OpenHands Fork Audit - HIGH: Stale duplicate build/lib/ directories under vendor/ could be shipped

FLEET AUDIT FINDING: OpenHands Zentra fork — offline packaging audit

Location: vendor/openhands-sdk/build/lib, vendor/openhands-agent-server/build/lib, vendor/openhands-tools/build/lib

Severity: HIGH (P2) — Maintainability/hygiene; risk of stale code being shipped if packaging is done incorrectly

The Issue:
Each vendored package has a build/ directory with a lib/ subdirectory containing duplicate Python source:

vendor/openhands-sdk/
  ├── openhands/sdk/...          (source)
  └── build/lib/openhands/sdk/... (stale copy)

vendor/openhands-agent-server/
  ├── openhands/agent_server/...  (source)
  └── build/lib/openhands/agent_server/... (stale copy)

These build/ artifacts should NOT be in the git repo. They are created by setup.py/build during wheel builds and should be cleaned before committing.

Why it matters:

1. Duplication → maintenance burden (changes must be mirrored)
2. Stale copies → if the build process is wrong, old code could ship
3. Confusion → future maintainers might edit the stale copy instead of the source
4. Size → unnecessarily inflates the repo and the shipped package

Proof:

find vendor -path "*/build/lib/*" -name "*.py" | wc -l
# Currently ~300+ Python files duplicated

Verify stale-ness:

diff vendor/openhands-sdk/openhands/sdk/_zentra_airgap.py vendor/openhands-sdk/build/lib/openhands/sdk/_zentra_airgap.py
# Will show they differ (build/ is stale from an earlier vendor cycle)

Fix guidance:

1. Add vendor/*/build/ to .gitignore (if not already there)
2. Clean existing: find vendor -type d -name build -exec rm -rf {} ; 2>/dev/null
3. Update the vendoring/build process to clean build/ before final commit
4. Verify packaging uses the source trees, not build/lib

This is a hygiene fix, not a functional fix, but it prevents future confusion and shipping accidents.

Start with vendor/openhands-sdk/build/lib, vendor/openhands-agent-server/build/lib, and vendor/openhands-tools/build/lib, then inspect .gitignore and the vendoring/build process. Use the issue's find and diff commands to identify tracked artifacts and compare copies. Done means existing build/ directories are removed, future vendor builds clean them before commit, and packaging uses the source trees.