feat(agent-canvas): add staticServer.lockToCloud chart value

Passes `--lock-to-cloud <url>` to static-server.mjs when set, injecting
`window.__AGENT_CANVAS_LOCK_TO_CLOUD__` so the UI locks backend setup to
a single OpenHands Cloud host instead of the user-managed "Manage
Backends" flow. Empty by default, so existing deployments are unchanged.

- charts/agent-canvas: add `staticServer.lockToCloud` value + template
- bump agent-canvas chart 0.1.1 -> 0.1.2
- bump openhands parent chart 0.7.64 -> 0.7.65 and its agent-canvas
  dependency to 0.1.2

This wires the lock-to-cloud mode added in OpenHands/agent-canvas#1389
into the Helm chart so deployments (e.g. canvas.staging.all-hands.dev)
can opt in via values.

Co-authored-by: openhands <openhands@all-hands.dev>

Author: openhands-agent

charts/agent-canvas/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: agent-canvas
 description: Frontend-only deployment of OpenHands Agent Canvas (UI shell pointing at user-managed backends)
 type: application
-version: 0.1.1
+version: 0.1.2
 appVersion: "0.1.0"

charts/agent-canvas/README.md

@@ -30,3 +30,20 @@ agent-canvas:
       enabled: true
       secretName: agent-canvas-tls
 ```
+
+### Locking the UI to a single OpenHands Cloud host
+
+Set `staticServer.lockToCloud` to pass `--lock-to-cloud <url>` to
+`static-server.mjs`. The UI then locks backend setup to a single
+OpenHands Cloud host (skipping the "Manage Backends" flow), e.g. for a
+dedicated `canvas.<env>.all-hands.dev` deployment:
+
+```yaml
+agent-canvas:
+  enabled: true
+  staticServer:
+    lockToCloud: https://app.all-hands.dev
+  ingress:
+    enabled: true
+    host: canvas.staging.all-hands.dev
+```

charts/agent-canvas/templates/deployment.yaml

@@ -44,6 +44,10 @@ spec:
             {{- if .Values.staticServer.authRequired }}
             - --auth-required
             {{- end }}
+            {{- with .Values.staticServer.lockToCloud }}
+            - --lock-to-cloud
+            - {{ . | quote }}
+            {{- end }}
             {{- range .Values.staticServer.rejectPrefixes }}
             - --reject-prefix
             - {{ . | quote }}

charts/agent-canvas/values.yaml

@@ -43,6 +43,12 @@ ingress:
 # normally proxy to a local backend (since this deployment has none).
 staticServer:
   authRequired: true
+  # When set, passes `--lock-to-cloud <url>` to static-server.mjs, which
+  # injects window.__AGENT_CANVAS_LOCK_TO_CLOUD__ so the UI locks backend
+  # setup to a single OpenHands Cloud host (e.g.
+  # https://app.all-hands.dev). Leave empty for the standard
+  # user-managed "Manage Backends" flow.
+  lockToCloud: ""
   rejectPrefixes:
     - /api
     - /server_info

charts/openhands/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 description: OpenHands is an AI-driven autonomous software engineer
 name: openhands
 appVersion: cloud-1.38.0
-version: 0.7.65
+version: 0.7.66
 dependencies:
   - name: keycloak
     version: 24.7.5
@@ -53,5 +53,5 @@ dependencies:
     condition: integrations-hub.enabled
   - name: agent-canvas
     repository: oci://ghcr.io/openhands/helm-charts
-    version: 0.1.1
+    version: 0.1.2
     condition: agent-canvas.enabled