@openhands/extensions 0.32.1 → 0.33.0

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.32.1"
+  ".": "0.33.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openhands/extensions",
-  "version": "0.32.1",
+  "version": "0.33.0",
   "description": "Public OpenHands extension catalogs for skills, plugins, integrations, and automation templates.",
   "license": "MIT",
   "type": "module",

package/plugins/vulnerability-remediation/scripts/scan_and_remediate.py

@@ -182,9 +182,9 @@ def create_remediation_prompt(vuln: Vulnerability, repo_name: str) -> str:
 
    ```bash
    # Find ALL dependency files containing the package (excludes dependency/build directories)
-   find . \( -name node_modules -o -name .venv -o -name venv -o -name vendor -o -name .git -o -name __pycache__ -o -name dist -o -name build \) -prune -o -name "pyproject.toml" -exec grep -l "{vuln.package_name}" {} + 2>/dev/null
-   find . \( -name node_modules -o -name .venv -o -name venv -o -name vendor -o -name .git \) -prune -o -name "requirements*.txt" -exec grep -l "{vuln.package_name}" {} + 2>/dev/null
-   find . \( -name node_modules -o -name .venv -o -name venv -o -name vendor -o -name .git \) -prune -o -name "package.json" -exec grep -l "{vuln.package_name}" {} + 2>/dev/null
+   find . \( -name node_modules -o -name .venv -o -name venv -o -name vendor -o -name .git -o -name __pycache__ -o -name dist -o -name build \) -prune -o -name "pyproject.toml" -exec grep -l "{vuln.package_name}" {{}} + 2>/dev/null
+   find . \( -name node_modules -o -name .venv -o -name venv -o -name vendor -o -name .git \) -prune -o -name "requirements*.txt" -exec grep -l "{vuln.package_name}" {{}} + 2>/dev/null
+   find . \( -name node_modules -o -name .venv -o -name venv -o -name vendor -o -name .git \) -prune -o -name "package.json" -exec grep -l "{vuln.package_name}" {{}} + 2>/dev/null
    ```
 
    Update {vuln.package_name} from {vuln.installed_version} to {vuln.fixed_version} in **EVERY** file found.

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "openhands-extensions"
-version = "0.32.1"
+version = "0.33.0"
 description = "OpenHands extensions, plugins, and skills (Python bindings for the integration catalog)"
 requires-python = ">=3.12"
 dependencies = [

package/python/openhands_extensions/_version.py

@@ -18,7 +18,7 @@ from importlib.metadata import PackageNotFoundError, version
 #: Kept in lock-step with pyproject.toml/package.json by the version test.
 #: release-please only rewrites a semver found on the annotated line itself, so
 #: the annotation must stay on the assignment; on its own line it is a no-op.
-_FALLBACK_VERSION = "0.32.1"  # x-release-please-version
+_FALLBACK_VERSION = "0.33.0"  # x-release-please-version
 
 try:
     __version__: str = version("openhands-extensions")

package/skills/index.js

@@ -610,12 +610,12 @@ export const SKILLS_CATALOG = [
   },
   {
     "name": "software-factory",
-    "description": "Set up an OpenHands \"software factory\" on GitHub fast: ask only for the repositories and where tickets live (GitHub issues, Jira or Linear), create a working issue-to-PR and PR-review pipeline from the automation catalog with defaults, show what runs, then let the user stop or extend it one step at a time (tune settings, triage, auto-merge, stale-CI and QA add-ons).",
+    "description": "Set up an OpenHands \"software factory\" on GitHub fast: ask only for the repositories and where tickets live (GitHub issues, Jira or Linear), create a working issue-to-PR and PR-review pipeline from the automation catalog with defaults, show what runs, then let the user stop or extend it one step at a time (tune settings, AGENTS.md maintainer, auto-merge, stale-CI and QA add-ons).",
     "triggers": [
       "/software-factory",
       "software factory"
     ],
-    "content": "# Software Factory\n\nBuild a GitHub software factory from unmodified automation catalog bundles\n(`automations/catalog/<id>/manifest.json`); a Jira or Linear station is created\nby its own skill. This skill adds no automation logic.\n\nTwo phases: **Phase 1** gets a working factory after one question. **Phase 2**\nextends it in short rounds, only as far as the user wants. After Phase 1 and\nafter every round, the **Checkpoint** shows what exists and lets the user stop.\n\nCode lives on GitHub. Tickets can come from GitHub issues (default), Jira or\nLinear: only the issue to PR station changes (see \"Ticket source\"). GitLab and\nBitbucket code hosts are not part of this flow.\n\n## Stations\n\n| Station | Catalog id | Phase | Needs agent profile |\n|---|---|---|---|\n| Issue to PR | `github-issue-to-pr`, or the Jira or Linear station | 1 | yes (GitHub issues only) |\n| PR reviewer | `github-pr-reviewer` | 1 | yes |\n| AGENTS.md maintainer | `github-agents-md-maintainer` | 1 | no |\n| Issue triage | `github-issue-triage`, or `linear-triage-assistant` | add-on | yes (GitHub issues only) |\n| Auto-merge watchdog | `github-delivery-watchdog` | add-on | no |\n| Stale-CI PR closer | `github-stale-ci-pr-closer` | add-on | no |\n| QA changes | `qa-changes` | add-on | no |\n\n## Helper script\n\n`scripts/factory.py` in this skill's directory does every catalog and API step\nand prints one JSON document; it exits non-zero with `{\"error\": ...}` on\nfailure. Its usage is below: do not read its source, and do not load the\n`openhands-automation` skill for Phase 1.\n\nSet `OPENHANDS_HOST` to the **Ingress** URL in `<RUNTIME_SERVICES>` on a local\nAgent Canvas (it serves both `/api/automation` and `/api`; the automation\nbackend URL does not), or to `<HOST>` on OpenHands Cloud. Run every command as:\n\n```bash\nGITHUB_PERSONAL_ACCESS_TOKEN=\"$GITHUB_PERSONAL_ACCESS_TOKEN\" \\\nOPENHANDS_AUTOMATION_API_KEY=\"$OPENHANDS_AUTOMATION_API_KEY\" \\\nOPENHANDS_API_KEY=\"$OPENHANDS_API_KEY\" \\\npython3 <this skill's directory>/scripts/factory.py <command> ...\n```\n\n`$F` below stands for that whole line. Keep the secret names in it: the agent\nserver passes a saved secret into a command only when the command names it.\nThe script reads the token and never prints it.\n\n| Command | Does |\n|---|---|\n| `$F preflight --repos a/b,c/d` | Which stations this deployment supports, the agent profile, the GitHub login, push access per repository. |\n| `$F create --repos a/b --ids ID,ID [--set FIELD=VALUE] [--set ID.FIELD=VALUE]` | Fills each station's form (answers, then derived values, then manifest defaults), uploads the bundle and creates it disabled. `FIELD=VALUE` applies to every listed station with that field. Stations that already exist are reported under `existing`, not recreated. |\n| `$F tune --repos a/b --ids ID,ID [--set FIELD=VALUE] [--set ID.FIELD=VALUE]` | Applies new settings to an existing station by updating it in place. Use this to change a value that is fixed at creation. |\n| `$F verify ID... [--no-wait ID...]` | Dispatches once, enables the ones whose run `COMPLETED` and disables the rest, reporting their `error_detail`. `--no-wait` enables without waiting. |\n| `$F status ID...` | The latest run of each. |\n| `$F prs --repos a/b [--branch-prefix P]` | Open pull requests whose branch starts with `P` (default `openhands/agents-md`, the AGENTS.md maintainer's). |\n| `$F reset-token` | Deletes the saved `GITHUB_PERSONAL_ACCESS_TOKEN` (local Agent Canvas), so `request_secret` opens its form again. |\n\n`create` and `verify` return each automation's `url`, its page in Agent Canvas.\nTrust the script's output: do not open pages in the browser to check them, and\ndo not use the task tracker for this flow.\n\nAdd `--profile NAME` to `preflight` or `create` to use a profile other than the\nactive one.\n\n## Rules\n\n- **Supported stations**: create only those `preflight` reports `ok`; say why\n  the others are skipped.\n- **Derived values** (the script fills them; never ask): every\n  `githubTokenSecret` is `GITHUB_PERSONAL_ACCESS_TOKEN`. The watchdog's\n  `branchPrefix` must equal issue to PR's: when it was changed, pass\n  `--set github-delivery-watchdog.branchPrefix=<same value>`.\n- **Agent profile**: if `preflight` reports a profile error, skip the stations\n  that need one and point the user to the station's catalog card in Agent\n  Canvas (Automations), which has a profile picker.\n- **Token**: never ask for its value in chat, echo it, or put it in a tool\n  argument or file.\n- **Failures**: if `create` fails, its output lists the stations it already\n  created; report them with the error and ask whether to retry or delete them\n  (`DELETE ${OPENHANDS_HOST}/api/automation/v1/{id}`).\n- **Existing stations**: a station `create` reports under `existing` was already\n  set up by an earlier run and was left unchanged. Say so rather than presenting\n  it as new, and change it with `$F tune` if the user wants different settings.\n\n## Phase 1 - Working factory\n\n1. Ask, in one message: \"Which GitHub repositories (`owner/repo`)? Where do\n   tickets live: GitHub issues (default), Jira or Linear?\" Say that everything\n   else uses defaults that can be changed afterwards. If the answer names only\n   repositories, use GitHub issues; do not ask again.\n2. Run `$F preflight --repos <repos>`. Drop repositories without `push`, and\n   say which.\n3. If `github_login` is null, act on `token_error`:\n   - `not_set`, and the `request_secret` tool is available: call it once with\n     `name: \"GITHUB_PERSONAL_ACCESS_TOKEN\"` and a `reason` asking for Contents,\n     Issues, Pull requests and Workflows read and write (classic PAT: `repo`,\n     `workflow`). End your turn, wait for the `[secret-request]` message,\n     then rerun `preflight`.\n   - `rejected`: GitHub refuses the saved token (invalid or expired), and\n     `request_secret` cannot replace it: it answers `saved` at once for a name\n     that exists. Say so in one sentence and ask \"Shall I remove it and open\n     the form for a new one?\" On yes, run `$F reset-token`, then handle it as\n     `not_set`. If `reset-token` fails, tell the user to replace it in\n     Settings -> Secrets and say when done.\n   - `not_set` without the tool: tell the user to add it in Settings ->\n     Secrets and stop.\n4. `$F create --repos <repos> --ids github-pr-reviewer,github-agents-md-maintainer`,\n   adding `github-issue-to-pr` for GitHub issues. For Jira or Linear, also set\n   up the issue to PR station as \"Ticket source\" describes.\n5. `$F verify <reviewer id> [<issue to PR id>] --no-wait <maintainer id>`. The\n   maintainer's run opens one `AGENTS.md` pull request per repository.\n6. Go to the Checkpoint.\n\n## Checkpoint\n\nWrite one short message, in this order:\n\n1. One plain sentence on what runs and how to use it: \"Your factory is running\n   on `<repos>`. Add the `<trigger label>` label to a ticket to get a draft pull\n   request; the reviewer reviews it and you merge it.\" (On Jira, add that the\n   ticket body must name the `owner/repo`.)\n2. The `AGENTS.md` pull requests from `$F prs --repos <repos>`, asking the user\n   to merge them: they give the build agent the repository's build, test and\n   lint commands. One opened before this setup started (`created_at`) is\n   \"still open from an earlier run\", not new; the maintainer works once a week\n   per repository. If there are none yet, say they are on their way.\n3. A small table of the automations, each linked to its `url`:\n\n   | Automation | Schedule | Status |\n   |---|---|---|\n   | [Issue to PR](<url>) | every 15 minutes | on |\n\n   Status is `on`, or `off` with the reason in a few words. No automation ids.\n4. The settings in effect, as a short list (the Tune table's current values).\n   Mention that the reviewer also reviews any open, non-draft, green pull\n   request with no review yet (at most 2 new per scan).\n5. End with only a list of possible next steps, one line each, and nothing\n   after it. Mark the first one not done yet as recommended:\n   - **Try it**: I open a small test issue with the `<trigger label>` label in\n     `<repo>`, only if you say so, and report the pull request.\n   - **Tune**: change a setting from the list above.\n   - **Add a station**: triage, auto-merge watchdog, stale-CI closer (QA only\n     if `preflight` reports it `ok`).\n   - **Stop here**: the factory keeps running as it is.\n\n## Phase 2 - Extend, one round at a time\n\nDo only what the user picked. Ask only the questions for it, in one message,\neach with its current value. Apply, then return to the Checkpoint.\n\n### Tune\n\n| Setting | Default | `--set` |\n|---|---|---|\n| Issue trigger label (GitHub issues) | `openhands` | `github-issue-to-pr.triggerLabel` |\n| Draft or ready pull requests | `draft` | `pullRequestMode` (issue to PR, AGENTS.md maintainer) |\n| Branch prefix (GitHub issues) | `openhands/issue` | `github-issue-to-pr.branchPrefix` (and the watchdog's, if present) |\n| Which pull requests get reviewed | label `openhands-review`, reviewer `all-hands-bot` | `github-pr-reviewer.triggerLabel`, `triggerReviewer` |\n| Review tone: concise, thorough, friendly | `concise` | `reviewTone` |\n| Human reviewers requested after agent approval (two or more logins) | none | `maintainers` |\n| Schedules and timezone | issue to PR `*/15 * * * *`, reviewer `*/5 * * * *`, AGENTS.md maintainer `0 9 * * 1`, add-ons per manifest; `UTC` | `ID.schedule`, `timezone` |\n| Agent profile | active profile | `--profile NAME` |\n\nApply:\n\n- Schedule or timezone only:\n  `PATCH ${OPENHANDS_HOST}/api/automation/v1/{id}` with `{\"trigger\": {...}}`.\n- Jira or Linear station settings: change them as its skill describes.\n- Anything else is fixed at creation: `$F tune --repos <repos> --ids <id>` with\n  the new `--set` values (repeat every earlier non-default value), then\n  `$F verify <id>`. `tune` updates the station in place, so there is no\n  replacement to delete and no template-id collision.\n\n### Add a station\n\nAsk only the question below, then `$F create` it and `$F verify` it.\n\n- **Auto-merge watchdog** (`github-delivery-watchdog`, GitHub issues only,\n  since it merges only branches with the issue to PR prefix): confirm the user\n  wants the agent to merge pull requests itself once review, tests and CI are\n  green.\n- **Stale-CI closer** (`github-stale-ci-pr-closer`): confirm it may warn on,\n  then close, pull requests whose CI keeps failing.\n- **Triage** (`github-issue-triage`): nothing. For Linear, follow the\n  `linear-triage` skill instead; for Jira there is none.\n- **QA changes**: which base branch (default `main`). Offer QA only if\n  `preflight` reports it `ok` and the `openhands-automation` webhook\n  reachability check passes. It has no bundle, so the script cannot create it:\n  create it as the `openhands-automation` skill describes for an\n  event-triggered prompt preset, with its manifest `prompt` and `filter`, one\n  per repository (it takes a single `repository`). It runs only on pull request\n  events, so leave it enabled and skip `verify`.\n\n## Ticket source\n\n- **GitHub issues**: `github-issue-to-pr`, created with the others in Phase 1.\n- **Jira**: follow the `jira-issue-to-pr` skill with `git_provider` `github`\n  and its defaults (label `create-pr`, `*/5 * * * *`). Ask only what it cannot\n  look up (the Jira site if several, or the API-token details when Atlassian\n  Rovo is not connected). Tell the user each ticket body must name its\n  `owner/repo`.\n- **Linear**: follow the `ticket-to-code-change` skill with GitHub as the\n  provider. Ask its questions in one message, proposing the repositories above\n  and `*/15 * * * *` as defaults.\n\nOnce its skill has created the station, run `$F verify <id>` on it.\n\n## Troubleshooting\n\n| Symptom | Cause and fix |\n|---|---|\n| Create returns 422 | A value does not match the manifest `setup` block; fix the field at the path the error names. |\n| Issue to PR fails at push | The token lacks Contents or Workflows write, or does not cover that repository. |\n| Reviewer never reviews | The pull request has neither the trigger label nor a request for the trigger reviewer, and is not green. |\n| Watchdog never merges | Its branch prefix differs from issue to PR's, or the pull request lacks an independent approval or green CI. |",
+    "content": "# Software Factory\n\nBuild a GitHub software factory from unmodified automation catalog bundles\n(`automations/catalog/<id>/manifest.json`); a Jira or Linear station is created\nby its own skill. This skill adds no automation logic.\n\nTwo phases: **Phase 1** gets a working factory after one question. **Phase 2**\nextends it in short rounds, only as far as the user wants. After Phase 1 and\nafter every round, the **Checkpoint** shows what exists and lets the user stop.\n\nCode lives on GitHub. Tickets can come from GitHub issues (default), Jira or\nLinear: only the issue to PR station changes (see \"Ticket source\"). GitLab and\nBitbucket code hosts are not part of this flow.\n\n## Stations\n\n| Station | Catalog id | Phase | Needs agent profile |\n|---|---|---|---|\n| Issue to PR | `github-issue-to-pr`, or the Jira or Linear station | 1 | yes (GitHub issues only) |\n| PR reviewer | `github-pr-reviewer` | 1 | yes |\n| Issue triage | `github-issue-triage`, or `linear-triage-assistant` | 1 | yes (GitHub issues only) |\n| AGENTS.md maintainer | `github-agents-md-maintainer` | add-on | no |\n| Auto-merge watchdog | `github-delivery-watchdog` | add-on | no |\n| Stale-CI PR closer | `github-stale-ci-pr-closer` | add-on | no |\n| QA changes | `qa-changes` | add-on | no |\n\n## Helper script\n\n`scripts/factory.py` in this skill's directory does every catalog and API step\nand prints one JSON document; it exits non-zero with `{\"error\": ...}` on\nfailure. Its usage is below: do not read its source, and do not load the\n`openhands-automation` skill for Phase 1.\n\nSet `OPENHANDS_HOST` to the **Ingress** URL in `<RUNTIME_SERVICES>` on a local\nAgent Canvas (it serves both `/api/automation` and `/api`; the automation\nbackend URL does not), or to `<HOST>` on OpenHands Cloud. Run every command as:\n\n```bash\nGITHUB_PERSONAL_ACCESS_TOKEN=\"$GITHUB_PERSONAL_ACCESS_TOKEN\" \\\nOPENHANDS_AUTOMATION_API_KEY=\"$OPENHANDS_AUTOMATION_API_KEY\" \\\nOPENHANDS_API_KEY=\"$OPENHANDS_API_KEY\" \\\npython3 <this skill's directory>/scripts/factory.py <command> ...\n```\n\n`$F` below stands for that whole line. Keep the secret names in it: the agent\nserver passes a saved secret into a command only when the command names it.\nThe script reads the token and never prints it.\n\n| Command | Does |\n|---|---|\n| `$F preflight --repos a/b,c/d` | Which stations this deployment supports, the agent profile, the GitHub login, push access per repository. |\n| `$F create --repos a/b --ids ID,ID [--set FIELD=VALUE] [--set ID.FIELD=VALUE]` | Fills each station's form (answers, then derived values, then manifest defaults), uploads the bundle and creates it disabled. `FIELD=VALUE` applies to every listed station with that field. Stations that already exist are reported under `existing`, not recreated. |\n| `$F tune --repos a/b --ids ID,ID [--set FIELD=VALUE] [--set ID.FIELD=VALUE]` | Applies new settings to an existing station by updating it in place. Use this to change a value that is fixed at creation. |\n| `$F verify ID... [--no-wait ID...]` | Dispatches once, enables the ones whose run `COMPLETED` and disables the rest, reporting their `error_detail`. `--no-wait` enables without waiting. |\n| `$F status ID...` | The latest run of each. |\n| `$F prs --repos a/b [--branch-prefix P]` | Open pull requests whose branch starts with `P` (default `openhands/agents-md`, the AGENTS.md maintainer's). |\n| `$F reset-token` | Deletes the saved `GITHUB_PERSONAL_ACCESS_TOKEN` (local Agent Canvas), so `request_secret` opens its form again. |\n\n`create` and `verify` return each automation's `url`, its page in Agent Canvas.\nTrust the script's output: do not open pages in the browser to check them, and\ndo not use the task tracker for this flow.\n\nAdd `--profile NAME` to `preflight` or `create` to use a profile other than the\nactive one.\n\n## Rules\n\n- **Supported stations**: create only those `preflight` reports `ok`; say why\n  the others are skipped.\n- **Derived values** (the script fills them; never ask): every\n  `githubTokenSecret` is `GITHUB_PERSONAL_ACCESS_TOKEN`. The watchdog's\n  `branchPrefix` must equal issue to PR's: when it was changed, pass\n  `--set github-delivery-watchdog.branchPrefix=<same value>`.\n- **Agent profile**: if `preflight` reports a profile error, skip the stations\n  that need one and point the user to the station's catalog card in Agent\n  Canvas (Automations), which has a profile picker.\n- **Token**: never ask for its value in chat, echo it, or put it in a tool\n  argument or file.\n- **Failures**: if `create` fails, its output lists the stations it already\n  created; report them with the error and ask whether to retry or delete them\n  (`DELETE ${OPENHANDS_HOST}/api/automation/v1/{id}`).\n- **Existing stations**: a station `create` reports under `existing` was already\n  set up by an earlier run and was left unchanged. Say so rather than presenting\n  it as new, and change it with `$F tune` if the user wants different settings.\n\n## Phase 1 - Working factory\n\n1. Ask, in one message: \"Which GitHub repositories (`owner/repo`)? Where do\n   tickets live: GitHub issues (default), Jira or Linear?\" Say that everything\n   else uses defaults that can be changed afterwards. If the answer names only\n   repositories, use GitHub issues; do not ask again.\n2. Run `$F preflight --repos <repos>`. Drop repositories without `push`, and\n   say which.\n3. If `github_login` is null, act on `token_error`:\n   - `not_set`, and the `request_secret` tool is available: call it once with\n     `name: \"GITHUB_PERSONAL_ACCESS_TOKEN\"` and a `reason` asking for Contents,\n     Issues, Pull requests and Workflows read and write (classic PAT: `repo`,\n     `workflow`). End your turn, wait for the `[secret-request]` message,\n     then rerun `preflight`.\n   - `rejected`: GitHub refuses the saved token (invalid or expired), and\n     `request_secret` cannot replace it: it answers `saved` at once for a name\n     that exists. Say so in one sentence and ask \"Shall I remove it and open\n     the form for a new one?\" On yes, run `$F reset-token`, then handle it as\n     `not_set`. If `reset-token` fails, tell the user to replace it in\n     Settings -> Secrets and say when done.\n   - `not_set` without the tool: tell the user to add it in Settings ->\n     Secrets and stop.\n4. `$F create --repos <repos> --ids github-pr-reviewer`, adding\n   `github-issue-to-pr,github-issue-triage` for GitHub issues. For Jira or\n   Linear, also set up the issue to PR station as \"Ticket source\" describes;\n   for Linear, set up triage with the `linear-triage` skill (Jira has none).\n5. `$F verify <reviewer id> [<issue to PR id>] [<triage id>]`.\n6. Go to the Checkpoint.\n\n## Checkpoint\n\nWrite one short message, in this order:\n\n1. One plain sentence on what runs and how to use it: \"Your factory is running\n   on `<repos>`. Add the `<trigger label>` label to a ticket to get a draft pull\n   request; the reviewer reviews it and you merge it.\" (On Jira, add that the\n   ticket body must name the `owner/repo`.)\n2. If the AGENTS.md maintainer was added, the `AGENTS.md` pull requests from\n   `$F prs --repos <repos>`, asking the user to merge them: they give the build\n   agent the repository's build, test and lint commands. One opened before\n   this setup started (`created_at`) is \"still open from an earlier run\", not\n   new; the maintainer works once a week per repository. If there are none\n   yet, say they are on their way.\n3. A small table of the automations, each linked to its `url`:\n\n   | Automation | Schedule | Status |\n   |---|---|---|\n   | [Issue to PR](<url>) | every 15 minutes | on |\n\n   Status is `on`, or `off` with the reason in a few words. No automation ids.\n4. The settings in effect, as a short list (the Tune table's current values).\n   Mention that the reviewer also reviews any open, non-draft, green pull\n   request with no review yet (at most 2 new per scan).\n5. End with only a list of possible next steps, one line each, and nothing\n   after it. Mark the first one not done yet as recommended:\n   - **Try it**: I open a small test issue with the `<trigger label>` label in\n     `<repo>`, only if you say so, and report the pull request.\n   - **Tune**: change a setting from the list above.\n   - **Add a station**: AGENTS.md maintainer, auto-merge watchdog, stale-CI closer (QA only\n     if `preflight` reports it `ok`).\n   - **Stop here**: the factory keeps running as it is.\n\n## Phase 2 - Extend, one round at a time\n\nDo only what the user picked. Ask only the questions for it, in one message,\neach with its current value. Apply, then return to the Checkpoint.\n\n### Tune\n\n| Setting | Default | `--set` |\n|---|---|---|\n| Issue trigger label (GitHub issues) | `openhands` | `github-issue-to-pr.triggerLabel` |\n| Draft or ready pull requests | `draft` | `pullRequestMode` (issue to PR, AGENTS.md maintainer) |\n| Branch prefix (GitHub issues) | `openhands/issue` | `github-issue-to-pr.branchPrefix` (and the watchdog's, if present) |\n| Which pull requests get reviewed | label `openhands-review`, reviewer `all-hands-bot` | `github-pr-reviewer.triggerLabel`, `triggerReviewer` |\n| Review tone: concise, thorough, friendly | `concise` | `reviewTone` |\n| Human reviewers requested after agent approval (two or more logins) | none | `maintainers` |\n| Schedules and timezone | issue to PR `*/15 * * * *`, reviewer `*/5 * * * *`, triage `*/5 * * * *`, add-ons per manifest; `UTC` | `ID.schedule`, `timezone` |\n| Agent profile | active profile | `--profile NAME` |\n\nApply:\n\n- Schedule or timezone only:\n  `PATCH ${OPENHANDS_HOST}/api/automation/v1/{id}` with `{\"trigger\": {...}}`.\n- Jira or Linear station settings: change them as its skill describes.\n- Anything else is fixed at creation: `$F tune --repos <repos> --ids <id>` with\n  the new `--set` values (repeat every earlier non-default value), then\n  `$F verify <id>`. `tune` updates the station in place, so there is no\n  replacement to delete and no template-id collision.\n\n### Add a station\n\nAsk only the question below, then `$F create` it and `$F verify` it.\n\n- **Auto-merge watchdog** (`github-delivery-watchdog`, GitHub issues only,\n  since it merges only branches with the issue to PR prefix): confirm the user\n  wants the agent to merge pull requests itself once review, tests and CI are\n  green.\n- **Stale-CI closer** (`github-stale-ci-pr-closer`): confirm it may warn on,\n  then close, pull requests whose CI keeps failing.\n- **AGENTS.md maintainer** (`github-agents-md-maintainer`): nothing. Verify it\n  with `--no-wait`; its run opens one `AGENTS.md` pull request per repository.\n- **QA changes**: which base branch (default `main`). Offer QA only if\n  `preflight` reports it `ok` and the `openhands-automation` webhook\n  reachability check passes. It has no bundle, so the script cannot create it:\n  create it as the `openhands-automation` skill describes for an\n  event-triggered prompt preset, with its manifest `prompt` and `filter`, one\n  per repository (it takes a single `repository`). It runs only on pull request\n  events, so leave it enabled and skip `verify`.\n\n## Ticket source\n\n- **GitHub issues**: `github-issue-to-pr`, created with the others in Phase 1.\n- **Jira**: follow the `jira-issue-to-pr` skill with `git_provider` `github`\n  and its defaults (label `create-pr`, `*/5 * * * *`). Ask only what it cannot\n  look up (the Jira site if several, or the API-token details when Atlassian\n  Rovo is not connected). Tell the user each ticket body must name its\n  `owner/repo`.\n- **Linear**: follow the `ticket-to-code-change` skill with GitHub as the\n  provider. Ask its questions in one message, proposing the repositories above\n  and `*/15 * * * *` as defaults.\n\nOnce its skill has created the station, run `$F verify <id>` on it.\n\n## Troubleshooting\n\n| Symptom | Cause and fix |\n|---|---|\n| Create returns 422 | A value does not match the manifest `setup` block; fix the field at the path the error names. |\n| Issue to PR fails at push | The token lacks Contents or Workflows write, or does not cover that repository. |\n| Reviewer never reviews | The pull request has neither the trigger label nor a request for the trigger reviewer, and is not green. |\n| Watchdog never merges | Its branch prefix differs from issue to PR's, or the pull request lacks an independent approval or green CI. |",
     "category": "automations",
     "defaultEnabled": true
   },

package/skills/software-factory/README.md

@@ -18,8 +18,8 @@ This skill is activated by:
 |---|---|---|
 | Issue to PR | `github-issue-to-pr`, or the Jira or Linear station | 1 |
 | PR reviewer | `github-pr-reviewer` | 1 |
-| AGENTS.md maintainer | `github-agents-md-maintainer` | 1 |
-| Issue triage | `github-issue-triage` | add-on |
+| Issue triage | `github-issue-triage` | 1 |
+| AGENTS.md maintainer | `github-agents-md-maintainer` | add-on |
 | Auto-merge watchdog | `github-delivery-watchdog` | add-on |
 | Stale-CI PR closer | `github-stale-ci-pr-closer` | add-on |
 | QA changes | `qa-changes` | add-on (webhooks only) |
@@ -36,9 +36,8 @@ or Linear issue to PR station is created by its own skill instead.
 1. **Phase 1**: verify `GITHUB_PERSONAL_ACCESS_TOKEN` (asked for with the
    `request_secret` tool if missing, never in chat), ask for the repositories
    and the ticket source (GitHub issues, Jira or Linear),
-   create the three Phase 1 stations with defaults, smoke-run issue to PR and
-   the reviewer, and enable those that pass. The AGENTS.md maintainer is
-   enabled at once and opens an `AGENTS.md` pull request per repository.
+   create the three Phase 1 stations with defaults, smoke-run them, and enable
+   those that pass.
 2. **Checkpoint**: show the stations, their settings and how to use the
    factory. The user can stop here or pick a next step: try it with a test
    issue, tune settings, or add a station.

package/skills/software-factory/SKILL.md

@@ -4,8 +4,8 @@ description: >
   Set up an OpenHands "software factory" on GitHub fast: ask only for the
   repositories and where tickets live (GitHub issues, Jira or Linear), create a working issue-to-PR and PR-review pipeline from the
   automation catalog with defaults, show what runs, then let the user stop or
-  extend it one step at a time (tune settings, triage, auto-merge, stale-CI and
-  QA add-ons).
+  extend it one step at a time (tune settings, AGENTS.md maintainer,
+  auto-merge, stale-CI and QA add-ons).
 triggers:
   - /software-factory
   - software factory
@@ -31,8 +31,8 @@ Bitbucket code hosts are not part of this flow.
 |---|---|---|---|
 | Issue to PR | `github-issue-to-pr`, or the Jira or Linear station | 1 | yes (GitHub issues only) |
 | PR reviewer | `github-pr-reviewer` | 1 | yes |
-| AGENTS.md maintainer | `github-agents-md-maintainer` | 1 | no |
-| Issue triage | `github-issue-triage`, or `linear-triage-assistant` | add-on | yes (GitHub issues only) |
+| Issue triage | `github-issue-triage`, or `linear-triage-assistant` | 1 | yes (GitHub issues only) |
+| AGENTS.md maintainer | `github-agents-md-maintainer` | add-on | no |
 | Auto-merge watchdog | `github-delivery-watchdog` | add-on | no |
 | Stale-CI PR closer | `github-stale-ci-pr-closer` | add-on | no |
 | QA changes | `qa-changes` | add-on | no |
@@ -118,11 +118,11 @@ active one.
      Settings -> Secrets and say when done.
    - `not_set` without the tool: tell the user to add it in Settings ->
      Secrets and stop.
-4. `$F create --repos <repos> --ids github-pr-reviewer,github-agents-md-maintainer`,
-   adding `github-issue-to-pr` for GitHub issues. For Jira or Linear, also set
-   up the issue to PR station as "Ticket source" describes.
-5. `$F verify <reviewer id> [<issue to PR id>] --no-wait <maintainer id>`. The
-   maintainer's run opens one `AGENTS.md` pull request per repository.
+4. `$F create --repos <repos> --ids github-pr-reviewer`, adding
+   `github-issue-to-pr,github-issue-triage` for GitHub issues. For Jira or
+   Linear, also set up the issue to PR station as "Ticket source" describes;
+   for Linear, set up triage with the `linear-triage` skill (Jira has none).
+5. `$F verify <reviewer id> [<issue to PR id>] [<triage id>]`.
 6. Go to the Checkpoint.
 
 ## Checkpoint
@@ -133,11 +133,12 @@ Write one short message, in this order:
    on `<repos>`. Add the `<trigger label>` label to a ticket to get a draft pull
    request; the reviewer reviews it and you merge it." (On Jira, add that the
    ticket body must name the `owner/repo`.)
-2. The `AGENTS.md` pull requests from `$F prs --repos <repos>`, asking the user
-   to merge them: they give the build agent the repository's build, test and
-   lint commands. One opened before this setup started (`created_at`) is
-   "still open from an earlier run", not new; the maintainer works once a week
-   per repository. If there are none yet, say they are on their way.
+2. If the AGENTS.md maintainer was added, the `AGENTS.md` pull requests from
+   `$F prs --repos <repos>`, asking the user to merge them: they give the build
+   agent the repository's build, test and lint commands. One opened before
+   this setup started (`created_at`) is "still open from an earlier run", not
+   new; the maintainer works once a week per repository. If there are none
+   yet, say they are on their way.
 3. A small table of the automations, each linked to its `url`:
 
    | Automation | Schedule | Status |
@@ -153,7 +154,7 @@ Write one short message, in this order:
    - **Try it**: I open a small test issue with the `<trigger label>` label in
      `<repo>`, only if you say so, and report the pull request.
    - **Tune**: change a setting from the list above.
-   - **Add a station**: triage, auto-merge watchdog, stale-CI closer (QA only
+   - **Add a station**: AGENTS.md maintainer, auto-merge watchdog, stale-CI closer (QA only
      if `preflight` reports it `ok`).
    - **Stop here**: the factory keeps running as it is.
 
@@ -172,7 +173,7 @@ each with its current value. Apply, then return to the Checkpoint.
 | Which pull requests get reviewed | label `openhands-review`, reviewer `all-hands-bot` | `github-pr-reviewer.triggerLabel`, `triggerReviewer` |
 | Review tone: concise, thorough, friendly | `concise` | `reviewTone` |
 | Human reviewers requested after agent approval (two or more logins) | none | `maintainers` |
-| Schedules and timezone | issue to PR `*/15 * * * *`, reviewer `*/5 * * * *`, AGENTS.md maintainer `0 9 * * 1`, add-ons per manifest; `UTC` | `ID.schedule`, `timezone` |
+| Schedules and timezone | issue to PR `*/15 * * * *`, reviewer `*/5 * * * *`, triage `*/5 * * * *`, add-ons per manifest; `UTC` | `ID.schedule`, `timezone` |
 | Agent profile | active profile | `--profile NAME` |
 
 Apply:
@@ -195,8 +196,8 @@ Ask only the question below, then `$F create` it and `$F verify` it.
   green.
 - **Stale-CI closer** (`github-stale-ci-pr-closer`): confirm it may warn on,
   then close, pull requests whose CI keeps failing.
-- **Triage** (`github-issue-triage`): nothing. For Linear, follow the
-  `linear-triage` skill instead; for Jira there is none.
+- **AGENTS.md maintainer** (`github-agents-md-maintainer`): nothing. Verify it
+  with `--no-wait`; its run opens one `AGENTS.md` pull request per repository.
 - **QA changes**: which base branch (default `main`). Offer QA only if
   `preflight` reports it `ok` and the `openhands-automation` webhook
   reachability check passes. It has no bundle, so the script cannot create it:

package/skills/software-factory/commands/software-factory.md

@@ -1,6 +1,6 @@
 ---
 # auto-generated by sync_extensions.py
-description: Set up an OpenHands "software factory" on GitHub fast: ask only for the repositories and where tickets live (GitHub issues, Jira or Linear), create a working issue-to-PR and PR-review pipeline from the automation catalog with defaults, show what runs, then let the user stop or extend it one step at a time (tune settings, triage, auto-merge, stale-CI and QA add-ons).
+description: Set up an OpenHands "software factory" on GitHub fast: ask only for the repositories and where tickets live (GitHub issues, Jira or Linear), create a working issue-to-PR and PR-review pipeline from the automation catalog with defaults, show what runs, then let the user stop or extend it one step at a time (tune settings, AGENTS.md maintainer, auto-merge, stale-CI and QA add-ons).
 ---
 
 Read and follow the complete instructions in the SKILL.md file located in this skill's directory.