@openhands/agent-canvas 1.0.0-rc.9 → 1.0.0

package/dist/node_modules/@openhands/extensions/integrations/catalog/github.js

@@ -12,35 +12,23 @@ var e = {
 		"code"
 	],
 	popularityRank: 100,
-	installHint: "Requires Docker because the legacy npm package was deprecated upstream.",
 	kind: "mcp",
 	defaultConnectionOptionId: "api",
 	connectionOptions: [{
 		id: "api",
 		provider: "mcp",
 		transport: {
-			kind: "stdio",
-			serverName: "github",
-			command: "docker",
-			args: [
-				"run",
-				"-i",
-				"--rm",
-				"-e",
-				"GITHUB_PERSONAL_ACCESS_TOKEN",
-				"ghcr.io/github/github-mcp-server"
-			],
-			envFields: [{
-				key: "GITHUB_PERSONAL_ACCESS_TOKEN",
-				label: "Personal access token",
-				type: "password",
-				placeholder: "github_pat_...",
-				required: !0,
-				helperText: "Classic or fine-grained personal access token from GitHub settings.",
-				helperLink: "https://github.com/settings/tokens"
-			}]
+			kind: "shttp",
+			url: "https://api.githubcopilot.com/mcp/"
 		},
-		auth: { strategy: "api_key" }
+		auth: {
+			strategy: "api_key",
+			credentialLabel: "Personal access token",
+			credentialPlaceholder: "github_pat_...",
+			credentialHelp: "Classic or fine-grained personal access token from GitHub settings.",
+			credentialSecretName: "GITHUB_PERSONAL_ACCESS_TOKEN",
+			saveCredentialAsSecretByDefault: !0
+		}
 	}]
 };
 //#endregion

package/dist/node_modules/@openhands/extensions/integrations/catalog/github.js.map

@@ -1 +1 @@
-{"version":3,"file":"github.js","names":[],"sources":["../../../../../../node_modules/@openhands/extensions/integrations/catalog/github.json"],"sourcesContent":["{\n  \"id\": \"github\",\n  \"name\": \"GitHub\",\n  \"description\": \"Search code, manage issues and pull requests, and inspect repos via the GitHub API.\",\n  \"docsUrl\": \"https://github.com/github/github-mcp-server\",\n  \"iconBg\": \"var(--oh-surface)\",\n  \"keywords\": [\n    \"git\",\n    \"pr\",\n    \"repo\",\n    \"issues\",\n    \"code\"\n  ],\n  \"popularityRank\": 100,\n  \"installHint\": \"Requires Docker because the legacy npm package was deprecated upstream.\",\n  \"kind\": \"mcp\",\n  \"defaultConnectionOptionId\": \"api\",\n  \"connectionOptions\": [\n    {\n      \"id\": \"api\",\n      \"provider\": \"mcp\",\n      \"transport\": {\n        \"kind\": \"stdio\",\n        \"serverName\": \"github\",\n        \"command\": \"docker\",\n        \"args\": [\n          \"run\",\n          \"-i\",\n          \"--rm\",\n          \"-e\",\n          \"GITHUB_PERSONAL_ACCESS_TOKEN\",\n          \"ghcr.io/github/github-mcp-server\"\n        ],\n        \"envFields\": [\n          {\n            \"key\": \"GITHUB_PERSONAL_ACCESS_TOKEN\",\n            \"label\": \"Personal access token\",\n            \"type\": \"password\",\n            \"placeholder\": \"github_pat_...\",\n            \"required\": true,\n            \"helperText\": \"Classic or fine-grained personal access token from GitHub settings.\",\n            \"helperLink\": \"https://github.com/settings/tokens\"\n          }\n        ]\n      },\n      \"auth\": {\n        \"strategy\": \"api_key\"\n      }\n    }\n  ]\n}\n"],"x_google_ignoreList":[0],"mappings":""}
+{"version":3,"file":"github.js","names":[],"sources":["../../../../../../node_modules/@openhands/extensions/integrations/catalog/github.json"],"sourcesContent":["{\n  \"id\": \"github\",\n  \"name\": \"GitHub\",\n  \"description\": \"Search code, manage issues and pull requests, and inspect repos via the GitHub API.\",\n  \"docsUrl\": \"https://github.com/github/github-mcp-server\",\n  \"iconBg\": \"var(--oh-surface)\",\n  \"keywords\": [\n    \"git\",\n    \"pr\",\n    \"repo\",\n    \"issues\",\n    \"code\"\n  ],\n  \"popularityRank\": 100,\n  \"kind\": \"mcp\",\n  \"defaultConnectionOptionId\": \"api\",\n  \"connectionOptions\": [\n    {\n      \"id\": \"api\",\n      \"provider\": \"mcp\",\n      \"transport\": {\n        \"kind\": \"shttp\",\n        \"url\": \"https://api.githubcopilot.com/mcp/\"\n      },\n      \"auth\": {\n        \"strategy\": \"api_key\",\n        \"credentialLabel\": \"Personal access token\",\n        \"credentialPlaceholder\": \"github_pat_...\",\n        \"credentialHelp\": \"Classic or fine-grained personal access token from GitHub settings.\",\n        \"credentialSecretName\": \"GITHUB_PERSONAL_ACCESS_TOKEN\",\n        \"saveCredentialAsSecretByDefault\": true\n      }\n    }\n  ]\n}\n"],"x_google_ignoreList":[0],"mappings":""}

package/dist/node_modules/@openhands/extensions/skills/index.cjs

@@ -1288,14 +1288,15 @@ curl -X POST \\
 5. Do NOT post comments for code that is acceptable — only comment when action is needed
 6. Use suggestion syntax for concrete code changes, but only after verifying the resulting code matches your description (see "How Suggestions Actually Work")
 7. Keep the review body brief (details go in inline comments)
-8. If no issues: post a short approval message with no inline comments`},{name:`github-pr-reviewer`,description:`Create an automation that reviews GitHub pull requests when they are opened or updated. Inspects the diff, changed files, tests, and existing discussion via GitHub MCP, then posts a concise review highlighting risks, security issues, missing tests, and next steps.`,triggers:[`/pr-reviewer:setup`],content:`# GitHub PR Reviewer Automation
+8. If no issues: post a short approval message with no inline comments`},{name:`github-pr-reviewer`,description:`Create an automation that reviews GitHub pull requests when a configurable trigger label is applied. Polls GitHub deterministically, starts one OpenHands review conversation per label event, inspects full repository and PR context, and posts the final review comment back to GitHub.`,triggers:[`/pr-reviewer:setup`],content:`# GitHub PR Reviewer Automation
 
-Create a cron automation that polls a GitHub repository, reviews each open
-pull request exactly once, and posts the AI review as a GitHub comment.
+Create a cron automation that watches a GitHub repository for pull requests
+with a review trigger label, starts an OpenHands review conversation once per
+label event, and posts the AI review as a GitHub comment.
 
-The automation script is fully deterministic: PR discovery, state tracking,
-and deduplication are handled in Python. The LLM is only invoked to write
-the review text for PRs not yet seen, never for orchestration.
+The automation script is deterministic: PR discovery, label-event tracking,
+state persistence, stale-result suppression, and GitHub comment posting are
+handled in Python. The LLM is invoked only for the review itself.
 
 ---
 
@@ -1303,12 +1304,12 @@ the review text for PRs not yet seen, never for orchestration.
 
 ### Required secret
 
-Verify that the following secret is set in **OpenHands Settings → Secrets**:
+Verify that the following secret is set in **OpenHands Settings -> Secrets**:
 
 | Secret name | Token type | Minimum permissions |
 |---|---|---|
-| \`GITHUB_PERSONAL_ACCESS_TOKEN\` | Classic PAT | \`repo\` (private) or \`public_repo\` (public) |
-| \`GITHUB_PERSONAL_ACCESS_TOKEN\` | Fine-grained PAT | Pull requests: Read and Write |
+| \`GITHUB_PERSONAL_ACCESS_TOKEN\` | Classic PAT | \`repo\` for private repos or \`public_repo\` for public repos |
+| \`GITHUB_PERSONAL_ACCESS_TOKEN\` | Fine-grained PAT | Contents: Read, Metadata: Read, Pull requests: Read, Issues: Read and Write |
 
 Check with:
 \`\`\`bash
@@ -1325,16 +1326,16 @@ If the token is missing or invalid, inform the user and stop.
 
 Follow these steps in order.
 
-### Step 1 — Verify GITHUB_PERSONAL_ACCESS_TOKEN
+### Step 1 - Verify \`GITHUB_PERSONAL_ACCESS_TOKEN\`
 
 Run the \`curl\` check above.
 
 - If absent: *"GITHUB_PERSONAL_ACCESS_TOKEN is not set. Please add it in
-  OpenHands Settings → Secrets."* Stop.
+  OpenHands Settings -> Secrets."* Stop.
 - If the API returns \`{"message": "Bad credentials"}\`: tell the user the
   token is invalid and ask them to update it. Stop.
 
-### Step 2 — Collect repository
+### Step 2 - Collect repository
 
 Ask: *"Which GitHub repository should be monitored?
 (Format: \`owner/repo\`, e.g. \`myorg/backend\`)"*
@@ -1355,26 +1356,38 @@ else:
 
 Record \`REPO = "{owner}/{repo}"\`.
 
-### Step 3 — Collect review tone
+### Step 3 - Collect trigger label
+
+Ask: *"Which PR label should trigger a review?
+(Press Enter for the default: \`openhands-review\`.)"*
+
+Record the answer as \`TRIGGER_LABEL\`. If the label does not exist yet, tell the
+user that GitHub will still record the event once the label is created and
+applied to a PR.
+
+The automation reviews a PR when it sees the latest matching \`labeled\` event for
+that label. To request another review later, remove and re-apply the label.
+
+### Step 4 - Collect review tone
 
 Ask: *"What review tone should the reviewer use?
-  1. Thorough (default) — comprehensive coverage of correctness, security, tests, style
-  2. Concise — high-signal only, skips minor style feedback
-  3. Friendly — constructive and encouraging
+  1. Thorough (default) - comprehensive coverage of correctness, security, tests, style
+  2. Concise - high-signal only, skips minor style feedback
+  3. Friendly - constructive and encouraging
 (Press Enter for Thorough, or type your choice or any custom style description)"*
 
 Map the choice to \`REVIEW_TONE\`:
 
 | Answer | \`REVIEW_TONE\` | \`REVIEW_STYLE_INSTRUCTIONS\` |
-|--------|--------------|------------------------------|
+|---|---|---|
 | 1 / Enter | \`"thorough"\` | \`""\` |
 | 2 | \`"concise"\` | \`""\` |
 | 3 | \`"friendly"\` | \`""\` |
-| Custom text (e.g. "hostile pirate") | \`"thorough"\` | the custom text verbatim |
+| Custom text, e.g. \`strict but kind\` | \`"thorough"\` | the custom text verbatim |
 
-### Step 4 — Collect cron schedule
+### Step 5 - Collect cron schedule
 
-Ask: *"How often should the automation poll for new PRs?
+Ask: *"How often should the automation poll for labeled PRs?
 (Press Enter for the default: every 5 minutes.
 Use a cron expression for a different interval, e.g. \`0 * * * *\` = hourly)"*
 
@@ -1382,22 +1395,26 @@ Default: \`*/5 * * * *\`.
 
 Record as \`CRON_SCHEDULE\`.
 
-### Step 5 — Generate the automation script
+### Step 6 - Generate the automation script
 
-Read \`scripts/main.py\` from this skill's directory. Apply exactly four
-constant substitutions near the top of the file:
+Read \`scripts/main.py\` from this skill's directory. Apply exactly five constant
+substitutions near the top of the file:
 
 | Placeholder | Replace with |
 |---|---|
 | \`REPO = "owner/repo"\` | \`REPO = "{owner_repo}"\` |
+| \`TRIGGER_LABEL = "openhands-review"\` | \`TRIGGER_LABEL = "{trigger_label}"\` |
 | \`REVIEW_TONE = "thorough"\` | \`REVIEW_TONE = "{review_tone}"\` |
 | \`REVIEW_STYLE_INSTRUCTIONS = ""\` | \`REVIEW_STYLE_INSTRUCTIONS = "{style_instructions}"\` |
 | \`DEFAULT_OPENHANDS_URL = "http://localhost:8000"\` | leave unchanged unless the user has a preference |
 
-Write the customised script to a temporary build directory:
+Use a safe string writer such as \`json.dumps(value)\` when inserting user-provided
+repository names, labels, or style instructions into Python string literals.
+
+Write the customized script to a temporary build directory:
 \`\`\`bash
 mkdir -p /tmp/pr-reviewer-build
-# write the customised main.py to /tmp/pr-reviewer-build/main.py
+# write the customized main.py to /tmp/pr-reviewer-build/main.py
 \`\`\`
 
 Validate syntax before packaging:
@@ -1407,7 +1424,7 @@ python3 -m py_compile /tmp/pr-reviewer-build/main.py && echo "Syntax OK"
 
 Fix any syntax errors before proceeding.
 
-### Step 6 — Package and upload
+### Step 7 - Package and upload
 
 Determine the Automation backend URL and auth from the \`<RUNTIME_SERVICES>\`
 block in your system context:
@@ -1427,14 +1444,14 @@ TARBALL_PATH=$(curl -s -X POST \\
 echo "Uploaded: $TARBALL_PATH"
 \`\`\`
 
-### Step 7 — Register the automation
+### Step 8 - Register the automation
 
 \`\`\`bash
 curl -s -X POST "\${OPENHANDS_HOST}/api/automation/v1" \\
   -H "X-Session-API-Key: $OPENHANDS_AUTOMATION_API_KEY" \\
   -H "Content-Type: application/json" \\
   -d "{
-    \\"name\\": \\"GitHub PR Reviewer: {owner}/{repo}\\",
+    \\"name\\": \\"GitHub PR Reviewer: {owner}/{repo} label {trigger_label}\\",
     \\"trigger\\": {\\"type\\": \\"cron\\", \\"schedule\\": \\"{cron_schedule}\\"},
     \\"tarball_path\\": \\"$TARBALL_PATH\\",
     \\"entrypoint\\": \\"python3 main.py\\",
@@ -1444,7 +1461,7 @@ curl -s -X POST "\${OPENHANDS_HOST}/api/automation/v1" \\
 
 Record the returned \`id\`.
 
-### Step 8 — Confirm
+### Step 9 - Confirm
 
 Tell the user:
 
@@ -1452,13 +1469,14 @@ Tell the user:
 >
 > - Automation ID: \`{id}\`
 > - Repository: \`{owner}/{repo}\`
+> - Trigger label: \`{trigger_label}\`
 > - Review tone: \`{tone}\`
 > - Polling schedule: \`{cron_schedule}\`
-> - State file: \`~/.openhands/workspaces/automation-state/github_pr_reviewer_{id}.json\`
+> - State file: \`~/.openhands/workspaces/automation-state/github_pr_reviewer_label_event_{id}.json\`
 >
-> The next cron run will discover all currently open PRs and queue reviews.
-> Each PR is reviewed exactly once; state is stored in the JSON file above.
-> To force a re-review of all PRs, delete the state file.
+> Apply the \`{trigger_label}\` label to a pull request to queue a review. Each
+> label event is processed once. To request another review, remove and re-apply
+> the label.
 
 ---
 
@@ -1466,36 +1484,37 @@ Tell the user:
 
 Each cron run executes \`main.py\`, which:
 
-1. **Loads state** from the JSON file (see \`references/state-schema.md\`).
-2. **Resolves and validates \`GITHUB_PERSONAL_ACCESS_TOKEN\`** — aborts
-   immediately if absent or invalid.
-3. **Lists all open PRs** in the configured repository.
-4. **For each PR not yet in state**:
-   - Fetches the unified diff via the GitHub API.
-   - Skips PRs whose diff exceeds \`MAX_DIFF_LINES_SKIP\` (default 5000 lines)
-     and posts an explanatory comment.
-   - Truncates diffs larger than \`MAX_DIFF_LINES\` (default 500 lines) and
-     notes this in the prompt.
-   - Creates an OpenHands conversation with the PR metadata, diff, and
-     configured tone instructions as the initial message.
-   - Posts an acknowledgement comment on the PR with a link to the conversation.
-   - Records the PR in state with \`status: "active"\`.
-5. **For each active conversation**:
-   - Skips PRs that have been closed or merged (marks them closed silently).
-   - Checks the conversation's \`execution_status\`.
-   - When it reaches \`idle\`, \`finished\`, \`error\`, or \`stuck\`:
-     posts the agent's final response as a GitHub comment and marks the
-     conversation \`closed\`.
-6. **Saves updated state** and fires the completion callback.
+1. Loads state from the JSON file (see \`references/state-schema.md\`).
+2. Resolves and validates \`GITHUB_PERSONAL_ACCESS_TOKEN\` and repository access.
+3. Lists open PRs, newest-updated first.
+4. For each open PR carrying \`TRIGGER_LABEL\`:
+   - Refetches current PR metadata to avoid acting on stale list data.
+   - Finds the latest matching GitHub \`labeled\` issue event.
+   - Skips the event if it has already been tracked.
+   - Starts an OpenHands conversation with a review prompt that includes PR
+     metadata, the exact head SHA, label event details, and instructions to
+     clone the repo, inspect PR discussion, review comments, changed files,
+     diff, and surrounding code.
+   - Posts an acknowledgement comment with the label event, head SHA, and
+     conversation link.
+   - Records the label-event review in state with \`status: "active"\`.
+5. For each active review conversation:
+   - Marks it closed without posting if the PR has closed or merged.
+   - Suppresses stale results if the PR head SHA changed after the review was
+     queued.
+   - When the conversation reaches \`idle\`, \`finished\`, \`error\`, or \`stuck\`,
+     posts the agent's final response as a GitHub comment and marks the review
+     closed.
+6. Saves state atomically and fires the completion callback.
 
 ---
 
 ## Additional Resources
 
-- **\`references/state-schema.md\`** — State JSON schema, field definitions,
-  and conversation lifecycle diagram.
-- **\`scripts/main.py\`** — The complete automation script. Customise the
-  four constants at the top before packaging.
+- **\`references/state-schema.md\`** - State JSON schema, field definitions, and
+  review lifecycle diagram.
+- **\`scripts/main.py\`** - The complete automation script. Customize the five
+  constants at the top before packaging.
 
 ---
 
@@ -1503,12 +1522,12 @@ Each cron run executes \`main.py\`, which:
 
 | Symptom | Likely cause | Fix |
 |---|---|---|
-| Bot never posts reviews | \`GITHUB_PERSONAL_ACCESS_TOKEN\` missing or wrong scopes | Verify token; check Step 1 |
-| "Bad credentials" in run logs | Token expired | Rotate and update the secret |
+| Bot never queues reviews | Trigger label not present or no matching \`labeled\` event | Apply the configured label to the PR |
+| "Bad credentials" in run logs | Token expired | Rotate and update \`GITHUB_PERSONAL_ACCESS_TOKEN\` |
 | 404 on repo access | Repo name wrong or no access | Re-check \`owner/repo\` and token permissions |
-| Same PR reviewed twice | State file deleted or corrupted | Check that the state file path is stable across runs |
-| Review never posted | Conversation stuck in \`running\` | Open the conversation in the OpenHands UI |
-| PR skipped silently | Diff too large | Raise \`MAX_DIFF_LINES_SKIP\` in the script or split the PR |`},{name:`github-repo-monitor`,description:`This skill should be used when the user asks to "monitor a GitHub repository", "watch GitHub for issues or PRs", "respond to @OpenHands mentions on GitHub", "set up an OpenHands GitHub integration", "trigger OpenHands from a GitHub comment", or "poll a GitHub repo for a trigger phrase". Guides the user through creating a cron automation that polls a single repository and starts an OpenHands conversation whenever a configurable trigger phrase is detected in an issue or PR comment.`,triggers:[`/github-monitor:poll`],content:`# GitHub Repository Monitor
+| Same PR not reviewed after new commits | Label event was already processed | Remove and re-apply the trigger label |
+| Review result never posts | Conversation still running or stuck | Open the conversation link from the acknowledgement comment |
+| Stale review suppressed | PR head SHA changed while the agent was reviewing | Re-apply the trigger label after the latest commit |`},{name:`github-repo-monitor`,description:`This skill should be used when the user asks to "monitor a GitHub repository", "watch GitHub for issues or PRs", "respond to @OpenHands mentions on GitHub", "set up an OpenHands GitHub integration", "trigger OpenHands from a GitHub comment", or "poll a GitHub repo for a trigger phrase". Guides the user through creating a cron automation that polls a single repository and starts an OpenHands conversation whenever a configurable trigger phrase is detected in an issue or PR comment.`,triggers:[`/github-monitor:poll`],content:`# GitHub Repository Monitor
 
 Create a cron automation that polls a single GitHub repository on a
 configurable schedule (default: every minute).
@@ -5540,9 +5559,12 @@ detected it:
 3. Posts a reply in the Slack thread with a link to the conversation.
 
 On every subsequent run:
-- Replies in the thread are forwarded to the running conversation.
+- New Slack thread replies are forwarded only when they contain the trigger
+  phrase, so unrelated conversation in the thread is ignored.
 - When the conversation finishes (or errors), the agent's final response is
   posted back to the Slack thread.
+- Completed conversations stay in a short follow-up watch window, allowing
+  triggered Slack replies to continue the same OpenHands conversation.
 
 > **Local mode only.** This automation targets the local OpenHands setup
 > (\`dev:automation\` stack). A cloud/webhook-based variant is out of scope here.
@@ -5752,20 +5774,26 @@ Each cron run executes \`main.py\`, which runs **10 polling iterations** (every
    - User token + \`search:read\` + > 1 channel → single \`search.messages\` call
      (searches for the trigger phrase across all channels).
    - Otherwise → one \`conversations.history\` call per channel.
-4. **Fetches thread replies**  -  one \`conversations.replies\` call per tracked thread.
+4. **Fetches due thread replies**  -  polls at most one tracked thread per
+   iteration using per-thread exponential backoff to stay within Slack rate
+   limits.
 5. **Processes messages** in chronological order:
    - Skips messages already in \`processed_ts\` (dedup across the overlap window).
    - Skips bot messages and any \`ts\` in \`bot_message_ts\`.
-   - Reply in a tracked thread (active **or** closed) → forwards to the existing
-     conversation; re-opens closed conversations automatically.
-   - Contains trigger phrase → 👀 reaction, create conversation, post link.
+   - Reply in a tracked thread whose text contains the trigger phrase → forwards
+     a follow-up request to the existing conversation and resets the follow-up
+     watch window. Replies without the trigger phrase are marked processed and
+     ignored.
+   - Contains trigger phrase outside a tracked conversation → 👀 reaction, create
+     a new conversation, post link.
      - Thread replies: agent receives full thread history for context.
      - Root messages: agent receives the trigger text only.
 6. **Checks conversation statuses**  -  for each active conversation where
    \`time.time() - last_activity > 15 s\`:
    - If status is \`idle\`, \`finished\`, \`error\`, or \`stuck\` → fetch the agent's
      final response via \`/api/conversations/{id}/agent_final_response\` and post
-     it to the Slack thread. Mark conversation \`closed\`.
+     it to the Slack thread. Mark the record \`watching\` for five minutes so
+     triggered follow-up replies can continue the same conversation.
 7. **Advances \`last_poll\`** to \`now - 10 s\` (overlap window prevents boundary
    races). If a conversation creation failed, pins \`last_poll\` further back to
    retry on the next iteration.