
• GET /api/init
• POST /api/conversations/{}/goal
• POST /api/conversations/{}/goal/resume
• POST /api/conversations/{}/goal/stop
• POST /api/init
• POST /api/skills/installed/{}/refresh

[openhands-release-bot]

🚀 Released in v1.27.0.