@openhands/extensions 0.22.1 → 0.24.0

package/.agents/skills/custom-codereview-guide.md

@@ -1,32 +1,101 @@
 ---
 name: custom-codereview-guide
-description: Repository-specific code review guidelines for OpenHands/extensions
+description: Repository-specific review guidance for OpenHands/extensions.
 triggers:
 - /codereview
 ---
 
-# Extensions Repo — Code Review Guidelines
+# OpenHands/extensions review guide
 
-## Repository Boundaries
+Apply this guide with the general code-review skill and `AGENTS.md`. Approve the
+current head when it has no material correctness, security, compatibility, or
+acceptance-criterion defect. Comment only on concrete failures; do not withhold
+approval for optional refactors, tone, style, or speculative improvements.
 
-Review whether a PR belongs in this public extensions registry. Skills, plugins, automations, and integrations belong here; Agent Server behavior and API endpoints belong in [`OpenHands/software-agent-sdk`](https://github.com/OpenHands/software-agent-sdk), typed browser API access belongs in [`OpenHands/typescript-client`](https://github.com/OpenHands/typescript-client), UI belongs in [`OpenHands/OpenHands`](https://github.com/OpenHands/OpenHands), and scheduling/dispatch lifecycle behavior belongs in [`OpenHands/automation`](https://github.com/OpenHands/automation).
+## Repository scope
 
-If a PR is opened in the wrong repository, explicitly recommend that it may need to be closed and moved to the repository that owns the change rather than merged here. Apply the repository's contribution and review guidance to every PR.
+This repository owns reusable extensions: skills, plugins, and automation
+bundles that use existing public host and runtime interfaces. Out of scope here,
+because another repository owns the contract or machinery:
 
+- SDK, agent-server, and client contracts — `OpenHands/software-agent-sdk`;
+- generic automation scheduling, state, dispatch, and profile machinery —
+  `OpenHands/automation`;
+- Canvas product and UI integration — `OpenHands/OpenHands`.
 
-## SDK Documentation Placement
+Cross-repository work is acceptable when this PR contains only the
+extensions-owned portion and relies on public interfaces from the owning
+repository.
 
-If a PR adds or modifies OpenHands SDK-specific documentation (API guides, SDK usage examples, SDK feature descriptions), flag it:
+## Blocking checkpoints
 
-- The canonical source of truth for SDK documentation is <https://docs.openhands.dev/sdk> and its `llms.txt` index.
-- The `skills/openhands-sdk/SKILL.md` in this repo is a thin pointer to the docs site. It should NOT contain duplicated SDK content.
-- **Push back**: ask the submitter to contribute SDK documentation changes to [OpenHands/docs](https://github.com/OpenHands/docs) instead.
+### Executable instructions and runtime parity
 
-## Pre-release Integration Catalog Changes
+Commands, imports, environment variables, endpoints, and setup steps in extension
+content are executable contracts. Verify them against the released packages and
+the actual local and cloud environments that claim support. Do not approve an
+example that relies on an unreleased API, a developer-only dependency, a private
+path, or a variable that the production runtime does not provide.
 
-The `@openhands/extensions/mcps` catalog was experimental and pre-release. If a
-PR intentionally replaces it with the broader `integrations` catalog and updates
-known downstream consumers in the same coordinated stack, do not require
-backward-compatible `mcps` aliases or a deprecation window. Require migration
-documentation for consumers, but accept a clean breaking change for this
-pre-release surface.
+For a changed skill, plugin, hook, or automation, follow its documented entrypoint
+in a clean environment far enough to exercise the changed behavior. Keep local
+and cloud behavior identical unless the documentation names and explains a real
+platform capability difference.
+
+### Untrusted triggers and credentials
+
+Treat repository events, issue and PR comments, chat messages, catalog fields,
+and extension-provided arguments as untrusted. Verify who may trigger the action,
+whose identity it runs as, which repository or organization it can affect, and
+which secrets it receives. A trigger phrase alone is not authorization. Require
+an explicit allowlist, permission check, or repository policy before performing
+mutating or credentialed work.
+
+Use only the minimum documented credential set. Never place secret values in
+prompts, logs, generated files, examples, or persisted state.
+
+### Sources of truth and generated artifacts
+
+Identify the hand-authored source before reviewing a catalog or generated file.
+A change should update that source once and regenerate every derived artifact
+with the repository's existing sync/build command. Documentation must describe
+the real direction of generation; do not call a generated asset the source of
+truth or claim two runtimes read one asset when they do not.
+
+Check the marketplace entry and generated command/catalog coverage required by
+`AGENTS.md`. Do not add a parallel catalog, provider-specific copy, or manual
+compatibility layer when the repository already has a generator or schema.
+
+### Documentation claims
+
+Test copy-paste commands and verify named tools, flags, package exports, URLs, and
+installation mechanisms from authoritative sources. A plausible command is not
+evidence. Documentation that teaches the wrong data flow or setup is a material
+finding because agents execute it directly.
+
+SDK documentation belongs in `docs.openhands.dev/sdk`; the generated
+`skills/openhands-sdk/SKILL.md` remains a thin synchronized entrypoint. The
+former `@openhands/extensions/mcps` catalog was experimental and pre-release, so
+an explicitly coordinated replacement with the `integrations` catalog needs
+consumer migration documentation but not compatibility aliases or a deprecation
+window.
+
+### Dependencies and supply chain
+
+Apply the general seven-day release-recency guard to the exact dependency version,
+regardless of the package's age or popularity. Validate installation with the
+package manager and runtime used by the extension. Temporary git pins and
+unreleased package APIs are blockers for merge unless the PR is an explicit,
+coordinated stack that will replace them before release.
+
+## Evidence and comment discipline
+
+Evidence should exercise the extension as users invoke it: run the command, hook,
+plugin, or automation entrypoint and show the relevant result. Static text checks
+alone do not validate executable instructions. Require only the environments and
+paths the change affects.
+
+Do not comment on punctuation, preferred prose tone, optional DRY cleanup, or
+hypothetical non-standard configurations without a supported failure mode. Before
+raising a finding, verify that the referenced file and behavior are present in
+the current PR head and have not already been addressed in review history.

package/.claude-plugin/marketplace.json

@@ -106,6 +106,20 @@
         "delegation"
       ]
     },
+    {
+      "name": "canvas-extension-api",
+      "source": "./skills/canvas-extension-api",
+      "description": "Build and validate Apps for Agent Canvas using the supported Canvas Extensions API v1 routed-page contract.",
+      "category": "agent-authoring",
+      "defaultEnabled": true,
+      "keywords": [
+        "agent-canvas",
+        "canvas-app",
+        "canvas-extension",
+        "register-page",
+        "app-development"
+      ]
+    },
     {
       "name": "openhands-sdk",
       "source": "./skills/openhands-sdk",

package/.codex-plugin/marketplace.json

@@ -106,6 +106,20 @@
         "delegation"
       ]
     },
+    {
+      "name": "canvas-extension-api",
+      "source": "./skills/canvas-extension-api",
+      "description": "Build and validate Apps for Agent Canvas using the supported Canvas Extensions API v1 routed-page contract.",
+      "category": "agent-authoring",
+      "defaultEnabled": true,
+      "keywords": [
+        "agent-canvas",
+        "canvas-app",
+        "canvas-extension",
+        "register-page",
+        "app-development"
+      ]
+    },
     {
       "name": "openhands-sdk",
       "source": "./skills/openhands-sdk",

package/.github/workflows/check-extensions.yml

@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
 
@@ -44,10 +44,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
@@ -63,10 +63,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 

package/.github/workflows/deprecation-check.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7

package/.github/workflows/issue-readiness-check.yml

@@ -1,131 +1,62 @@
 ---
-name: Issue Readiness Check
+name: Ready-for-dev Label Policy
 
-# Manages the `ready-for-dev` label based on type-specific readiness criteria
-# tailored to extension contributions (skills, plugins, integrations,
-# automations).
-#
-# Bug reports (label `bug`): the Actual Behavior section must reference a
-# reproducible command (`uv run pytest`, `pytest`, `python`, `pip`, `npm run`,
-# or `node`), plus an Acceptance Criteria section with at least one checklist
-# item.
-#
-# Enhancements (label `enhancement`): the body must contain Desired Behavior and
-# Acceptance Criteria sections, the latter with at least one checklist item.
-#
-# When criteria are met the label is added (idempotently); when they are not the
-# label is removed. A feedback comment is posted (or updated) in three cases:
-#   1. The issue is first opened or reopened - always comment so the author
-#      knows whether their issue is ready or what is missing.
-#   2. The label is being added (issue became ready) - comment celebrating it.
-#   3. The label is being removed (issue was ready but is no longer) - comment
-#      explaining what changed.
-# Edits that do not change the label state do not produce a new comment. All
-# comments are upserted by a hidden marker so there is at most one per issue.
-#
-# The readiness step uses `--json`, which always exits 0, so a not-ready result
-# never aborts the workflow under `set -euo pipefail`; label and comment steps
-# run for both outcomes.
+# The issue-triage automation and repository writers may grant ready-for-dev.
+# Labels from any other actor are removed.
 
 on:
     issues:
-        types: [opened, edited, reopened, labeled, unlabeled]
-
-permissions:
-    issues: write
-    pull-requests: read
-    contents: read
+        types: [labeled, unlabeled]
 
 concurrency:
-    group: issue-readiness-${{ github.event.issue.number }}
+    group: ready-for-dev-policy-${{ github.event.issue.number }}
     cancel-in-progress: false
 
 jobs:
-    check:
-        if: github.event.issue.state == 'open' && github.event.issue.pull_request == null
+    enforce-label-policy:
+        name: Enforce ready-for-dev label policy
+        if: >-
+            github.event.issue.state == 'open'
+            && github.event.issue.pull_request == null
+            && github.event.label.name == 'ready-for-dev'
         runs-on: ubuntu-latest
         timeout-minutes: 5
+        permissions:
+            issues: write
+        outputs:
+            refresh-linked-prs: ${{ steps.policy.outputs.refresh-linked-prs }}
         steps:
-            - name: Checkout trusted workflow scripts
-              uses: actions/checkout@v4
-
-            - name: Evaluate issue readiness
-              id: readiness
-              env:
-                  GITHUB_EVENT_PATH: ${{ github.event_path }}
-              run: |
-                  set -euo pipefail
-                  python .github/scripts/check_issue_readiness.py --json > /tmp/result.json
-                  echo "ready=$(jq -r '.ready' /tmp/result.json)" >> "$GITHUB_OUTPUT"
-                  # Write reasons to a file so the comment step can read them
-                  # without shell-escaping multiline text.
-                  jq -r '.reasons[]?' /tmp/result.json > /tmp/reasons.txt || true
-                  echo "reasons_file=/tmp/reasons.txt" >> "$GITHUB_OUTPUT"
-
-            - name: Add ready-for-dev label
-              if: steps.readiness.outputs.ready == 'true'
+            - name: Check label actor
+              id: policy
               env:
                   GH_TOKEN: ${{ github.token }}
+                  ACTION: ${{ github.event.action }}
+                  ACTOR: ${{ github.event.sender.login }}
+                  REPOSITORY: ${{ github.repository }}
+                  ISSUE_NUMBER: ${{ github.event.issue.number }}
               run: |
                   set -euo pipefail
-                  # Capture stderr — tolerate "label already present" (exit 0
-                  # from gh) but surface unexpected errors to the step summary.
-                  if ! gh issue edit "${{ github.event.issue.number }}" \
-                      --repo "${{ github.repository }}" \
-                      --add-label "ready-for-dev" 2>/tmp/gh-err.txt; then
-                    echo "::warning::Failed to add ready-for-dev label:" >> "$GITHUB_STEP_SUMMARY"
-                    cat /tmp/gh-err.txt >> "$GITHUB_STEP_SUMMARY"
-                  fi
 
-            - name: Remove ready-for-dev label
-              if: steps.readiness.outputs.ready != 'true' && contains(github.event.issue.labels.*.name, 'ready-for-dev')
-              env:
-                  GH_TOKEN: ${{ github.token }}
-              run: |
-                  set -euo pipefail
-                  # Capture stderr — tolerate "label already removed" but
-                  # surface unexpected errors.
-                  if ! gh issue edit "${{ github.event.issue.number }}" \
-                      --repo "${{ github.repository }}" \
-                      --remove-label "ready-for-dev" 2>/tmp/gh-err.txt; then
-                    echo "::warning::Failed to remove ready-for-dev label:" >> "$GITHUB_STEP_SUMMARY"
-                    cat /tmp/gh-err.txt >> "$GITHUB_STEP_SUMMARY"
+                  if [ "$ACTION" = "unlabeled" ]; then
+                    echo "refresh-linked-prs=true" >> "$GITHUB_OUTPUT"
+                    exit 0
                   fi
 
-            - name: Post feedback comment
-              if: >-
-                  github.event.action == 'opened'
-                  || github.event.action == 'reopened'
-                  || (steps.readiness.outputs.ready == 'true' && !contains(github.event.issue.labels.*.name, 'ready-for-dev'))
-                  || (steps.readiness.outputs.ready != 'true' && contains(github.event.issue.labels.*.name, 'ready-for-dev'))
-              env:
-                  GH_TOKEN: ${{ github.token }}
-              run: |
-                  set -euo pipefail
-                  if [ "${{ steps.readiness.outputs.ready }}" = "true" ]; then
-                    node .github/scripts/post-readiness-comment.mjs \
-                        --issue-number "${{ github.event.issue.number }}" \
-                        --repo "${{ github.repository }}" \
-                        --ready
-                  else
-                    node .github/scripts/post-readiness-comment.mjs \
-                        --issue-number "${{ github.event.issue.number }}" \
-                        --repo "${{ github.repository }}" \
-                        --reasons-file "${{ steps.readiness.outputs.reasons_file }}"
-                  fi
+                  permission="$(gh api "repos/$REPOSITORY/collaborators/$ACTOR/permission" --jq .permission 2>/dev/null || true)"
+                  case "$permission" in
+                    write|maintain|admin)
+                      echo "refresh-linked-prs=true" >> "$GITHUB_OUTPUT"
+                      ;;
+                    *)
+                      gh issue edit "$ISSUE_NUMBER" --repo "$REPOSITORY" --remove-label ready-for-dev
+                      echo "refresh-linked-prs=false" >> "$GITHUB_OUTPUT"
+                      ;;
+                  esac
 
-    # When the ready-for-dev label is added or removed, re-run the PR
-    # description check for every open PR that links this issue, so the
-    # `ready-for-dev` gate does not go stale between PR events. Runs after
-    # `check` so the label reflects the settled readiness state.
     refresh-linked-pr-gates:
         name: Refresh PR gates for linked issues
-        needs: check
-        if: >-
-            github.event.issue.state == 'open'
-            && github.event.issue.pull_request == null
-            && (github.event.action == 'labeled' || github.event.action == 'unlabeled')
-            && github.event.label.name == 'ready-for-dev'
+        needs: enforce-label-policy
+        if: needs.enforce-label-policy.outputs.refresh-linked-prs == 'true'
         runs-on: ubuntu-latest
         timeout-minutes: 10
         permissions:
@@ -134,7 +65,7 @@ jobs:
             actions: write
         steps:
             - name: Checkout trusted workflow scripts
-              uses: actions/checkout@v4
+              uses: actions/checkout@v7
 
             - name: Re-run PR description checks for linked open PRs
               env:

package/.github/workflows/npm-publish.yml

@@ -31,14 +31,14 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       # Trusted publishing requires Node 22.14.0+ and npm 11.5.1+
       # See: https://docs.npmjs.com/trusted-publishers/
       - name: Set up Node.js for npm trusted publishing
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
           registry-url: https://registry.npmjs.org

package/.github/workflows/pr-description-check.yml

@@ -29,7 +29,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout trusted workflow scripts
-              uses: actions/checkout@v4
+              uses: actions/checkout@v7
               with:
                   ref: ${{ github.event.pull_request.base.sha }}
 

package/.github/workflows/pypi-publish.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Extract version
         id: extract_version
@@ -72,7 +72,7 @@ jobs:
         run: uv build
 
       - name: Upload distributions
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: python-package-distributions
           path: dist/
@@ -95,7 +95,7 @@ jobs:
 
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           name: python-package-distributions
           path: dist/

package/.github/workflows/tests.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7
@@ -21,7 +21,7 @@ jobs:
           python-version: "3.12"
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
 

package/.plugin/marketplace.json

@@ -106,6 +106,20 @@
         "delegation"
       ]
     },
+    {
+      "name": "canvas-extension-api",
+      "source": "./skills/canvas-extension-api",
+      "description": "Build and validate Apps for Agent Canvas using the supported Canvas Extensions API v1 routed-page contract.",
+      "category": "agent-authoring",
+      "defaultEnabled": true,
+      "keywords": [
+        "agent-canvas",
+        "canvas-app",
+        "canvas-extension",
+        "register-page",
+        "app-development"
+      ]
+    },
     {
       "name": "openhands-sdk",
       "source": "./skills/openhands-sdk",

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.22.1"
+  ".": "0.24.0"
 }

package/AGENTS.md

@@ -16,6 +16,27 @@ Related repositories have distinct responsibilities:
 
 Put reusable skills, plugins, automations, and integrations here; put backend execution behavior and typed API access in the SDK, application UI in Agent Canvas, and scheduling/dispatch lifecycle code in `automation`. If a PR is opened in the wrong repository, explicitly recommend closing and moving it to the owning repository. PRs must follow this repository's applicable contribution and code-review guidance.
 
+## Review-Facing Extension Checklist
+
+Before opening a PR:
+
+- Keep a content change focused on one skill, plugin, automation bundle, or
+  integration. Put shared product runtime behavior in the repository that owns
+  it instead of copying machinery into extension content.
+- Treat every command, import, environment variable, endpoint, setup step, and
+  package name as an executable contract. Test the documented entrypoint with
+  released packages in each local or cloud environment the extension claims to
+  support; do not rely on developer-only variables or private paths.
+- For event-, comment-, or message-triggered work, define who may trigger it,
+  whose identity executes it, what scope it may mutate, and which minimal secrets
+  it receives. A trigger phrase is not authorization.
+- Edit the hand-authored source once and regenerate derived catalogs, commands,
+  indexes, and package assets with the existing sync/build command. Document the
+  true generation direction and do not introduce a parallel source of truth.
+- Verify copy-paste commands and factual documentation claims against the actual
+  tool or authoritative source. Extension instructions are executed by agents,
+  so incorrect setup or data-flow documentation is a functional defect.
+
 ## What this repo contains
 
 - `skills/` — a catalog of skills, **one directory per skill**.
@@ -110,7 +131,7 @@ When editing or adding skills in this repo, follow these rules (and add new skil
 - Agent-driven plugins (for example `plugins/pr-review` and `plugins/release-notes`) use `uv run --with openhands-sdk --with openhands-tools ...` and require an `LLM_API_KEY` in addition to `GITHUB_TOKEN`.
 - For OpenHands Cloud API guidance, automations, and CLI integration, use `plugins/openhands`. It is the canonical unified OpenHands plugin covering the V1 Cloud API, Automations API, and CLI. The individual skills (`skills/openhands-api`, `skills/openhands-automation`) are also available standalone.
 - When reviewing or editing `skills/openhands-sdk`, validate copy-paste imports against the released packages with `uv run --with openhands-tools --with openhands-workspace --with openhands-agent-server python ...`. In the current released workspace package, the exported remote workspace classes are `APIRemoteWorkspace` / `OpenHandsCloudWorkspace`; `RemoteAPIWorkspace` is not available.
-- For agent-driven plugin scripts, prefer `from openhands.sdk.plugin import PluginSource` and pass `plugins=[PluginSource(source=...)]` into `Conversation`. In the current released SDK (`openhands-sdk` 1.18.x), `Plugin` is not exported from `openhands.sdk.plugin`, so direct `Plugin.load(...)` imports can break CI.
+- For agent-driven plugin scripts, prefer `from openhands.sdk.plugin import PluginSource` and pass `plugins=[PluginSource(source=...)]` into `Conversation`. The current released SDK (`openhands-sdk` 1.49.x) exports both `PluginSource` and `Plugin` from `openhands.sdk.plugin`, so `Plugin.load(...)` imports also work (used by `tests/test_skill_plugin_loading.py`).
 - `plugins/qa-changes/action.yml` now has a preflight guard for fork PRs in `pull_request` context: if the PR comes from a fork and `LLM_API_KEY` is unavailable (normal for forks), the action exits successfully with a clear skip notice instead of failing.
 - `skills/bitbucket` should not tell agents to rewrite remotes proactively. In OpenHands, `BITBUCKET_TOKEN` is commonly kept in unencoded `user:token` form for API calls like `curl --user "$BITBUCKET_TOKEN" ...`; only split and URL-encode it when constructing a non-interactive HTTPS Git remote URL.
 
@@ -148,7 +169,16 @@ Important notes:
 - `scripts/sync_extensions.py` keeps generated artifacts in sync: Claude Code command files, README catalog section, coverage checks, and vendor symlinks. Run `python scripts/sync_extensions.py --check` (or just push — CI runs it) to verify everything is consistent. Run without `--check` to auto-fix. The "Quick Start" section in `README.md` (OpenHands SDK, Claude Code, and Codex setup instructions) is **manually maintained** above the auto-generated catalog markers and is intentionally not generated by the sync script.
 - The sync script uses PyYAML to parse SKILL.md frontmatter. If you add a skill with a slash trigger (e.g., `triggers: ["/mycommand"]`), the script auto-generates `commands/mycommand.md`. **Note:** Slash triggers in SKILL.md frontmatter are deprecated — prefer adding a `commands/command-name.md` file to the plugin's `commands/` directory instead. Keyword triggers (non-slash) remain the recommended way to activate skills by topic.
 
-- The `ready-for-dev` gates live in `.github/workflows/issue-readiness-check.yml` and `.github/workflows/pr-description-check.yml`, backed by `.github/scripts/check_issue_readiness.py`, `check_pr_description.py`, `refresh_linked_pr_checks.py`, and `post-readiness-comment.mjs`. Issues labeled `bug` or `enhancement` must meet type-specific readiness criteria (reproducible command plus Acceptance Criteria checklist for bugs; Desired Behavior plus Acceptance Criteria checklist for enhancements) to receive the `ready-for-dev` label. Non-draft PRs must keep the `## Why`, `## Summary`, and `## How to Test` template sections filled, and any issue linked via a closing keyword or the `## Issue Number` section must carry `ready-for-dev` unless it predates the 2026-08-25 rollout. Label transitions on an issue re-run the PR Description Check for linked open PRs. Tests live in `tests/test_check_issue_readiness.py`, `tests/test_check_pr_description.py`, and `tests/test_refresh_linked_pr_checks.py`.
+- The GitHub issue-triage automation and repository writers may grant
+  `ready-for-dev`.
+  `.github/workflows/issue-readiness-check.yml` removes a newly applied label
+  unless a user with `write`, `maintain`, or `admin` permission applied it. An
+  `unlabeled` event then lets triage reassess the issue.
+  `.github/workflows/pr-description-check.yml` still requires linked issues to
+  be ready, and label transitions refresh that check through
+  `.github/scripts/refresh_linked_pr_checks.py`. Tests for the PR gates live in
+  `tests/test_check_pr_description.py` and
+  `tests/test_refresh_linked_pr_checks.py`.
 
 ## OpenHands SDK documentation policy
 

package/README.md

@@ -9,7 +9,7 @@ It contains reusable, shareable skills and plugins that customize agent behavior
 
 ## Repository boundaries
 
-`OpenHands/extensions` is the public registry for reusable skills, plugins, automations, and integrations. [`OpenHands/software-agent-sdk`](https://github.com/OpenHands/software-agent-sdk) owns Agent Server execution and the canonical API, [`OpenHands/typescript-client`](https://github.com/OpenHands/typescript-client) owns typed browser access to that API, [`OpenHands/OpenHands`](https://github.com/OpenHands/OpenHands) owns Agent Canvas UI, and [`OpenHands/automation`](https://github.com/OpenHands/automation) owns scheduling, webhooks, run history, dispatch, and sandbox lifecycle orchestration.
+`OpenHands/extensions` is the public registry for reusable skills, plugins, automations, and integrations. [`OpenHands/software-agent-sdk`](https://github.com/OpenHands/software-agent-sdk) owns Agent Server execution, the canonical API, and typed browser access to it under `clients/typescript/`, [`OpenHands/OpenHands`](https://github.com/OpenHands/OpenHands) owns Agent Canvas UI, and [`OpenHands/automation`](https://github.com/OpenHands/automation) owns scheduling, webhooks, run history, dispatch, and sandbox lifecycle orchestration.
 
 Put reusable extension artifacts here rather than in application repositories. If a PR is opened in the wrong repository, close and move it to the repository that owns the change.
 
@@ -96,7 +96,7 @@ The JS and Python versions are kept in lock-step by `release-please` and guarded
 ## Extensions Catalog
 
 <!-- BEGIN AUTO-GENERATED CATALOG -->
-This repository contains **2 marketplace(s)** with **72 extensions** (62 skills, 10 plugins).
+This repository contains **2 marketplace(s)** with **73 extensions** (63 skills, 10 plugins).
 
 ### large-codebase
 
@@ -115,7 +115,7 @@ OpenHands skills for interacting, improving, and refactoring large codebases
 
 Official skills and plugins for OpenHands — the open-source AI software engineer.
 
-**68 extensions** (60 skills, 8 plugins)
+**69 extensions** (61 skills, 8 plugins)
 
 | Name | Type | Description | Commands |
 |------|------|-------------|----------|
@@ -128,6 +128,7 @@ Official skills and plugins for OpenHands — the open-source AI software engine
 | bitbucket | skill | Bitbucket integration hub. Detects whether the repository is on Bitbucket Cloud or Bitbucket Data Center and directs ... | — |
 | bitbucket-cloud | skill | Bitbucket Cloud (bitbucket.org) specifics — authenticate with BITBUCKET_TOKEN, use the REST API v2, workspace/repo_sl... | — |
 | bitbucket-data-center | skill | Bitbucket Data Center (self-hosted Bitbucket Server) specifics — authenticate with BITBUCKET_DATA_CENTER_TOKEN, use t... | — |
+| canvas-extension-api | skill | Build and validate Apps for Agent Canvas using the supported Canvas Extensions API v1 routed-page contract. | — |
 | city-weather | plugin | Get current weather, time, and precipitation forecast for any city using the free Open-Meteo API. Provides slash comm... | — |
 | code-review | skill | Rigorous code review focusing on data structures, simplicity, security, pragmatism, and risk/safety evaluation. Provi... | `/codereview`, `/codereview-roasted` |
 | code-simplifier | skill | Simplifies and refines code across three dimensions - code reuse, code quality, and efficiency - while preserving all... | `/simplify` |