@openhands/extensions 0.28.0 → 0.30.0

package/.agents/skills/custom-codereview-guide.md

@@ -27,7 +27,32 @@ Cross-repository work is acceptable when this PR contains only the
 extensions-owned portion and relies on public interfaces from the owning
 repository.
 
-## Blocking checkpoints
+## Issue triage
+
+Issue readiness means the work is clear enough to start—not that the fix is
+complete. Do not require a PR, passing implementation tests, or before-and-after
+fix evidence. Reconsider readiness when new information leaves scope or expected
+behavior unresolved. Read the issue, linked discussion, applicable `AGENTS.md`,
+and adjacent source before asking questions.
+
+For API failures, compare the extension request with the provider's reported or
+supported version, not upstream main. Use dependency pins or deployment evidence.
+Instructions, request arguments, response parsing, and scanner policy belong
+here; use the ownership boundaries above for other failures. State required
+cross-repository changes and their order. An independent upstream defect need
+not block this work. Naming an owner does not authorize edits or duplicate tickets.
+
+Define the smallest useful outcome and explicit non-goals. Cover only affected
+entrypoints, environments, and permissions. For scanners, state whether discovery,
+commenting, and dispatch are allowed for ineligible candidates or after a cap.
+Discovery alone does not authorize unsolicited comments.
+
+Request visual evidence only when needed; otherwise use logs, minimal
+reproductions, or failing tests. Do not repeat answered questions. Match managed
+criteria to current human decisions and authoritative readiness policy. Report
+conflicts instead of repeatedly adding a label that policy removes.
+
+## Implementation review checkpoints
 
 ### Executable instructions and runtime parity
 
@@ -42,6 +67,16 @@ in a clean environment far enough to exercise the changed behavior. Keep local
 and cloud behavior identical unless the documentation names and explains a real
 platform capability difference.
 
+For provider changes, inspect the supported implementation; mocks and local types
+alone do not establish an API contract. Separate static/helper tests, tests with
+simulated services, and real integration evidence. If the version or runtime is
+unavailable, report that limit, not an assumed defect. For packaging changes,
+check source, shipped bundle, and deployed files separately.
+
+For scanners, check eligibility, permissions, caps, retries, unchanged runs, and
+recovery for each action listed under triage. A launch cap does not permit
+unlimited gate comments.
+
 ### Untrusted triggers and credentials
 
 Treat repository events, issue and PR comments, chat messages, catalog fields,
@@ -130,3 +165,11 @@ Do not comment on punctuation, preferred prose tone, optional DRY cleanup, or
 hypothetical non-standard configurations without a supported failure mode. Before
 raising a finding, verify that the referenced file and behavior are present in
 the current PR head and have not already been addressed in review history.
+
+## Review verdict
+
+Do not approve material code defects or unmet blocking merge/evidence checks.
+Distinguish code defects from missing merge requirements and optional follow-up.
+If GitHub forbids self-approval of a clean PR, use COMMENT and explain why.
+Respect accepted scope and non-goals: block on a pre-existing limitation only if
+this change exposes it.

package/.claude-plugin/marketplace.json

@@ -752,7 +752,7 @@
     {
       "name": "gitlab-issue-to-mr",
       "source": "./skills/gitlab-issue-to-mr",
-      "description": "Create an automation that implements GitLab issues when a configurable trigger label is applied. Clones the default branch for the agent, then commits, pushes, and opens the merge request itself - the agent is handed no push credential.",
+      "description": "Create an automation that implements GitLab issues when a configurable trigger label is applied. Polls the projects deterministically and starts one conversation per label event; on OpenHands Cloud and Enterprise it reaches GitLab through the connected MCP server or integration, with no token to set up.",
       "category": "automations",
       "keywords": [
         "gitlab",
@@ -851,11 +851,14 @@
     {
       "name": "jira-issue-to-pr",
       "source": "./skills/jira-issue-to-pr",
-      "description": "Deploy a cron-based OpenHands automation that watches a Jira Cloud project for issues labeled with a configurable label (default: create-pr) and spawns an agent conversation to create a GitHub pull request for each new issue found. The target GitHub repo is read from the ticket body - no repo parameter required at deploy time.",
+      "description": "Deploy a cron-based OpenHands automation that opens a GitHub pull request, a GitLab merge request or a Bitbucket pull request for each Jira issue carrying a configurable label (default: create-pr). The target repository is read from the ticket body - no repo parameter required at deploy time.",
       "category": "automations",
       "keywords": [
         "jira",
-        "atlassian"
+        "atlassian",
+        "github",
+        "gitlab",
+        "bitbucket"
       ]
     },
     {
@@ -873,10 +876,9 @@
     {
       "name": "ticket-to-code-change",
       "source": "./skills/ticket-to-code-change",
-      "description": "Set up Jira or Linear ticket-to-code-change automations for GitHub, GitLab, and Bitbucket.",
+      "description": "Set up Linear ticket-to-code-change automations for GitHub, GitLab, and Bitbucket.",
       "category": "automations",
       "keywords": [
-        "jira",
         "linear",
         "github",
         "gitlab",

package/.codex-plugin/marketplace.json

@@ -752,7 +752,7 @@
     {
       "name": "gitlab-issue-to-mr",
       "source": "./skills/gitlab-issue-to-mr",
-      "description": "Create an automation that implements GitLab issues when a configurable trigger label is applied. Clones the default branch for the agent, then commits, pushes, and opens the merge request itself - the agent is handed no push credential.",
+      "description": "Create an automation that implements GitLab issues when a configurable trigger label is applied. Polls the projects deterministically and starts one conversation per label event; on OpenHands Cloud and Enterprise it reaches GitLab through the connected MCP server or integration, with no token to set up.",
       "category": "automations",
       "keywords": [
         "gitlab",
@@ -851,11 +851,14 @@
     {
       "name": "jira-issue-to-pr",
       "source": "./skills/jira-issue-to-pr",
-      "description": "Deploy a cron-based OpenHands automation that watches a Jira Cloud project for issues labeled with a configurable label (default: create-pr) and spawns an agent conversation to create a GitHub pull request for each new issue found. The target GitHub repo is read from the ticket body - no repo parameter required at deploy time.",
+      "description": "Deploy a cron-based OpenHands automation that opens a GitHub pull request, a GitLab merge request or a Bitbucket pull request for each Jira issue carrying a configurable label (default: create-pr). The target repository is read from the ticket body - no repo parameter required at deploy time.",
       "category": "automations",
       "keywords": [
         "jira",
-        "atlassian"
+        "atlassian",
+        "github",
+        "gitlab",
+        "bitbucket"
       ]
     },
     {
@@ -873,10 +876,9 @@
     {
       "name": "ticket-to-code-change",
       "source": "./skills/ticket-to-code-change",
-      "description": "Set up Jira or Linear ticket-to-code-change automations for GitHub, GitLab, and Bitbucket.",
+      "description": "Set up Linear ticket-to-code-change automations for GitHub, GitLab, and Bitbucket.",
       "category": "automations",
       "keywords": [
-        "jira",
         "linear",
         "github",
         "gitlab",

package/.github/workflows/build-vscode-app.yml

@@ -14,15 +14,15 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version: "24"
       - name: Build installable App package
         run: node apps/vscode/scripts/package.mjs
       - name: Validate package files
         run: |
           test -f dist/apps/vscode/canvas-extension.json
           test -f dist/apps/vscode/extension.js
-          test -f dist/apps/vscode/backend/openvscode-linux-amd64.tar.gz
-          test -f dist/apps/vscode/backend/openvscode-linux-arm64.tar.gz
+          test -f dist/apps/vscode/README.md
+          test -z "$(find dist/apps/vscode -type f -name '*.tar.gz' -print -quit)"
       - uses: actions/upload-artifact@v7
         with:
           name: vscode-app-${{ github.sha }}

package/.github/workflows/check-extensions.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version: "24"
 
       - name: Install Claude Code CLI
         run: npm install -g @anthropic-ai/claude-code

package/.github/workflows/tests.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version: "24"
 
       - name: Run tests
         run: uv run --group test pytest tests/

package/.plugin/marketplace.json

@@ -752,7 +752,7 @@
     {
       "name": "gitlab-issue-to-mr",
       "source": "./skills/gitlab-issue-to-mr",
-      "description": "Create an automation that implements GitLab issues when a configurable trigger label is applied. Clones the default branch for the agent, then commits, pushes, and opens the merge request itself - the agent is handed no push credential.",
+      "description": "Create an automation that implements GitLab issues when a configurable trigger label is applied. Polls the projects deterministically and starts one conversation per label event; on OpenHands Cloud and Enterprise it reaches GitLab through the connected MCP server or integration, with no token to set up.",
       "category": "automations",
       "keywords": [
         "gitlab",
@@ -851,11 +851,14 @@
     {
       "name": "jira-issue-to-pr",
       "source": "./skills/jira-issue-to-pr",
-      "description": "Deploy a cron-based OpenHands automation that watches a Jira Cloud project for issues labeled with a configurable label (default: create-pr) and spawns an agent conversation to create a GitHub pull request for each new issue found. The target GitHub repo is read from the ticket body - no repo parameter required at deploy time.",
+      "description": "Deploy a cron-based OpenHands automation that opens a GitHub pull request, a GitLab merge request or a Bitbucket pull request for each Jira issue carrying a configurable label (default: create-pr). The target repository is read from the ticket body - no repo parameter required at deploy time.",
       "category": "automations",
       "keywords": [
         "jira",
-        "atlassian"
+        "atlassian",
+        "github",
+        "gitlab",
+        "bitbucket"
       ]
     },
     {
@@ -873,10 +876,9 @@
     {
       "name": "ticket-to-code-change",
       "source": "./skills/ticket-to-code-change",
-      "description": "Set up Jira or Linear ticket-to-code-change automations for GitHub, GitLab, and Bitbucket.",
+      "description": "Set up Linear ticket-to-code-change automations for GitHub, GitLab, and Bitbucket.",
       "category": "automations",
       "keywords": [
-        "jira",
         "linear",
         "github",
         "gitlab",

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.28.0"
+  ".": "0.30.0"
 }

package/AGENTS.md

@@ -6,7 +6,7 @@ It contains **shareable skills and plugins** that can be loaded by OpenHands (CL
 
 ## Cross-Repository Boundaries
 
-This repository owns the public registry of reusable OpenHands skills, plugins, automations, and integrations. These extensions are consumed by OpenHands applications and SDK-based clients.
+This repository owns the public registry of reusable OpenHands skills, plugins, Agent Canvas Apps, automations, and integrations. These extensions are consumed by OpenHands applications and SDK-based clients.
 
 Related repositories have distinct responsibilities:
 
@@ -49,7 +49,12 @@ Before opening a PR:
   - `plugins/<plugin-name>/hooks/` — lifecycle hooks (optional)
   - `plugins/<plugin-name>/scripts/` — utility scripts (optional)
 
-There is no application code here; the primary artifacts are Markdown skill definitions and plugin configurations, which can contain `scripts/`, `hooks/` sub-directories.
+- `apps/` — a catalog of Agent Canvas Apps (beta), **one directory per app**.
+  - `apps/<app-name>/canvas-extension.json` — the App manifest (Canvas Extensions API v1)
+  - `apps/<app-name>/extension.js` — the browser ESM entrypoint exporting `activate(host)`
+  - `apps/catalog.json` — the registry catalog, exposed as `APPS_CATALOG` from `@openhands/extensions/apps`
+
+Most content is Markdown skill definitions and plugin configurations; the executable parts are plugin `scripts/` and `hooks/` plus the browser ESM App packages under `apps/`, each of which may ship its own `scripts/` and build sub-directories.
 
 ## How client code uses this repo
 

package/README.md

@@ -154,10 +154,10 @@ Official skills and plugins for OpenHands — the open-source AI software engine
 | github-repo-monitor | skill | Create a cron automation that polls a GitHub repository for issue and PR comments containing a configurable trigger p... | `/github-monitor:poll` |
 | github-stale-ci-pr-closer | skill | Warn and close abandoned pull requests whose required CI remains failing. | `/github-stale-ci-pr-closer` |
 | gitlab | skill | Interact with GitLab repositories, merge requests, and APIs using the GITLAB_TOKEN environment variable. Use when wor... | — |
-| gitlab-issue-to-mr | skill | Create an automation that implements GitLab issues when a configurable trigger label is applied. Clones the default b... | `/issue-to-mr:setup` |
+| gitlab-issue-to-mr | skill | Create an automation that implements GitLab issues when a configurable trigger label is applied. Polls the projects d... | `/issue-to-mr:setup` |
 | incident-retrospective | skill | Create an automation that drafts incident retrospectives by gathering incident-channel messages from Slack, collectin... | `/incident-retro:setup` |
 | iterate | skill | Iterate on a GitHub pull request — drive it through CI, code review, and QA until merge-ready. Monitors state, fixes ... | `/iterate`, `/verify`, `/babysit` |
-| jira-issue-to-pr | skill | Deploy a cron-based OpenHands automation that watches a Jira Cloud project for issues labeled with a configurable lab... | — |
+| jira-issue-to-pr | skill | Deploy a cron-based OpenHands automation that opens a GitHub pull request, a GitLab merge request or a Bitbucket pull... | — |
 | jupyter | skill | Read, modify, execute, and convert Jupyter notebooks programmatically. Use when working with .ipynb files for data sc... | — |
 | kubernetes | skill | Set up and manage local Kubernetes clusters using KIND (Kubernetes IN Docker). Use when testing Kubernetes applicatio... | — |
 | learn-from-code-review | skill | Distill code review feedback from GitHub PRs into reusable skills and guidelines. Use when users ask to learn from co... | `/learn-from-reviews` |
@@ -190,7 +190,7 @@ Official skills and plugins for OpenHands — the open-source AI software engine
 | swift-linux | skill | Install and configure Swift programming language on Debian Linux for server-side development. Use when building Swift... | — |
 | technical-writing | skill | Write and revise technical explanations in flowing, direct, conversational prose that stays concise without becoming ... | — |
 | theme-factory | skill | Toolkit for styling artifacts with a theme. These artifacts can be slides, docs, reportings, HTML landing pages, etc.... | — |
-| ticket-to-code-change | skill | Set up Jira or Linear ticket-to-code-change automations for GitHub, GitLab, and Bitbucket. | `/ticket-to-code-change:setup` |
+| ticket-to-code-change | skill | Set up Linear ticket-to-code-change automations for GitHub, GitLab, and Bitbucket. | `/ticket-to-code-change:setup` |
 | upstream-fork-sync | skill | Keep a long-lived fork in sync with its upstream. Creates a cron automation that fetches upstream changes, rebases lo... | `/upstream-fork-sync:setup` |
 | use-jev | skill | Use Jev, a general classifier, for typed choices, scores, and yes/no probabilities in software. | — |
 | uv | skill | Common project, dependency, and environment operations using uv. | — |

package/apps/vscode/README.md

@@ -1,13 +1,15 @@
 # VS Code App
 
-This App provides a full-height OpenVSCode editor. Before the backend is ready, the App shows backend status, an explicit workspace-folder input, and revision-bound prepare/start/stop/refresh actions. Once ready, the page contains only the editor iframe. The folder is persisted in browser storage and sent as an optional `query.folder` mount parameter; it is a user convenience, not OS sandboxing.
+Install this App in Agent Canvas by opening **Apps → Add App** and entering:
 
-## Artifact delivery
+```text
+https://github.com/OpenHands/extensions/tree/main/apps/vscode
+```
 
-The repository intentionally contains no OpenVSCode binaries. `scripts/package.mjs` downloads the pinned upstream OpenVSCode Server `v1.109.5` Linux amd64 and arm64 archives, verifies their upstream checksums, normalizes the archive layout and metadata, and writes the package-contained archives required by `canvas-extension.json`. The GitHub Actions workflow publishes the resulting `vscode-app-<commit>` artifact; that archive is the installable coordinate for this revision.
+The App provides a full-height OpenVSCode editor. Before the backend is ready, it shows backend status, an optional workspace-folder input, and revision-bound prepare/start/stop/refresh actions. Once ready, the page contains only the editor iframe.
 
-The package is not a release until reviewed and merged. The workflow artifact is a development delivery coordinate, not a published release or a version pin for Agent Server. This App depends on the Canvas consumer change that adds optional `mount({ container, query: { folder } })` support; until that consumer PR lands, setup works but the selected folder is not forwarded to OpenVSCode.
+## Artifact delivery
 
-The backend uses app-owned data directories for user data and extensions and receives only the manifest allowlisted environment. It does not receive Agent Server credentials. OpenVSCode starts at the existing app-owned `{data_dir}` by default; the optional folder query changes the editor folder only when the Canvas consumer supports it. Folder selection is not OS sandboxing.
+The repository contains no OpenVSCode binaries. During the explicit **Prepare and start** step, Agent Server downloads only the current platform's pinned OpenVSCode Server `v1.109.5` archive from its public GitHub Release, verifies the manifest-pinned SHA-256 digest, safely extracts it into an App-owned content-addressed cache, and starts it with App-owned home, user-data, and extensions directories. It does not send Agent Server or repository credentials to the artifact host.
 
-The real ngrok editor/save/terminal click-through GIF is maintained in the Agent Canvas implementation PR as development-stack evidence. It is not bundled here and is not a release or package test.
+The optional folder is persisted in browser storage and forwarded as the editor folder. It is a user convenience, not OS sandboxing.

package/apps/vscode/canvas-extension.json

@@ -9,10 +9,18 @@
   "backend": {
     "schema_version": 1,
     "artifacts": {
-      "linux-amd64": {"path": "backend/openvscode-linux-amd64.tar.gz", "sha256": "5ad14274cc5e5ed938ffecf1dd53c0e58272828d8b50cb5da93b6d9e5d2cd9d5"},
-      "linux-arm64": {"path": "backend/openvscode-linux-arm64.tar.gz", "sha256": "91876160f1b549020204e3909ad42a80d22ef0ebf66a62306cdf60ca5d44524b"}
+      "linux-amd64": {
+        "url": "https://github.com/gitpod-io/openvscode-server/releases/download/openvscode-server-v1.109.5/openvscode-server-v1.109.5-linux-x64.tar.gz",
+        "sha256": "b433bf4f0227321a7014d8460d10a8f958adc0f45aa79bd889e84e65e8f88363",
+        "strip_components": 1
+      },
+      "linux-arm64": {
+        "url": "https://github.com/gitpod-io/openvscode-server/releases/download/openvscode-server-v1.109.5/openvscode-server-v1.109.5-linux-arm64.tar.gz",
+        "sha256": "36d9c14036489b63de84ebace837fcacf7e60e669a0dc715802c5443684ea4dc",
+        "strip_components": 1
+      }
     },
-    "argv": ["{artifact_dir}/bin/openvscode-bootstrap", "--host", "127.0.0.1", "--port", "{port}", "--without-connection-token", "--accept-server-license-terms", "--telemetry-level", "off", "--user-data-dir", "{data_dir}/user", "--extensions-dir", "{data_dir}/extensions", "--server-base-path", "/app-backends/vscode", "{data_dir}"],
+    "argv": ["{artifact_dir}/bin/openvscode-server", "--host", "127.0.0.1", "--port", "{port}", "--without-connection-token", "--accept-server-license-terms", "--telemetry-level", "off", "--user-data-dir", "{data_dir}/user", "--extensions-dir", "{data_dir}/extensions", "--server-base-path", "/app-backends/vscode", "{data_dir}"],
     "health": {"path": "/", "timeout_seconds": 90, "interval_seconds": 0.5},
     "inherit_environment": ["PATH", "LANG", "LC_ALL", "TMPDIR"]
   }

package/apps/vscode/extension.js

@@ -5,14 +5,32 @@ function folderKey(host) {
   return `${FOLDER_KEY_PREFIX}:${host.backend.id}:${host.backend.orgId || "local"}:${host.extension.name}`;
 }
 
-function button(label, onClick) {
+function button(label, onClick, variant = "secondary") {
   const element = document.createElement("button");
   element.type = "button";
   element.textContent = label;
+  element.style.cssText = [
+    "min-height:40px",
+    "padding:0 18px",
+    "border-radius:8px",
+    "border:1px solid transparent",
+    "font:inherit",
+    "font-size:14px",
+    "font-weight:600",
+    "cursor:pointer",
+    "transition:opacity 120ms ease,background-color 120ms ease",
+    variant === "primary"
+      ? "background:#f3ce49;color:#171717"
+      : "background:#262626;color:#fafafa;border-color:#525252",
+  ].join(";");
   element.addEventListener("click", onClick);
   return element;
 }
 
+function statusLabel(state) {
+  return state.charAt(0).toUpperCase() + state.slice(1);
+}
+
 export function activate(host) {
   return host.registerPage("editor", async ({ container }) => {
     container.style.minHeight = "100vh";
@@ -54,26 +72,55 @@ export function activate(host) {
         return;
       }
 
+      shell.style.justifyContent = "center";
+      shell.style.alignItems = "center";
+      shell.style.padding = "32px";
+      shell.style.boxSizing = "border-box";
+
       const panel = document.createElement("section");
       panel.setAttribute("aria-live", "polite");
+      panel.style.cssText = "width:min(100%,520px);padding:32px;border:1px solid #262626;border-radius:12px;background:#0a0a0a;color:#fafafa;box-sizing:border-box;text-align:center";
       const heading = document.createElement("h2");
-      heading.textContent = "VS Code setup";
-      const detail = document.createElement("p");
-      detail.textContent = status.detail || `Backend status: ${status.state}.`;
-      panel.append(heading, detail);
+      heading.textContent = "Set up VS Code";
+      heading.style.cssText = "margin:0;font-size:24px;line-height:32px;font-weight:600";
+      const description = document.createElement("p");
+      description.textContent = "Start the secure VS Code backend for this Agent Canvas session. The first launch downloads and verifies the pinned editor package.";
+      description.style.cssText = "margin:12px auto 0;max-width:440px;color:#a3a3a3;font-size:14px;line-height:21px";
+      const statusRow = document.createElement("div");
+      statusRow.style.cssText = "display:flex;align-items:center;justify-content:center;gap:8px;margin:20px 0 24px;font-size:13px;color:#a3a3a3";
+      const statusDot = document.createElement("span");
+      statusDot.setAttribute("aria-hidden", "true");
+      statusDot.style.cssText = `width:8px;height:8px;border-radius:999px;background:${status.state === "unhealthy" ? "#fda4af" : "#737373"}`;
+      const detail = document.createElement("span");
+      detail.textContent = status.detail || `Backend status: ${statusLabel(status.state)}`;
+      statusRow.append(statusDot, detail);
+      panel.append(heading, description, statusRow);
+
+      const field = document.createElement("label");
+      field.style.cssText = "display:flex;flex-direction:column;gap:8px;text-align:left";
+      const fieldLabel = document.createElement("span");
+      fieldLabel.textContent = "Workspace folder";
+      fieldLabel.style.cssText = "font-size:13px;font-weight:500;color:#fafafa";
       const folder = document.createElement("input");
       folder.type = "text";
-      folder.placeholder = "Workspace folder path (optional)";
+      folder.placeholder = "Optional path to open in VS Code";
       folder.value = localStorage.getItem(storageKey) || "";
       folder.setAttribute("aria-label", "Workspace folder path");
-      panel.append(folder);
-      const actions = document.createElement("p");
+      folder.style.cssText = "width:100%;height:42px;padding:0 12px;border:1px solid #525252;border-radius:8px;background:#1a1a1a;color:#fafafa;font:inherit;font-size:14px;box-sizing:border-box;outline:none";
+      const hint = document.createElement("span");
+      hint.textContent = "Leave blank to open the default App workspace.";
+      hint.style.cssText = "font-size:12px;color:#8c8c8c";
+      field.append(fieldLabel, folder, hint);
+      panel.append(field);
+
+      const actions = document.createElement("div");
+      actions.style.cssText = "display:flex;justify-content:center;gap:10px;margin-top:24px;flex-wrap:wrap";
       if (status.state === "missing" || status.state === "stopped" || status.state === "unhealthy") {
         actions.append(button("Prepare and start", async () => {
           const selectedFolder = folder.value.trim();
           if (selectedFolder) localStorage.setItem(storageKey, selectedFolder);
           else localStorage.removeItem(storageKey);
-          actions.replaceChildren(document.createTextNode("Preparing..."));
+          actions.replaceChildren(document.createTextNode("Preparing and verifying VS Code..."));
           try {
             let approval = status;
             if (!approval.revision) approval = await request("GET");
@@ -90,14 +137,15 @@ export function activate(host) {
             render(await request("GET"));
           } catch (error) {
             detail.textContent = `Setup failed: ${error.message}`;
-            actions.replaceChildren(button("Prepare and start", () => render(status)));
+            statusDot.style.background = "#fda4af";
+            actions.replaceChildren(button("Try again", () => render(status), "primary"));
           }
-        }));
+        }, "primary"));
       }
       if (status.state === "ready" || status.state === "starting") {
         actions.append(button("Stop", async () => render(await request("POST", `${BACKEND}/stop`))));
       }
-      actions.append(button("Refresh", async () => render(await request("GET"))));
+      actions.append(button("Refresh status", async () => render(await request("GET"))));
       panel.append(actions);
       shell.append(panel);
     };

package/apps/vscode/scripts/package.mjs

@@ -1,84 +1,30 @@
-import { createHash } from "node:crypto";
-import { readdir, readFile, mkdir, rm, writeFile, chmod, stat } from "node:fs/promises";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
+import { cp, mkdir, readFile, rm } from "node:fs/promises";
 import path from "node:path";
 
-const exec = promisify(execFile);
 const appRoot = path.resolve(new URL("..", import.meta.url).pathname);
 const root = path.resolve(appRoot, "../..");
-if (process.platform !== "linux") throw new Error("VS Code App packaging currently supports Linux build runners only");
-
-/**
- * Force a umask-independent mode set on the staged tree.
- *
- * `cp -a` preserves whatever modes tar materialized, and the build host's umask
- * narrows them (0664/0775 under umask 0002, 0644/0755 under umask 022). Those
- * bits end up in the final archive's tar headers, so the digest — and with it
- * the `sha256` declared in canvas-extension.json — used to vary per build host.
- */
-async function normalizeModes(dir) {
-  for (const entry of await readdir(dir, { withFileTypes: true })) {
-    const target = path.join(dir, entry.name);
-    if (entry.isSymbolicLink()) continue;
-    if (entry.isDirectory()) {
-      await chmod(target, 0o755);
-      await normalizeModes(target);
-    } else if (entry.isFile()) {
-      const { mode } = await stat(target);
-      await chmod(target, mode & 0o111 ? 0o755 : 0o644);
-    }
-  }
-}
 const output = path.resolve(process.env.OUTPUT_DIR ?? path.join(root, "dist"));
-const version = "1.109.5";
-const releases = {
-  "linux-amd64": ["x64", "b433bf4f0227321a7014d8460d10a8f958adc0f45aa79bd889e84e65e8f88363"],
-  "linux-arm64": ["arm64", "36d9c14036489b63de84ebace837fcacf7e60e669a0dc715802c5443684ea4dc"],
-};
-const work = path.join(output, ".download");
 const packageRoot = path.join(output, "apps", "vscode");
-const manifest = JSON.parse(await readFile(path.join(appRoot, "canvas-extension.json"), "utf8"));
-await rm(work, { recursive: true, force: true });
-await rm(packageRoot, { recursive: true, force: true });
-await mkdir(work, { recursive: true });
-await mkdir(path.join(packageRoot, "backend"), { recursive: true });
-for (const [platform, [upstreamArch, expected]] of Object.entries(releases)) {
-  const source = path.join(work, `${platform}.tar.gz`);
-  const archive = `openvscode-server-v${version}-linux-${upstreamArch}.tar.gz`;
-  const url = `https://github.com/gitpod-io/openvscode-server/releases/download/openvscode-server-v${version}/${archive}`;
-  await exec("curl", ["--fail", "--location", "--retry", "3", "--output", source, url]);
-  const actual = createHash("sha256").update(await readFile(source)).digest("hex");
-  if (actual !== expected) throw new Error(`${platform}: upstream checksum mismatch (${actual})`);
-  const unpacked = path.join(work, `${platform}-unpacked`);
-  const normalized = path.join(work, `${platform}-normalized`);
-  await mkdir(unpacked, { recursive: true });
-  await exec("tar", ["-xzf", source, "-C", unpacked]);
-  await mkdir(normalized, { recursive: true });
-  const [top] = await readdir(unpacked);
-  await exec("cp", ["-a", `${path.join(unpacked, top)}/.`, normalized]);
-  await writeFile(path.join(normalized, "bin", "openvscode-bootstrap"), "#!/bin/sh\nset -eu\ndata_dir=\"\"\nfor candidate do data_dir=\"$candidate\"; done\nmkdir -p \"$data_dir\" \"$data_dir/home\" \"$data_dir/workspace\"\nexport HOME=\"$data_dir/home\"\nexec \"$(dirname \"$0\")/openvscode-server\" \"$@\"\n");
-  await exec("chmod", ["0755", path.join(normalized, "bin", "openvscode-bootstrap")]);
-  await normalizeModes(normalized);
-  const destination = path.join(packageRoot, "backend", `openvscode-${platform}.tar.gz`);
-  await exec("tar", ["--sort=name", "--mtime=UTC 1970-01-01", "--owner=0", "--group=0", "--numeric-owner", "-czf", destination, "-C", normalized, "."]);
-  const produced = createHash("sha256").update(await readFile(destination)).digest("hex");
-  const artifact = manifest?.backend?.artifacts?.[platform];
-  if (!artifact?.sha256) {
-    throw new Error(`canvas-extension.json declares no backend.artifacts.${platform}.sha256`);
+const manifest = JSON.parse(
+  await readFile(path.join(appRoot, "canvas-extension.json"), "utf8"),
+);
+
+for (const [platform, artifact] of Object.entries(manifest.backend.artifacts)) {
+  const url = new URL(artifact.url);
+  if (url.protocol !== "https:" || !url.pathname.endsWith(".tar.gz")) {
+    throw new Error(`${platform}: invalid HTTPS artifact URL`);
   }
-  if (path.basename(destination) !== path.basename(artifact.path)) {
-    throw new Error(`${platform}: built ${path.basename(destination)} but canvas-extension.json declares ${artifact.path}`);
+  if (!/^[0-9a-f]{64}$/.test(artifact.sha256)) {
+    throw new Error(`${platform}: invalid SHA-256`);
   }
-  if (produced !== artifact.sha256) {
-    throw new Error(
-      `${platform}: built archive digest ${produced} does not match the sha256 declared for backend.artifacts.${platform} in canvas-extension.json (${artifact.sha256}); update the manifest with the reproducible digest`
-    );
+  if (!Number.isInteger(artifact.strip_components) || artifact.strip_components < 0) {
+    throw new Error(`${platform}: invalid strip_components`);
   }
-  console.log(`${platform}: ${produced}`);
 }
-await exec("cp", [path.join(appRoot, "canvas-extension.json"), path.join(packageRoot, "canvas-extension.json")]);
-await exec("cp", [path.join(appRoot, "extension.js"), path.join(packageRoot, "extension.js")]);
-await exec("cp", [path.join(appRoot, "README.md"), path.join(packageRoot, "README.md")]);
-await rm(work, { recursive: true, force: true });
-console.log(`Wrote ${packageRoot}`);
+
+await rm(packageRoot, { recursive: true, force: true });
+await mkdir(packageRoot, { recursive: true });
+for (const filename of ["canvas-extension.json", "extension.js", "README.md"]) {
+  await cp(path.join(appRoot, filename), path.join(packageRoot, filename));
+}
+console.log(`Wrote source-installable App package to ${packageRoot}`);