@openhands/extensions 0.28.0 → 0.30.0

package/skills/github-pr-reviewer/tests/test_main.py

@@ -255,7 +255,7 @@ class TestState(_CheckoutTestCase):
 # ── Review verification ────────────────────────────────────────────────────────
 
 
-class TestMatchingReviewExists(unittest.TestCase):
+class TestPublishedReviews(unittest.TestCase):
     def setUp(self):
         self._login = main._AUTH_LOGIN
         main._AUTH_LOGIN = "review-bot"
@@ -265,10 +265,10 @@ class TestMatchingReviewExists(unittest.TestCase):
 
     def _exists(self, reviews):
         with patch.object(main, "_github_paginate", return_value=reviews):
-            return main._matching_review_exists("token", "owner/repo", 7, "abc123")
+            return bool(main._published_reviews("token", "owner/repo", 7, "abc123"))
 
     def test_true_for_our_review_at_this_commit(self):
-        self.assertTrue(self._exists([{"user": {"login": "Review-Bot"}, "commit_id": "abc123"}]))
+        self.assertTrue(self._exists([{"user": {"login": "Review-Bot"}, "commit_id": "abc123", "state": "COMMENTED"}]))
 
     def test_false_for_someone_elses_review(self):
         self.assertFalse(self._exists([{"user": {"login": "human"}, "commit_id": "abc123"}]))
@@ -276,9 +276,10 @@ class TestMatchingReviewExists(unittest.TestCase):
     def test_false_for_our_review_at_another_commit(self):
         self.assertFalse(self._exists([{"user": {"login": "review-bot"}, "commit_id": "older"}]))
 
-    def test_false_when_the_listing_fails(self):
+    def test_listing_failure_is_reported_to_the_caller(self):
         with patch.object(main, "_github_paginate", side_effect=RuntimeError("boom")):
-            self.assertFalse(main._matching_review_exists("token", "owner/repo", 7, "abc123"))
+            with self.assertRaises(RuntimeError):
+                main._published_reviews("token", "owner/repo", 7, "abc123")
 
 
 # ── Claiming a label event before the review starts ────────────────────────────
@@ -304,6 +305,11 @@ class TestClaimBeforeReview(_CheckoutTestCase):
         create = create or (lambda *a, **k: "conv-1")
         with (
             patch.object(main, "_prepare_repository", side_effect=prepare),
+            patch.object(
+                main,
+                "_get_agent_dict",
+                return_value={"kind": "Agent", "llm": {"model": "review-model"}},
+            ),
             patch.object(main, "create_conversation", side_effect=create),
             patch.object(main, "_post_github_comment"),
         ):
@@ -332,6 +338,8 @@ class TestClaimBeforeReview(_CheckoutTestCase):
         rec = self.reviews[main._review_key(7, 4242)]
         self.assertEqual(rec["status"], "active")
         self.assertEqual(rec["conversation_id"], "conv-1")
+        self.assertEqual(rec["llm_profile"], "default")
+        self.assertEqual(rec["llm_model"], "review-model")
         self.assertEqual(self.snapshots[-1][main._review_key(7, 4242)]["status"], "active")
 
     def test_a_failed_start_releases_the_claim_so_the_next_poll_retries(self):
@@ -521,6 +529,9 @@ class TestRepoReviewGuide(unittest.TestCase):
         self.assertIn("AGENTS.md", prompt)
         self.assertIn("CONTRIBUTING.md", prompt)
         self.assertIn("nested `AGENTS.md`", prompt)
+        self.assertIn("supported dependency version", prompt)
+        self.assertIn("custom-codereview-guide.md", prompt)
+        self.assertIn("Never end with APPROVED", prompt)
 
     def test_prompt_uses_native_approval_for_a_clean_review(self):
         prompt = main._build_review_prompt(
@@ -631,6 +642,63 @@ class TestRepoReviewGuide(unittest.TestCase):
         self.assertIn("move repositories, close, or receive a maintainer decision", prompt)
 
 
+class TestLlmProvenance(unittest.TestCase):
+    def test_review_prompt_names_its_conversation_marker(self):
+        prompt = main._build_review_prompt(
+            "owner/repo",
+            TestRepoReviewGuide()._pr(),
+            "0123456789abcdef",
+            {"id": "1", "created_at": "t"},
+            workspace_instructions="Check out the exact PR head before reviewing.",
+            github_token_secret="FACTORY_GITHUB_REVIEWER_TOKEN",
+            conversation_id="conv-1",
+        )
+
+        # The agent copies the marker; the script, not the agent, appends the
+        # provenance footer to the review that carries it.
+        self.assertIn("`<!-- openhands-review-run: conv-1 -->`", prompt)
+        self.assertIn("do not write that footer yourself", prompt)
+        self.assertNotIn("LLM profile:", prompt)
+        self.assertIn("Check out the exact PR head before reviewing.", prompt)
+        self.assertIn("FACTORY_GITHUB_REVIEWER_TOKEN", prompt)
+        self.assertNotIn("The workspace is already the repository root", prompt)
+
+    def test_fallback_comment_includes_llm_provenance(self):
+        rec = {
+            "conversation_id": "conv-1",
+            "pr_number": 42,
+            "head_sha": "0123456789abcdef",
+            "last_activity": 0.0,
+            "llm_profile": "review-profile",
+            "llm_model": "anthropic/claude-sonnet-4-6",
+        }
+        current_pr = {42: {"head": {"sha": "0123456789abcdef"}}}
+
+        with (
+            patch.object(main.time, "time", return_value=100.0),
+            patch.object(main, "conversation_status", return_value="finished"),
+            patch.object(main, "conversation_final_response", return_value="Review body"),
+            patch.object(main, "_published_reviews", return_value=[]),
+            patch.object(main, "_post_github_comment") as post_comment,
+        ):
+            main._check_conversation_completion(
+                rec,
+                current_pr,
+                "token",
+                "http://agent",
+                "key",
+                "owner/repo",
+            )
+
+        body = post_comment.call_args.args[3]
+        self.assertIn("Review body", body)
+        self.assertIn(
+            "LLM profile: `review-profile` · Model: `anthropic/claude-sonnet-4-6`",
+            body,
+        )
+
+
+
 class TestNormalizeRepo(unittest.TestCase):
     """A repository is written down in more than one way, and every API path in
     this script is built from owner/repo."""

package/skills/gitlab-issue-to-mr/README.md

@@ -62,8 +62,11 @@ OpenHands API in a sandbox of its own, which changes three things:
 - A conversation that ends without a merge request is reported on the issue. The
   script cannot finish the work, because it has no copy of it.
 
-A user with no `GITLAB_TOKEN` secret is served the token of their connected
-GitLab integration instead.
+A GitLab token is used whenever there is one: a `GITLAB_TOKEN` secret, or else the
+token of the user's GitLab sign-in or connected integration. Without a token, a
+connected GitLab MCP server is used directly, by the script and by the
+conversation. Calling GitLab MCP directly needs GitLab 19.4 or later, because the
+tools it uses arrived in 19.3 and 19.4, while a token works with any GitLab.
 
 ## Two setup paths
 
@@ -76,7 +79,11 @@ tarball the automation service runs on a cron, not a prompt handed to an agent.
 
 ## Prerequisites
 
-Set `GITLAB_TOKEN` in OpenHands Settings -> Secrets. It needs the `api` scope and
+On OpenHands Cloud and Enterprise, connect GitLab under Settings - its MCP server
+or the built-in integration, which signing in with GitLab connects - and no secret
+is needed. Calling GitLab MCP directly needs GitLab 19.4 or later, so on an older
+GitLab use the integration. Otherwise set
+`GITLAB_TOKEN` in OpenHands Settings -> Secrets. It needs the `api` scope and
 at least the **Developer** role on every watched project - Developer is the
 lowest role that can push a branch and open a merge request. Leave the configured
 branch prefix out of any protected-branch rule, or the push is rejected.

package/skills/gitlab-issue-to-mr/SKILL.md

@@ -28,6 +28,9 @@ prompt goes stale between dispatch and the moment the agent reads it.
 That needs read access, so the conversation is handed one secret, `GITLAB_TOKEN`.
 `AGENT_SECRET_NAMES` stays an allow-list: the rest of the deployment's secret
 store is not reachable from a conversation whose instructions came from an issue.
+On OpenHands Cloud and Enterprise the conversation runs with the user's own
+settings instead: the connected GitLab integration's token, or the tools of the
+connected GitLab MCP server.
 
 The deployment's MCP servers are forwarded whole, matching `github-pr-reviewer`,
 so a connected GitLab server gives the agent typed tools rather than curl. What
@@ -46,9 +49,24 @@ a command that mentions it, and masks it in the output.
 
 ## Prerequisites
 
-### Required secret
+### GitLab access
 
-Verify that the following secret is set in **OpenHands Settings -> Secrets**:
+On OpenHands Cloud and Enterprise, no secret is needed. A connected GitLab MCP
+server (Settings -> MCP) is used directly, by the poller and by the conversations
+it starts; a connected GitLab integration (Settings -> Integrations, connected by
+signing in with GitLab) serves both with its token. With only the MCP server, the conversation commits through its
+tools and reads a private project through them rather than cloning it.
+
+Calling GitLab MCP directly needs GitLab 19.4 or later, where the branch,
+commit, repository and work item tools this uses first appear. A token works with
+any GitLab, so whenever there is one - the token of the user's GitLab sign-in or
+connected integration, or a `GITLAB_TOKEN` secret - the poller and its
+conversations use it rather than the MCP server. On an older GitLab, sign in with
+GitLab or connect it under Settings -> Integrations; a `GITLAB_TOKEN` secret is
+only needed when neither is possible.
+
+On a local Agent Canvas, or when neither is connected, verify that the following
+secret is set in **OpenHands Settings -> Secrets**:
 
 | Secret name | Token type | Minimum requirements |
 |---|---|---|
@@ -86,9 +104,21 @@ If the token is missing or invalid, inform the user and stop.
 
 Follow these steps in order.
 
-### Step 1 - Verify `GITLAB_TOKEN`
-
-Run the `curl` check above, against the user's instance if it is not
+### Step 1 - Verify GitLab access
+
+On OpenHands Cloud and Enterprise, read `GET ${OPENHANDS_HOST}/api/v1/settings`
+first. `gitlab` in `provider_tokens_set` means the user signed in with GitLab or
+connected the integration, and its token is used, with any GitLab version: skip the
+token check and go to Step 2. Otherwise, an entry in `agent_settings.mcp_config`
+whose `url` is the instance's `/api/v4/mcp` means the poller uses that server: put
+its key in `gitlab_mcp_server`, or leave it out and the run finds the server itself.
+Call its `get_mcp_server_version` tool, and on 19.4 or later skip the token check
+and go to Step 2. Calling GitLab MCP directly needs 19.4 or later, so on an older
+GitLab tell the user that and ask them to sign in with GitLab or connect it under
+Settings -> Integrations. Only if they can do neither, ask for a `GITLAB_TOKEN`
+secret and run the token check below.
+
+Otherwise run the `curl` check above, against the user's instance if it is not
 `gitlab.com`.
 
 - If absent: *"GITLAB_TOKEN is not set. Please add it in OpenHands Settings ->
@@ -207,8 +237,8 @@ out of these conversations.
 
 ### Step 9 - Generate the automation script
 
-Read `scripts/main.py` from this skill's directory. Apply exactly six constant
-substitutions near the top of the file:
+Read `scripts/main.py` from this skill's directory. Apply the constant
+substitutions below near the top of the file:
 
 > The script also reads a `config.json` shipped beside it, if there is one, over
 > these constants. That is how the catalog entry
@@ -223,6 +253,7 @@ substitutions near the top of the file:
 | `BRANCH_PREFIX = "openhands/issue"` | `BRANCH_PREFIX = "{branch_prefix}"` |
 | `DRAFT_MERGE_REQUEST = True` | `DRAFT_MERGE_REQUEST = {True or False}` |
 | `GITLAB_API_URL = "https://gitlab.com/api/v4"` | `GITLAB_API_URL = "{gitlab_api_url}"` |
+| `GITLAB_MCP_SERVER_NAME = ""` | `GITLAB_MCP_SERVER_NAME = "{settings key}"` - only on OpenHands Cloud and Enterprise, and only when the user named a connected GitLab MCP server in Step 1; left empty, a cloud run finds the server itself |
 | `AGENT_SECRET_NAMES: list[str] = ["GITLAB_TOKEN"]` | `AGENT_SECRET_NAMES: list[str] = ["{name}", ...]` |
 
 Leave `MAX_NEW_PER_RUN` and `DEFAULT_OPENHANDS_URL` alone unless the user asks
@@ -320,7 +351,9 @@ Tell the user:
 > the label - that opens a second branch and merge request.
 >
 > The agent runs without a checkout credential; the automation pushes the branch
-> and opens the merge request once the agent has stopped.
+> and opens the merge request once the agent has stopped. On OpenHands Cloud and
+> Enterprise the agent pushes and opens the merge request itself, and the
+> automation reports on the issue when none appears.
 
 ---
 
@@ -409,7 +442,8 @@ The completion callback fires once for the whole run.
 | `git is not available in the automation runtime` | The runtime image has no git | Use a runtime image that ships git; the script clones, commits, and pushes with it |
 | Issue commented "did not change any code" | The agent judged the issue too ambiguous, or made no edits | Read its answer in the comment, add the missing detail to the issue, then re-apply the label |
 | Same issue not picked up again after new comments | Its label event was already processed | Remove and re-apply the trigger label |
-| Agent reports it cannot push or open an MR | By design - it has no push credentials in `origin` | No action; the automation pushes and opens the merge request after the agent stops |
+| Agent reports it cannot push or open an MR | By design on a local run - it has no push credentials in `origin`. On Cloud it pushes with the connected integration, or commits through the GitLab MCP tools | No action locally; the automation pushes and opens the merge request after the agent stops |
 | `Warning: could not fetch MCP config` in run logs | The settings endpoint was unreachable | Non-fatal; the agent falls back to the REST calls in the prompt |
+| A GitLab MCP tool call fails in the run log, for example on `get_project` | The run found no GitLab token, and the connected GitLab is older than 19.4, which lacks the tools the poller calls | Sign in with GitLab or connect it under Settings -> Integrations, or add a `GITLAB_TOKEN` secret; any GitLab token is used instead of the MCP server. Or upgrade GitLab |
 | A backlog of labelled issues starts slowly | `MAX_NEW_PER_RUN` caps how many conversations one poll starts | Wait for the next polls, or raise the cap in the script |
 | Clones remain under `issue-to-mr/` | Their conversations had not stopped yet | They are removed by a later poll once the conversation is terminal |

package/skills/gitlab-issue-to-mr/references/state-schema.md

@@ -64,6 +64,10 @@ Key: `"{issue_iid}:label:{label_event_id}"`. This makes the latest GitLab
 resource label event with `action: "add"` the idempotency key. Re-applying the
 trigger label creates a new event and therefore a new task, on a new branch.
 
+When GitLab is reached through a connected MCP server, the event is the system
+note that recorded the label being added (`first` for a work item without one),
+so switching between the token and the MCP server can queue an issue once more.
+
 Value: **TaskRecord**
 
 ```jsonc