@openhands/extensions 0.16.0 → 0.17.0

package/automations/index.d.ts

@@ -63,6 +63,11 @@ export interface AutomationFormField {
   default?: string;
   required: boolean;
   provider?: AutomationGitProvider;
+  /**
+   * repo-picker only. The field collects several repositories rather than one,
+   * and its value is a list. A whole-value placeholder resolves to that list.
+   */
+  multiple?: true;
   options?: AutomationFieldOption[];
   constraints?: AutomationFieldConstraints;
 }
@@ -96,12 +101,40 @@ export interface AutomationForm {
   args: AutomationFormFields;
 }
 
+/** A config.json leaf: templated string, number, boolean, null, or a nesting of those. */
+export type AutomationBundleConfigValue =
+  | string
+  | number
+  | boolean
+  | null
+  | AutomationBundleConfigValue[]
+  | { [key: string]: AutomationBundleConfigValue };
+
+/**
+ * The script tarball a direct entry may ship instead of a prompt, for an
+ * automation that is deterministic machinery rather than judgement.
+ */
+export interface AutomationBundle {
+  /** The command run inside the extracted tarball. */
+  entrypoint: string;
+  /** Script run once before the entrypoint. Absent when nothing to install. */
+  setupScript?: string;
+  /** Seconds a run may take, when the service default is not enough. */
+  timeout?: number;
+  /** Packed path -> the repository path the file is read from at build time. */
+  files: Record<string, string>;
+  /** Rendered from the form and packed as config.json beside the entrypoint. */
+  config: Record<string, AutomationBundleConfigValue>;
+}
+
 export interface AutomationSetup {
   version: "1.0";
   mode: AutomationSetupMode;
   form: AutomationForm;
   /** direct only. What the automation is told to do. */
   prompt?: string;
+  /** direct only, and the alternative to `prompt`. Exactly one is present. */
+  bundle?: AutomationBundle;
   /** direct only, event trigger only. Which delivered events belong to it. */
   filter?: string;
   /**
@@ -337,6 +370,10 @@ export interface AutomationInterfaceEndpoints {
   validate: string;
   createPrompt: string;
   createPlugin: string;
+  /** The raw create endpoint, which a bundle entry is created through. */
+  createBundle: string;
+  /** Where a bundle's tarball is uploaded before that create call. */
+  uploads: string;
 }
 
 export interface AutomationInterfaceManifest {
@@ -365,4 +402,15 @@ export function listAutomationCatalog(): RecommendedAutomation[];
 export function getAutomationCatalogEntry(
   id: string,
 ): RecommendedAutomation | undefined;
+/**
+ * Return the files a bundle entry ships, keyed by the path each takes inside
+ * the tarball, as an independent copy. Undefined for an entry with no bundle.
+ *
+ * The contents are inlined at build time from the repository paths
+ * `setup.bundle.files` names, because a host packing the tarball has the
+ * published package but not the repository.
+ */
+export function getAutomationBundleFiles(
+  id: string,
+): Record<string, string> | undefined;
 export default AUTOMATION_CATALOG;

package/automations/index.js

@@ -5,6 +5,7 @@
  * directory. `catalog-index.js` is generated from that directory so the JS
  * package can statically import each JSON file without an aggregate JSON asset.
  */
+import { AUTOMATION_BUNDLE_FILES } from "./bundle-index.js";
 import { AUTOMATION_CATALOG_ENTRIES } from "./catalog-index.js";
 import interfaceManifest from "./interface.json" with { type: "json" };
 
@@ -21,6 +22,19 @@ export const getAutomationCatalogEntry = (id) => {
 
 export const AUTOMATION_CATALOG = clone(AUTOMATIONS);
 
+/**
+ * The files a bundle entry ships, keyed by entry id and then by the path each
+ * file takes inside the tarball. Generated from the repository paths the
+ * entry's `setup.bundle.files` names, because a host packing the tarball has
+ * the package but not the repository.
+ *
+ * Absent for every entry that does not ship a bundle.
+ */
+export const getAutomationBundleFiles = (id) => {
+  const files = AUTOMATION_BUNDLE_FILES[id];
+  return files ? clone(files) : undefined;
+};
+
 /**
  * The production Automation interface manifest: the domain-level facts of the
  * interface, hand-authored in `automations/interface.json`.

package/automations/interface.json

@@ -144,7 +144,9 @@
     "capabilities": "/v1/capabilities",
     "validate": "/v1/validate",
     "createPrompt": "/v1/preset/prompt",
-    "createPlugin": "/v1/preset/plugin"
+    "createPlugin": "/v1/preset/plugin",
+    "createBundle": "/v1",
+    "uploads": "/v1/uploads"
   },
   "featuredAutomationIds": [
     "github-pr-reviewer",

package/automations/interface.schema.json

@@ -178,7 +178,9 @@
         "capabilities",
         "validate",
         "createPrompt",
-        "createPlugin"
+        "createPlugin",
+        "createBundle",
+        "uploads"
       ],
       "properties": {
         "list": { "$ref": "#/$defs/plainEndpoint" },
@@ -190,7 +192,9 @@
         "capabilities": { "$ref": "#/$defs/plainEndpoint" },
         "validate": { "$ref": "#/$defs/plainEndpoint" },
         "createPrompt": { "$ref": "#/$defs/plainEndpoint" },
-        "createPlugin": { "$ref": "#/$defs/plainEndpoint" }
+        "createPlugin": { "$ref": "#/$defs/plainEndpoint" },
+        "createBundle": { "$ref": "#/$defs/plainEndpoint" },
+        "uploads": { "$ref": "#/$defs/plainEndpoint" }
       }
     },
     "featuredAutomationIds": {

package/index.d.ts

@@ -42,5 +42,5 @@ export type {
   AutomationInterfacePages,
   AutomationInterfaceRoutes,
 } from "./automations/index.js";
-export { SKILLS_CATALOG } from "./skills/index.js";
+export { SKILLS_CATALOG, DEFAULT_ENABLED_SKILL_NAMES } from "./skills/index.js";
 export type { SkillCatalogEntry } from "./skills/index.js";

package/index.js

@@ -1,3 +1,3 @@
 export { INTEGRATION_CATALOG } from "./integrations/index.js";
 export { AUTOMATION_CATALOG, AUTOMATION_INTERFACE } from "./automations/index.js";
-export { SKILLS_CATALOG } from "./skills/index.js";
+export { SKILLS_CATALOG, DEFAULT_ENABLED_SKILL_NAMES } from "./skills/index.js";

package/integrations/catalog/posthog.json

@@ -8,7 +8,7 @@
   ],
   "appUrl": "https://posthog.com",
   "docsUrl": "https://posthog.com/docs/model-context-protocol",
-  "notes": "Relevant for product analytics and experimentation workflows.",
+  "notes": "Uses PostHog's official hosted MCP server. OAuth is preferred; the bearer-token option remains for clients or deployments that require a personal API key. The OAuth URL defaults to read-only mode; remove readonly=true only when write access has been approved.",
   "popularityRank": 37,
   "iconBg": "#1D4AFF",
   "logoUrl": "https://cdn.simpleicons.org/posthog/FFFFFF",
@@ -18,8 +18,44 @@
     "product",
     "experiments"
   ],
-  "installHint": "Authenticate with a PostHog personal API key (PostHog → User settings → API keys, MCP Server preset) — sent as a Bearer token.",
+  "installHint": "Prefer OAuth. The default OAuth connection uses read-only MCP mode; edit the URL or use the bearer-key fallback only when a workflow needs approved write access. For API keys, create a PostHog personal API key with the MCP Server preset.",
   "connectionOptions": [
+    {
+      "id": "oauth",
+      "provider": "mcp",
+      "auth": {
+        "strategy": "oauth2",
+        "oauth": {
+          "authorizationUrl": "https://oauth.posthog.com/oauth/authorize/",
+          "tokenUrl": "https://oauth.posthog.com/oauth/token/",
+          "registrationUrl": "https://oauth.posthog.com/oauth/register/",
+          "scopes": [
+            "openid",
+            "profile",
+            "email",
+            "organization:read",
+            "project:read",
+            "dashboard:read",
+            "insight:read",
+            "query:read",
+            "event_definition:read"
+          ],
+          "pkce": true,
+          "clientAuthentication": "none",
+          "additionalAuthorizationParams": {
+            "resource": "https://mcp.posthog.com/mcp"
+          },
+          "additionalTokenParams": {
+            "resource": "https://mcp.posthog.com/mcp"
+          }
+        }
+      },
+      "transport": {
+        "kind": "shttp",
+        "url": "https://mcp.posthog.com/mcp?readonly=true",
+        "urlEditable": true
+      }
+    },
     {
       "id": "api-key",
       "provider": "mcp",
@@ -31,7 +67,9 @@
         "strategy": "bearer",
         "credentialLabel": "PostHog personal API key",
         "credentialPlaceholder": "Paste your PostHog personal API key",
-        "credentialHelp": "Create one under PostHog → User settings → API keys (MCP Server preset). Sent as Authorization: Bearer <token>."
+        "credentialHelp": "Create one under PostHog > User settings > API keys using the MCP Server preset. Sent as Authorization: Bearer <token>.",
+        "credentialSecretName": "POSTHOG_PERSONAL_API_KEY",
+        "saveCredentialAsSecretByDefault": true
       }
     }
   ]

package/integrations/catalog/sonarqube.json

@@ -0,0 +1,78 @@
+{
+  "id": "sonarqube",
+  "name": "SonarQube",
+  "description": "Inspect code quality and security findings, quality gates, and analyze code snippets from SonarQube Server or Cloud.",
+  "categories": [
+    "Engineering",
+    "Security"
+  ],
+  "appUrl": "https://www.sonarsource.com/products/sonarqube/mcp-server/",
+  "docsUrl": "https://github.com/SonarSource/sonarqube-mcp-server",
+  "notes": "Uses SonarSource's official SonarQube MCP Server, run locally as a Docker container. Provide a SonarQube user token. Set SONARQUBE_ORG for SonarQube Cloud, or SONARQUBE_URL for a self-managed SonarQube Server (or https://sonarqube.us for SonarQube Cloud US).",
+  "popularityRank": 43,
+  "installHint": "SONARQUBE_TOKEN is always required. For SonarQube Cloud, set your organization key in SONARQUBE_ORG. For a self-managed SonarQube Server, set SONARQUBE_URL to your server URL; for SonarQube Cloud US, set SONARQUBE_URL to https://sonarqube.us. Requires a container runtime such as Docker.",
+  "connectionOptions": [
+    {
+      "id": "api",
+      "provider": "mcp",
+      "transport": {
+        "kind": "stdio",
+        "serverName": "sonarqube",
+        "command": "docker",
+        "args": [
+          "run",
+          "--init",
+          "--pull=always",
+          "-i",
+          "--rm",
+          "-e",
+          "SONARQUBE_TOKEN",
+          "-e",
+          "SONARQUBE_ORG",
+          "-e",
+          "SONARQUBE_URL",
+          "sonarsource/sonarqube-mcp"
+        ],
+        "envFields": [
+          {
+            "key": "SONARQUBE_TOKEN",
+            "label": "SonarQube token",
+            "type": "password",
+            "required": true,
+            "helperText": "User token generated in your SonarQube Server or Cloud account settings.",
+            "helperLink": "https://docs.sonarsource.com/sonarqube-cloud/managing-your-account/managing-tokens/"
+          },
+          {
+            "key": "SONARQUBE_ORG",
+            "label": "Organization key (SonarQube Cloud)",
+            "type": "text",
+            "required": false,
+            "placeholder": "my-org",
+            "helperText": "Required for SonarQube Cloud. Your organization key, found in SonarQube Cloud."
+          },
+          {
+            "key": "SONARQUBE_URL",
+            "label": "Server URL (SonarQube Server)",
+            "type": "text",
+            "required": false,
+            "placeholder": "https://sonarqube.example.com",
+            "helperText": "Required for a self-managed SonarQube Server. For SonarQube Cloud US, use https://sonarqube.us."
+          }
+        ]
+      },
+      "auth": {
+        "strategy": "api_key"
+      }
+    }
+  ],
+  "iconBg": "#126ED3",
+  "logoUrl": "https://cdn.simpleicons.org/sonarqubeserver/FFFFFF",
+  "keywords": [
+    "code quality",
+    "static analysis",
+    "security",
+    "sast",
+    "quality gate",
+    "sonarcloud"
+  ]
+}

package/integrations/catalog-index.js

@@ -14,69 +14,70 @@ import entry8 from "./catalog/elevenlabs.json" with { type: "json" };
 import entry9 from "./catalog/bitbucket.json" with { type: "json" };
 import entry10 from "./catalog/xero.json" with { type: "json" };
 import entry11 from "./catalog/quickbooks.json" with { type: "json" };
-import entry12 from "./catalog/okta.json" with { type: "json" };
-import entry13 from "./catalog/netlify.json" with { type: "json" };
-import entry14 from "./catalog/vercel.json" with { type: "json" };
-import entry15 from "./catalog/supabase.json" with { type: "json" };
-import entry16 from "./catalog/posthog.json" with { type: "json" };
-import entry17 from "./catalog/sentry.json" with { type: "json" };
-import entry18 from "./catalog/datadog.json" with { type: "json" };
-import entry19 from "./catalog/canva.json" with { type: "json" };
-import entry20 from "./catalog/miro.json" with { type: "json" };
-import entry21 from "./catalog/webflow.json" with { type: "json" };
-import entry22 from "./catalog/zoom.json" with { type: "json" };
-import entry23 from "./catalog/discord.json" with { type: "json" };
-import entry24 from "./catalog/stripe.json" with { type: "json" };
-import entry25 from "./catalog/intercom.json" with { type: "json" };
-import entry26 from "./catalog/hubspot.json" with { type: "json" };
-import entry27 from "./catalog/salesforce.json" with { type: "json" };
-import entry28 from "./catalog/sharepoint.json" with { type: "json" };
-import entry29 from "./catalog/onedrive.json" with { type: "json" };
-import entry30 from "./catalog/microsoft-teams.json" with { type: "json" };
-import entry31 from "./catalog/microsoft-outlook.json" with { type: "json" };
-import entry32 from "./catalog/box.json" with { type: "json" };
-import entry33 from "./catalog/airtable.json" with { type: "json" };
-import entry34 from "./catalog/monday.json" with { type: "json" };
-import entry35 from "./catalog/trello.json" with { type: "json" };
-import entry36 from "./catalog/asana.json" with { type: "json" };
-import entry37 from "./catalog/confluence.json" with { type: "json" };
-import entry38 from "./catalog/jira.json" with { type: "json" };
-import entry39 from "./catalog/google-calendar.json" with { type: "json" };
-import entry40 from "./catalog/gmail.json" with { type: "json" };
-import entry41 from "./catalog/google-sheets.json" with { type: "json" };
-import entry42 from "./catalog/google-drive.json" with { type: "json" };
-import entry43 from "./catalog/figma.json" with { type: "json" };
-import entry44 from "./catalog/google-docs.json" with { type: "json" };
-import entry45 from "./catalog/apify.json" with { type: "json" };
-import entry46 from "./catalog/atlassian-rovo.json" with { type: "json" };
-import entry47 from "./catalog/brave-search.json" with { type: "json" };
-import entry48 from "./catalog/browser-mcp.json" with { type: "json" };
-import entry49 from "./catalog/clickhouse.json" with { type: "json" };
-import entry50 from "./catalog/cloudflare-bindings.json" with { type: "json" };
-import entry51 from "./catalog/cloudflare-browser-rendering.json" with { type: "json" };
-import entry52 from "./catalog/cloudflare-builds.json" with { type: "json" };
-import entry53 from "./catalog/cloudflare-docs.json" with { type: "json" };
-import entry54 from "./catalog/cloudflare-observability.json" with { type: "json" };
-import entry55 from "./catalog/deepwiki.json" with { type: "json" };
-import entry56 from "./catalog/everything.json" with { type: "json" };
-import entry57 from "./catalog/exa.json" with { type: "json" };
-import entry58 from "./catalog/fetch.json" with { type: "json" };
-import entry59 from "./catalog/filesystem.json" with { type: "json" };
-import entry60 from "./catalog/firecrawl.json" with { type: "json" };
-import entry61 from "./catalog/git.json" with { type: "json" };
-import entry62 from "./catalog/huggingface.json" with { type: "json" };
-import entry63 from "./catalog/kagi.json" with { type: "json" };
-import entry64 from "./catalog/memory.json" with { type: "json" };
-import entry65 from "./catalog/mongodb.json" with { type: "json" };
-import entry66 from "./catalog/neon.json" with { type: "json" };
-import entry67 from "./catalog/obsidian.json" with { type: "json" };
-import entry68 from "./catalog/paypal.json" with { type: "json" };
-import entry69 from "./catalog/playwright.json" with { type: "json" };
-import entry70 from "./catalog/redis.json" with { type: "json" };
-import entry71 from "./catalog/resend.json" with { type: "json" };
-import entry72 from "./catalog/sequential-thinking.json" with { type: "json" };
-import entry73 from "./catalog/superhuman-mail.json" with { type: "json" };
-import entry74 from "./catalog/time.json" with { type: "json" };
+import entry12 from "./catalog/sonarqube.json" with { type: "json" };
+import entry13 from "./catalog/okta.json" with { type: "json" };
+import entry14 from "./catalog/netlify.json" with { type: "json" };
+import entry15 from "./catalog/vercel.json" with { type: "json" };
+import entry16 from "./catalog/supabase.json" with { type: "json" };
+import entry17 from "./catalog/posthog.json" with { type: "json" };
+import entry18 from "./catalog/sentry.json" with { type: "json" };
+import entry19 from "./catalog/datadog.json" with { type: "json" };
+import entry20 from "./catalog/canva.json" with { type: "json" };
+import entry21 from "./catalog/miro.json" with { type: "json" };
+import entry22 from "./catalog/webflow.json" with { type: "json" };
+import entry23 from "./catalog/zoom.json" with { type: "json" };
+import entry24 from "./catalog/discord.json" with { type: "json" };
+import entry25 from "./catalog/stripe.json" with { type: "json" };
+import entry26 from "./catalog/intercom.json" with { type: "json" };
+import entry27 from "./catalog/hubspot.json" with { type: "json" };
+import entry28 from "./catalog/salesforce.json" with { type: "json" };
+import entry29 from "./catalog/sharepoint.json" with { type: "json" };
+import entry30 from "./catalog/onedrive.json" with { type: "json" };
+import entry31 from "./catalog/microsoft-teams.json" with { type: "json" };
+import entry32 from "./catalog/microsoft-outlook.json" with { type: "json" };
+import entry33 from "./catalog/box.json" with { type: "json" };
+import entry34 from "./catalog/airtable.json" with { type: "json" };
+import entry35 from "./catalog/monday.json" with { type: "json" };
+import entry36 from "./catalog/trello.json" with { type: "json" };
+import entry37 from "./catalog/asana.json" with { type: "json" };
+import entry38 from "./catalog/confluence.json" with { type: "json" };
+import entry39 from "./catalog/jira.json" with { type: "json" };
+import entry40 from "./catalog/google-calendar.json" with { type: "json" };
+import entry41 from "./catalog/gmail.json" with { type: "json" };
+import entry42 from "./catalog/google-sheets.json" with { type: "json" };
+import entry43 from "./catalog/google-drive.json" with { type: "json" };
+import entry44 from "./catalog/figma.json" with { type: "json" };
+import entry45 from "./catalog/google-docs.json" with { type: "json" };
+import entry46 from "./catalog/apify.json" with { type: "json" };
+import entry47 from "./catalog/atlassian-rovo.json" with { type: "json" };
+import entry48 from "./catalog/brave-search.json" with { type: "json" };
+import entry49 from "./catalog/browser-mcp.json" with { type: "json" };
+import entry50 from "./catalog/clickhouse.json" with { type: "json" };
+import entry51 from "./catalog/cloudflare-bindings.json" with { type: "json" };
+import entry52 from "./catalog/cloudflare-browser-rendering.json" with { type: "json" };
+import entry53 from "./catalog/cloudflare-builds.json" with { type: "json" };
+import entry54 from "./catalog/cloudflare-docs.json" with { type: "json" };
+import entry55 from "./catalog/cloudflare-observability.json" with { type: "json" };
+import entry56 from "./catalog/deepwiki.json" with { type: "json" };
+import entry57 from "./catalog/everything.json" with { type: "json" };
+import entry58 from "./catalog/exa.json" with { type: "json" };
+import entry59 from "./catalog/fetch.json" with { type: "json" };
+import entry60 from "./catalog/filesystem.json" with { type: "json" };
+import entry61 from "./catalog/firecrawl.json" with { type: "json" };
+import entry62 from "./catalog/git.json" with { type: "json" };
+import entry63 from "./catalog/huggingface.json" with { type: "json" };
+import entry64 from "./catalog/kagi.json" with { type: "json" };
+import entry65 from "./catalog/memory.json" with { type: "json" };
+import entry66 from "./catalog/mongodb.json" with { type: "json" };
+import entry67 from "./catalog/neon.json" with { type: "json" };
+import entry68 from "./catalog/obsidian.json" with { type: "json" };
+import entry69 from "./catalog/paypal.json" with { type: "json" };
+import entry70 from "./catalog/playwright.json" with { type: "json" };
+import entry71 from "./catalog/redis.json" with { type: "json" };
+import entry72 from "./catalog/resend.json" with { type: "json" };
+import entry73 from "./catalog/sequential-thinking.json" with { type: "json" };
+import entry74 from "./catalog/superhuman-mail.json" with { type: "json" };
+import entry75 from "./catalog/time.json" with { type: "json" };
 
 export const INTEGRATION_CATALOG_ENTRIES = [
   entry0,
@@ -154,4 +155,5 @@ export const INTEGRATION_CATALOG_ENTRIES = [
   entry72,
   entry73,
   entry74,
+  entry75,
 ];

package/marketplaces/openhands-extensions.json

@@ -29,6 +29,7 @@
       "source": "./skills/add-skill",
       "description": "Add (import) an OpenHands skill from a GitHub repository into the current workspace.",
       "category": "agent-authoring",
+      "defaultEnabled": true,
       "keywords": [
         "skill",
         "import",
@@ -41,6 +42,7 @@
       "source": "./skills/agent-memory",
       "description": "Persist and retrieve repository-specific knowledge using AGENTS.md files. Use when you want to save important information about a codebase (build commands, code style, workflows) for future sessions.",
       "category": "agent-authoring",
+      "defaultEnabled": true,
       "keywords": [
         "memory",
         "knowledge",
@@ -53,6 +55,7 @@
       "source": "./skills/agent-sdk-builder",
       "description": "Guided workflow for building custom AI agents using the OpenHands Software Agent SDK. Use when you want to create a new agent through an interactive interview process that gathers requirements and generates implementation plans.",
       "category": "agent-authoring",
+      "defaultEnabled": true,
       "keywords": [
         "agent",
         "sdk",
@@ -80,6 +83,7 @@
       "source": "./skills/openhands-automation",
       "description": "Create and manage OpenHands automations - scheduled tasks that run in sandboxes. Use the prompt preset to create automations from natural language, or manage existing automations.",
       "category": "automations",
+      "defaultEnabled": true,
       "keywords": [
         "automation",
         "cron",
@@ -93,6 +97,7 @@
       "source": "./skills/agent-canvas-environment",
       "description": "Work effectively inside a local Agent Canvas environment, including local agent-server auth, safe workspace hygiene, and local conversation delegation.",
       "category": "agent-authoring",
+      "defaultEnabled": true,
       "keywords": [
         "agent-canvas",
         "openhands",
@@ -106,6 +111,7 @@
       "source": "./skills/openhands-sdk",
       "description": "Reference skill for the OpenHands Software Agent SDK - build AI agents with custom tools, LLM configuration, conversations, sub-agent delegation, MCP integration, security, and persistence.",
       "category": "agent-authoring",
+      "defaultEnabled": true,
       "keywords": [
         "sdk",
         "agent",
@@ -182,6 +188,7 @@
       "source": "./skills/code-review",
       "description": "Rigorous code review focusing on data structures, simplicity, security, pragmatism, and risk/safety evaluation. Provides brutally honest, actionable feedback on pull requests or merge requests, including a risk assessment for every review. Use when reviewing code changes.",
       "category": "code-quality",
+      "defaultEnabled": true,
       "keywords": [
         "code-review",
         "quality",
@@ -232,6 +239,7 @@
       "source": "./skills/docker",
       "description": "Run Docker commands within a container environment, including starting the Docker daemon and managing containers. Use when building, running, or managing Docker containers and images.",
       "category": "environment",
+      "defaultEnabled": true,
       "keywords": [
         "docker",
         "container",
@@ -268,6 +276,7 @@
       "source": "./skills/github",
       "description": "Interact with GitHub repositories, pull requests, issues, and workflows using the GITHUB_TOKEN environment variable and GitHub CLI. Use when working with code hosted on GitHub or managing GitHub resources.",
       "category": "code-hosting",
+      "defaultEnabled": true,
       "keywords": [
         "github",
         "git",
@@ -444,6 +453,7 @@
       "source": "./skills/openhands-api",
       "description": "Use the OpenHands Cloud REST API (V1) and agent-server APIs to create and manage Cloud or local backend conversations, including multi-conversation delegation workflows. Includes minimal Python and TypeScript clients under scripts/.",
       "category": "agent-authoring",
+      "defaultEnabled": true,
       "keywords": [
         "openhands",
         "api",
@@ -534,6 +544,7 @@
       "source": "./skills/skill-creator",
       "description": "Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations.",
       "category": "agent-authoring",
+      "defaultEnabled": true,
       "keywords": [
         "skill",
         "plugin",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openhands/extensions",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Public OpenHands extension catalogs for skills, plugins, integrations, and automation templates.",
   "license": "MIT",
   "type": "module",

package/plugins/qa-changes/action.yml

@@ -160,7 +160,7 @@ runs:
         # so we enforce the time limit via the coreutils timeout command.
         TIMEOUT_SECONDS=$((TIMEOUT_MINUTES * 60))
         timeout "${TIMEOUT_SECONDS}" \
-          uv run --no-project --with openhands-sdk --with openhands-tools --with 'lmnr<0.7.53' \
+          uv run --no-project --with openhands-sdk --with openhands-tools --with lmnr \
             python ../extensions/plugins/qa-changes/scripts/agent_script.py
 
     - name: Upload logs as artifact

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "openhands-extensions"
-version = "0.16.0"
+version = "0.17.0"
 description = "OpenHands extensions, plugins, and skills (Python bindings for the integration catalog)"
 requires-python = ">=3.12"
 dependencies = [

package/python/openhands_extensions/_version.py

@@ -18,7 +18,7 @@ from importlib.metadata import PackageNotFoundError, version
 #: Kept in lock-step with pyproject.toml/package.json by the version test.
 #: release-please only rewrites a semver found on the annotated line itself, so
 #: the annotation must stay on the assignment; on its own line it is a no-op.
-_FALLBACK_VERSION = "0.16.0"  # x-release-please-version
+_FALLBACK_VERSION = "0.17.0"  # x-release-please-version
 
 try:
     __version__: str = version("openhands-extensions")

package/scripts/build-automation-catalog.mjs

@@ -4,6 +4,7 @@ import path from "node:path";
 const root = process.cwd();
 const catalogDir = path.join(root, "automations", "catalog");
 const outputPath = path.join(root, "automations", "catalog-index.js");
+const bundleOutputPath = path.join(root, "automations", "bundle-index.js");
 
 const directories = (await readdir(catalogDir, { withFileTypes: true }))
   .filter((entry) => entry.isDirectory())
@@ -37,6 +38,25 @@ const imports = indexedAutomations
   .join("\n");
 const entries = indexedAutomations.map(({ importName }) => `  ${importName},`).join("\n");
 
+// A bundle entry names its files by repository-relative path, so the one copy
+// of a script shipped by both a skill and the catalog stays in one place. The
+// package cannot ship a path, though - a browser host has no repository - so
+// the contents are inlined here at build time.
+const bundles = {};
+for (const { entry } of automations) {
+  const files = entry.setup?.bundle?.files;
+  if (!files) continue;
+  bundles[entry.id] = {};
+  for (const [packedPath, source] of Object.entries(files).sort()) {
+    if (!/^(skills|automations)\//.test(source) || source.includes("..")) {
+      throw new Error(
+        `${entry.id}: bundle file "${packedPath}" names ${source}, which is outside skills/ or automations/`,
+      );
+    }
+    bundles[entry.id][packedPath] = await readFile(path.join(root, source), "utf8");
+  }
+}
+
 const header = `// This file is auto-generated by scripts/build-automation-catalog.mjs.
 // Do not edit it manually. To update it after changing automations/catalog/*/manifest.json,
 // run: npm run build:automations
@@ -49,3 +69,13 @@ ${entries}
 ];
 `;
 await writeFile(outputPath, body);
+
+const bundleHeader = `// This file is auto-generated by scripts/build-automation-catalog.mjs.
+// Do not edit it manually. It inlines the files each bundle entry ships, read from
+// the repository paths its manifest names. To update it, run: npm run build:automations
+
+`;
+await writeFile(
+  bundleOutputPath,
+  `${bundleHeader}export const AUTOMATION_BUNDLE_FILES = ${JSON.stringify(bundles, null, 2)};\n`,
+);