@openhands/extensions 0.23.0 → 0.24.0

package/.agents/skills/custom-codereview-guide.md

@@ -12,18 +12,20 @@ current head when it has no material correctness, security, compatibility, or
 acceptance-criterion defect. Comment only on concrete failures; do not withhold
 approval for optional refactors, tone, style, or speculative improvements.
 
-## Repository ownership and scope
-
-This repository owns reusable skills, plugins, automation bundles, and integration
-catalogs. Agent Server behavior, endpoints, and browser client code belong in
-`OpenHands/software-agent-sdk`; Canvas UI belongs in `OpenHands/OpenHands`; and
-scheduling, dispatch, run history, and sandbox lifecycle belong in
-`OpenHands/automation`.
-
-A content PR should remain focused on one extension or one shared mechanism that
-multiple extensions actually use. Flag unrelated edits to another skill, plugin,
-or automation. Shared runtime machinery belongs in the owning product repository,
-not copied into extension content.
+## Repository scope
+
+This repository owns reusable extensions: skills, plugins, and automation
+bundles that use existing public host and runtime interfaces. Out of scope here,
+because another repository owns the contract or machinery:
+
+- SDK, agent-server, and client contracts — `OpenHands/software-agent-sdk`;
+- generic automation scheduling, state, dispatch, and profile machinery —
+  `OpenHands/automation`;
+- Canvas product and UI integration — `OpenHands/OpenHands`.
+
+Cross-repository work is acceptable when this PR contains only the
+extensions-owned portion and relies on public interfaces from the owning
+repository.
 
 ## Blocking checkpoints
 

package/.claude-plugin/marketplace.json

@@ -106,6 +106,20 @@
         "delegation"
       ]
     },
+    {
+      "name": "canvas-extension-api",
+      "source": "./skills/canvas-extension-api",
+      "description": "Build and validate Apps for Agent Canvas using the supported Canvas Extensions API v1 routed-page contract.",
+      "category": "agent-authoring",
+      "defaultEnabled": true,
+      "keywords": [
+        "agent-canvas",
+        "canvas-app",
+        "canvas-extension",
+        "register-page",
+        "app-development"
+      ]
+    },
     {
       "name": "openhands-sdk",
       "source": "./skills/openhands-sdk",

package/.codex-plugin/marketplace.json

@@ -106,6 +106,20 @@
         "delegation"
       ]
     },
+    {
+      "name": "canvas-extension-api",
+      "source": "./skills/canvas-extension-api",
+      "description": "Build and validate Apps for Agent Canvas using the supported Canvas Extensions API v1 routed-page contract.",
+      "category": "agent-authoring",
+      "defaultEnabled": true,
+      "keywords": [
+        "agent-canvas",
+        "canvas-app",
+        "canvas-extension",
+        "register-page",
+        "app-development"
+      ]
+    },
     {
       "name": "openhands-sdk",
       "source": "./skills/openhands-sdk",

package/.github/workflows/check-extensions.yml

@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
 
@@ -44,10 +44,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
@@ -63,10 +63,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 

package/.github/workflows/deprecation-check.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7

package/.github/workflows/issue-readiness-check.yml

@@ -1,131 +1,62 @@
 ---
-name: Issue Readiness Check
+name: Ready-for-dev Label Policy
 
-# Manages the `ready-for-dev` label based on type-specific readiness criteria
-# tailored to extension contributions (skills, plugins, integrations,
-# automations).
-#
-# Bug reports (label `bug`): the Actual Behavior section must reference a
-# reproducible command (`uv run pytest`, `pytest`, `python`, `pip`, `npm run`,
-# or `node`), plus an Acceptance Criteria section with at least one checklist
-# item.
-#
-# Enhancements (label `enhancement`): the body must contain Desired Behavior and
-# Acceptance Criteria sections, the latter with at least one checklist item.
-#
-# When criteria are met the label is added (idempotently); when they are not the
-# label is removed. A feedback comment is posted (or updated) in three cases:
-#   1. The issue is first opened or reopened - always comment so the author
-#      knows whether their issue is ready or what is missing.
-#   2. The label is being added (issue became ready) - comment celebrating it.
-#   3. The label is being removed (issue was ready but is no longer) - comment
-#      explaining what changed.
-# Edits that do not change the label state do not produce a new comment. All
-# comments are upserted by a hidden marker so there is at most one per issue.
-#
-# The readiness step uses `--json`, which always exits 0, so a not-ready result
-# never aborts the workflow under `set -euo pipefail`; label and comment steps
-# run for both outcomes.
+# The issue-triage automation and repository writers may grant ready-for-dev.
+# Labels from any other actor are removed.
 
 on:
     issues:
-        types: [opened, edited, reopened, labeled, unlabeled]
-
-permissions:
-    issues: write
-    pull-requests: read
-    contents: read
+        types: [labeled, unlabeled]
 
 concurrency:
-    group: issue-readiness-${{ github.event.issue.number }}
+    group: ready-for-dev-policy-${{ github.event.issue.number }}
     cancel-in-progress: false
 
 jobs:
-    check:
-        if: github.event.issue.state == 'open' && github.event.issue.pull_request == null
+    enforce-label-policy:
+        name: Enforce ready-for-dev label policy
+        if: >-
+            github.event.issue.state == 'open'
+            && github.event.issue.pull_request == null
+            && github.event.label.name == 'ready-for-dev'
         runs-on: ubuntu-latest
         timeout-minutes: 5
+        permissions:
+            issues: write
+        outputs:
+            refresh-linked-prs: ${{ steps.policy.outputs.refresh-linked-prs }}
         steps:
-            - name: Checkout trusted workflow scripts
-              uses: actions/checkout@v4
-
-            - name: Evaluate issue readiness
-              id: readiness
-              env:
-                  GITHUB_EVENT_PATH: ${{ github.event_path }}
-              run: |
-                  set -euo pipefail
-                  python .github/scripts/check_issue_readiness.py --json > /tmp/result.json
-                  echo "ready=$(jq -r '.ready' /tmp/result.json)" >> "$GITHUB_OUTPUT"
-                  # Write reasons to a file so the comment step can read them
-                  # without shell-escaping multiline text.
-                  jq -r '.reasons[]?' /tmp/result.json > /tmp/reasons.txt || true
-                  echo "reasons_file=/tmp/reasons.txt" >> "$GITHUB_OUTPUT"
-
-            - name: Add ready-for-dev label
-              if: steps.readiness.outputs.ready == 'true'
+            - name: Check label actor
+              id: policy
               env:
                   GH_TOKEN: ${{ github.token }}
+                  ACTION: ${{ github.event.action }}
+                  ACTOR: ${{ github.event.sender.login }}
+                  REPOSITORY: ${{ github.repository }}
+                  ISSUE_NUMBER: ${{ github.event.issue.number }}
               run: |
                   set -euo pipefail
-                  # Capture stderr — tolerate "label already present" (exit 0
-                  # from gh) but surface unexpected errors to the step summary.
-                  if ! gh issue edit "${{ github.event.issue.number }}" \
-                      --repo "${{ github.repository }}" \
-                      --add-label "ready-for-dev" 2>/tmp/gh-err.txt; then
-                    echo "::warning::Failed to add ready-for-dev label:" >> "$GITHUB_STEP_SUMMARY"
-                    cat /tmp/gh-err.txt >> "$GITHUB_STEP_SUMMARY"
-                  fi
 
-            - name: Remove ready-for-dev label
-              if: steps.readiness.outputs.ready != 'true' && contains(github.event.issue.labels.*.name, 'ready-for-dev')
-              env:
-                  GH_TOKEN: ${{ github.token }}
-              run: |
-                  set -euo pipefail
-                  # Capture stderr — tolerate "label already removed" but
-                  # surface unexpected errors.
-                  if ! gh issue edit "${{ github.event.issue.number }}" \
-                      --repo "${{ github.repository }}" \
-                      --remove-label "ready-for-dev" 2>/tmp/gh-err.txt; then
-                    echo "::warning::Failed to remove ready-for-dev label:" >> "$GITHUB_STEP_SUMMARY"
-                    cat /tmp/gh-err.txt >> "$GITHUB_STEP_SUMMARY"
+                  if [ "$ACTION" = "unlabeled" ]; then
+                    echo "refresh-linked-prs=true" >> "$GITHUB_OUTPUT"
+                    exit 0
                   fi
 
-            - name: Post feedback comment
-              if: >-
-                  github.event.action == 'opened'
-                  || github.event.action == 'reopened'
-                  || (steps.readiness.outputs.ready == 'true' && !contains(github.event.issue.labels.*.name, 'ready-for-dev'))
-                  || (steps.readiness.outputs.ready != 'true' && contains(github.event.issue.labels.*.name, 'ready-for-dev'))
-              env:
-                  GH_TOKEN: ${{ github.token }}
-              run: |
-                  set -euo pipefail
-                  if [ "${{ steps.readiness.outputs.ready }}" = "true" ]; then
-                    node .github/scripts/post-readiness-comment.mjs \
-                        --issue-number "${{ github.event.issue.number }}" \
-                        --repo "${{ github.repository }}" \
-                        --ready
-                  else
-                    node .github/scripts/post-readiness-comment.mjs \
-                        --issue-number "${{ github.event.issue.number }}" \
-                        --repo "${{ github.repository }}" \
-                        --reasons-file "${{ steps.readiness.outputs.reasons_file }}"
-                  fi
+                  permission="$(gh api "repos/$REPOSITORY/collaborators/$ACTOR/permission" --jq .permission 2>/dev/null || true)"
+                  case "$permission" in
+                    write|maintain|admin)
+                      echo "refresh-linked-prs=true" >> "$GITHUB_OUTPUT"
+                      ;;
+                    *)
+                      gh issue edit "$ISSUE_NUMBER" --repo "$REPOSITORY" --remove-label ready-for-dev
+                      echo "refresh-linked-prs=false" >> "$GITHUB_OUTPUT"
+                      ;;
+                  esac
 
-    # When the ready-for-dev label is added or removed, re-run the PR
-    # description check for every open PR that links this issue, so the
-    # `ready-for-dev` gate does not go stale between PR events. Runs after
-    # `check` so the label reflects the settled readiness state.
     refresh-linked-pr-gates:
         name: Refresh PR gates for linked issues
-        needs: check
-        if: >-
-            github.event.issue.state == 'open'
-            && github.event.issue.pull_request == null
-            && (github.event.action == 'labeled' || github.event.action == 'unlabeled')
-            && github.event.label.name == 'ready-for-dev'
+        needs: enforce-label-policy
+        if: needs.enforce-label-policy.outputs.refresh-linked-prs == 'true'
         runs-on: ubuntu-latest
         timeout-minutes: 10
         permissions:
@@ -134,7 +65,7 @@ jobs:
             actions: write
         steps:
             - name: Checkout trusted workflow scripts
-              uses: actions/checkout@v4
+              uses: actions/checkout@v7
 
             - name: Re-run PR description checks for linked open PRs
               env:

package/.github/workflows/npm-publish.yml

@@ -31,14 +31,14 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       # Trusted publishing requires Node 22.14.0+ and npm 11.5.1+
       # See: https://docs.npmjs.com/trusted-publishers/
       - name: Set up Node.js for npm trusted publishing
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
           registry-url: https://registry.npmjs.org

package/.github/workflows/pr-description-check.yml

@@ -29,7 +29,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout trusted workflow scripts
-              uses: actions/checkout@v4
+              uses: actions/checkout@v7
               with:
                   ref: ${{ github.event.pull_request.base.sha }}
 

package/.github/workflows/pypi-publish.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Extract version
         id: extract_version
@@ -72,7 +72,7 @@ jobs:
         run: uv build
 
       - name: Upload distributions
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: python-package-distributions
           path: dist/
@@ -95,7 +95,7 @@ jobs:
 
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           name: python-package-distributions
           path: dist/

package/.github/workflows/tests.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7
@@ -21,7 +21,7 @@ jobs:
           python-version: "3.12"
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
 

package/.plugin/marketplace.json

@@ -106,6 +106,20 @@
         "delegation"
       ]
     },
+    {
+      "name": "canvas-extension-api",
+      "source": "./skills/canvas-extension-api",
+      "description": "Build and validate Apps for Agent Canvas using the supported Canvas Extensions API v1 routed-page contract.",
+      "category": "agent-authoring",
+      "defaultEnabled": true,
+      "keywords": [
+        "agent-canvas",
+        "canvas-app",
+        "canvas-extension",
+        "register-page",
+        "app-development"
+      ]
+    },
     {
       "name": "openhands-sdk",
       "source": "./skills/openhands-sdk",

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.23.0"
+  ".": "0.24.0"
 }

package/AGENTS.md

@@ -169,7 +169,16 @@ Important notes:
 - `scripts/sync_extensions.py` keeps generated artifacts in sync: Claude Code command files, README catalog section, coverage checks, and vendor symlinks. Run `python scripts/sync_extensions.py --check` (or just push — CI runs it) to verify everything is consistent. Run without `--check` to auto-fix. The "Quick Start" section in `README.md` (OpenHands SDK, Claude Code, and Codex setup instructions) is **manually maintained** above the auto-generated catalog markers and is intentionally not generated by the sync script.
 - The sync script uses PyYAML to parse SKILL.md frontmatter. If you add a skill with a slash trigger (e.g., `triggers: ["/mycommand"]`), the script auto-generates `commands/mycommand.md`. **Note:** Slash triggers in SKILL.md frontmatter are deprecated — prefer adding a `commands/command-name.md` file to the plugin's `commands/` directory instead. Keyword triggers (non-slash) remain the recommended way to activate skills by topic.
 
-- The `ready-for-dev` gates live in `.github/workflows/issue-readiness-check.yml` and `.github/workflows/pr-description-check.yml`, backed by `.github/scripts/check_issue_readiness.py`, `check_pr_description.py`, `refresh_linked_pr_checks.py`, and `post-readiness-comment.mjs`. Issues labeled `bug` or `enhancement` must meet type-specific readiness criteria (reproducible command plus Acceptance Criteria checklist for bugs; Desired Behavior plus Acceptance Criteria checklist for enhancements) to receive the `ready-for-dev` label. Non-draft PRs must keep the `## Why`, `## Summary`, and `## How to Test` template sections filled, and any issue linked via a closing keyword or the `## Issue Number` section must carry `ready-for-dev` unless it predates the 2026-08-25 rollout. Label transitions on an issue re-run the PR Description Check for linked open PRs. Tests live in `tests/test_check_issue_readiness.py`, `tests/test_check_pr_description.py`, and `tests/test_refresh_linked_pr_checks.py`.
+- The GitHub issue-triage automation and repository writers may grant
+  `ready-for-dev`.
+  `.github/workflows/issue-readiness-check.yml` removes a newly applied label
+  unless a user with `write`, `maintain`, or `admin` permission applied it. An
+  `unlabeled` event then lets triage reassess the issue.
+  `.github/workflows/pr-description-check.yml` still requires linked issues to
+  be ready, and label transitions refresh that check through
+  `.github/scripts/refresh_linked_pr_checks.py`. Tests for the PR gates live in
+  `tests/test_check_pr_description.py` and
+  `tests/test_refresh_linked_pr_checks.py`.
 
 ## OpenHands SDK documentation policy
 

package/README.md

@@ -96,7 +96,7 @@ The JS and Python versions are kept in lock-step by `release-please` and guarded
 ## Extensions Catalog
 
 <!-- BEGIN AUTO-GENERATED CATALOG -->
-This repository contains **2 marketplace(s)** with **72 extensions** (62 skills, 10 plugins).
+This repository contains **2 marketplace(s)** with **73 extensions** (63 skills, 10 plugins).
 
 ### large-codebase
 
@@ -115,7 +115,7 @@ OpenHands skills for interacting, improving, and refactoring large codebases
 
 Official skills and plugins for OpenHands — the open-source AI software engineer.
 
-**68 extensions** (60 skills, 8 plugins)
+**69 extensions** (61 skills, 8 plugins)
 
 | Name | Type | Description | Commands |
 |------|------|-------------|----------|
@@ -128,6 +128,7 @@ Official skills and plugins for OpenHands — the open-source AI software engine
 | bitbucket | skill | Bitbucket integration hub. Detects whether the repository is on Bitbucket Cloud or Bitbucket Data Center and directs ... | — |
 | bitbucket-cloud | skill | Bitbucket Cloud (bitbucket.org) specifics — authenticate with BITBUCKET_TOKEN, use the REST API v2, workspace/repo_sl... | — |
 | bitbucket-data-center | skill | Bitbucket Data Center (self-hosted Bitbucket Server) specifics — authenticate with BITBUCKET_DATA_CENTER_TOKEN, use t... | — |
+| canvas-extension-api | skill | Build and validate Apps for Agent Canvas using the supported Canvas Extensions API v1 routed-page contract. | — |
 | city-weather | plugin | Get current weather, time, and precipitation forecast for any city using the free Open-Meteo API. Provides slash comm... | — |
 | code-review | skill | Rigorous code review focusing on data structures, simplicity, security, pragmatism, and risk/safety evaluation. Provi... | `/codereview`, `/codereview-roasted` |
 | code-simplifier | skill | Simplifies and refines code across three dimensions - code reuse, code quality, and efficiency - while preserving all... | `/simplify` |