@openhands/extensions 0.27.0 → 0.29.0

package/.agents/skills/custom-codereview-guide.md

@@ -88,6 +88,37 @@ package manager and runtime used by the extension. Temporary git pins and
 unreleased package APIs are blockers for merge unless the PR is an explicit,
 coordinated stack that will replace them before release.
 
+### Design context for deep changes
+
+A diff shows edits, not always the design. Expect concise design context when a
+reviewer cannot judge a change from the diff in a few minutes: a new or changed
+skill, plugin, automation, integration contract, or manifest schema; a new
+subsystem, migration, or cross-cutting refactor; a behavior change in shared
+loading, validation, discovery, or execution; or a large diff whose intent is
+hard to hold once generated files, lockfiles, snapshots, vendored code, and
+mechanical churn are set aside. Typos, one-line guards, dependency bumps, small
+documentation edits, and localized fixes need none. Line count is a signal,
+never a gate by itself.
+
+Design context is an available design-doc artifact or a durable write-up in the
+PR description that states the intent, the important before/after behavior or
+contract shape, compatibility and risk, and grounded code references. When a
+deep change lacks it, weigh the gap by risk:
+
+- **HIGH** risk: do not approve; submit a COMMENT review that asks for design
+  context before a human merge decision.
+- **MEDIUM** risk: withhold approval only when reconstructing the design from
+  the diff would materially slow or weaken the review.
+- **LOW** risk: never block on missing design context alone.
+
+Approving a same-repository PR removes its `.pr/` directory. If a temporary
+`.pr/` page is the only design explanation, submit a COMMENT review instead of
+approving, so the page remains for the human maintainer's decision, unless the
+PR description already carries the durable equivalent.
+
+Design context aids review; it does not excuse correctness, security,
+architecture, or repository-ownership problems.
+
 ## Evidence and comment discipline
 
 Evidence should exercise the extension as users invoke it: run the command, hook,

package/.claude-plugin/marketplace.json

@@ -830,6 +830,15 @@
         "technical-writing"
       ]
     },
+    {
+      "name": "simplified-technical-english",
+      "source": "./skills/simplified-technical-english",
+      "description": "Write explanations and chat in the style of ASD-STE100 Simplified Technical English: short active sentences, one idea each, plain consistent words. Applies to prose only, never to code.",
+      "category": "writing",
+      "keywords": [
+        "simplified-technical-english"
+      ]
+    },
     {
       "name": "plain-english-content",
       "source": "./skills/plain-english-content",

package/.codex-plugin/marketplace.json

@@ -830,6 +830,15 @@
         "technical-writing"
       ]
     },
+    {
+      "name": "simplified-technical-english",
+      "source": "./skills/simplified-technical-english",
+      "description": "Write explanations and chat in the style of ASD-STE100 Simplified Technical English: short active sentences, one idea each, plain consistent words. Applies to prose only, never to code.",
+      "category": "writing",
+      "keywords": [
+        "simplified-technical-english"
+      ]
+    },
     {
       "name": "plain-english-content",
       "source": "./skills/plain-english-content",

package/.github/workflows/build-vscode-app.yml

@@ -11,8 +11,8 @@ jobs:
   package:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
       - name: Build installable App package
@@ -23,7 +23,7 @@ jobs:
           test -f dist/apps/vscode/extension.js
           test -f dist/apps/vscode/backend/openvscode-linux-amd64.tar.gz
           test -f dist/apps/vscode/backend/openvscode-linux-arm64.tar.gz
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: vscode-app-${{ github.sha }}
           path: dist/apps/vscode

package/.github/workflows/deprecation-check.yml

@@ -16,7 +16,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
           python-version: "3.12"

package/.github/workflows/pypi-publish.yml

@@ -43,7 +43,7 @@ jobs:
           echo "📦 Version: $VERSION"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           version: latest
           python-version: '3.12'
@@ -101,4 +101,4 @@ jobs:
           path: dist/
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

package/.github/workflows/tests.yml

@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
           python-version: "3.12"

package/.plugin/marketplace.json

@@ -830,6 +830,15 @@
         "technical-writing"
       ]
     },
+    {
+      "name": "simplified-technical-english",
+      "source": "./skills/simplified-technical-english",
+      "description": "Write explanations and chat in the style of ASD-STE100 Simplified Technical English: short active sentences, one idea each, plain consistent words. Applies to prose only, never to code.",
+      "category": "writing",
+      "keywords": [
+        "simplified-technical-english"
+      ]
+    },
     {
       "name": "plain-english-content",
       "source": "./skills/plain-english-content",

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.27.0"
+  ".": "0.29.0"
 }

package/AGENTS.md

@@ -6,7 +6,7 @@ It contains **shareable skills and plugins** that can be loaded by OpenHands (CL
 
 ## Cross-Repository Boundaries
 
-This repository owns the public registry of reusable OpenHands skills, plugins, automations, and integrations. These extensions are consumed by OpenHands applications and SDK-based clients.
+This repository owns the public registry of reusable OpenHands skills, plugins, Agent Canvas Apps, automations, and integrations. These extensions are consumed by OpenHands applications and SDK-based clients.
 
 Related repositories have distinct responsibilities:
 
@@ -49,7 +49,12 @@ Before opening a PR:
   - `plugins/<plugin-name>/hooks/` — lifecycle hooks (optional)
   - `plugins/<plugin-name>/scripts/` — utility scripts (optional)
 
-There is no application code here; the primary artifacts are Markdown skill definitions and plugin configurations, which can contain `scripts/`, `hooks/` sub-directories.
+- `apps/` — a catalog of Agent Canvas Apps (beta), **one directory per app**.
+  - `apps/<app-name>/canvas-extension.json` — the App manifest (Canvas Extensions API v1)
+  - `apps/<app-name>/extension.js` — the browser ESM entrypoint exporting `activate(host)`
+  - `apps/catalog.json` — the registry catalog, exposed as `APPS_CATALOG` from `@openhands/extensions/apps`
+
+Most content is Markdown skill definitions and plugin configurations; the executable parts are plugin `scripts/` and `hooks/` plus the browser ESM App packages under `apps/`, each of which may ship its own `scripts/` and build sub-directories.
 
 ## How client code uses this repo
 

package/README.md

@@ -100,7 +100,7 @@ The JS and Python versions are kept in lock-step by `release-please` and guarded
 ## Extensions Catalog
 
 <!-- BEGIN AUTO-GENERATED CATALOG -->
-This repository contains **2 marketplace(s)** with **76 extensions** (65 skills, 11 plugins).
+This repository contains **2 marketplace(s)** with **77 extensions** (66 skills, 11 plugins).
 
 ### large-codebase
 
@@ -119,7 +119,7 @@ OpenHands skills for interacting, improving, and refactoring large codebases
 
 Official skills and plugins for OpenHands — the open-source AI software engineer.
 
-**72 extensions** (63 skills, 9 plugins)
+**73 extensions** (64 skills, 9 plugins)
 
 | Name | Type | Description | Commands |
 |------|------|-------------|----------|
@@ -182,6 +182,7 @@ Official skills and plugins for OpenHands — the open-source AI software engine
 | research-brief | skill | Create a recurring automation that researches a topic using Tavily web search and publishes a structured brief to Not... | `/research-brief:setup` |
 | runtime-api-configs | plugin | Manage warm sandbox pools on OpenHands Enterprise from a Python CLI: list, template, save, and delete warm runtime co... | — |
 | security | skill | Security best practices for secure coding, authentication, authorization, and data protection. Use when developing fe... | — |
+| simplified-technical-english | skill | Write explanations and chat in the style of ASD-STE100 Simplified Technical English: short active sentences, one idea... | — |
 | skill-creator | skill | Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an ex... | — |
 | slack-channel-monitor | skill | Create a cron automation that polls up to 10 Slack channels every minute and starts an OpenHands conversation when a ... | `/slack-monitor:poll` |
 | slack-standup-digest | skill | Create an automation that generates an async standup digest from Slack. Searches selected channels for messages since... | `/standup-digest:setup` |