openhands-extensions 0.23.0__tar.gz → 0.24.0__tar.gz

{openhands_extensions-0.23.0 → openhands_extensions-0.24.0}/.agents/skills/custom-codereview-guide.md

@@ -12,18 +12,20 @@ current head when it has no material correctness, security, compatibility, or
 acceptance-criterion defect. Comment only on concrete failures; do not withhold
 approval for optional refactors, tone, style, or speculative improvements.
 
-## Repository ownership and scope
-
-This repository owns reusable skills, plugins, automation bundles, and integration
-catalogs. Agent Server behavior, endpoints, and browser client code belong in
-`OpenHands/software-agent-sdk`; Canvas UI belongs in `OpenHands/OpenHands`; and
-scheduling, dispatch, run history, and sandbox lifecycle belong in
-`OpenHands/automation`.
-
-A content PR should remain focused on one extension or one shared mechanism that
-multiple extensions actually use. Flag unrelated edits to another skill, plugin,
-or automation. Shared runtime machinery belongs in the owning product repository,
-not copied into extension content.
+## Repository scope
+
+This repository owns reusable extensions: skills, plugins, and automation
+bundles that use existing public host and runtime interfaces. Out of scope here,
+because another repository owns the contract or machinery:
+
+- SDK, agent-server, and client contracts — `OpenHands/software-agent-sdk`;
+- generic automation scheduling, state, dispatch, and profile machinery —
+  `OpenHands/automation`;
+- Canvas product and UI integration — `OpenHands/OpenHands`.
+
+Cross-repository work is acceptable when this PR contains only the
+extensions-owned portion and relies on public interfaces from the owning
+repository.
 
 ## Blocking checkpoints
 

{openhands_extensions-0.23.0 → openhands_extensions-0.24.0}/.github/workflows/check-extensions.yml

@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
 
@@ -44,10 +44,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
@@ -63,10 +63,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 

{openhands_extensions-0.23.0 → openhands_extensions-0.24.0}/.github/workflows/deprecation-check.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7

openhands_extensions-0.24.0/.github/workflows/issue-readiness-check.yml

@@ -0,0 +1,73 @@
+---
+name: Ready-for-dev Label Policy
+
+# The issue-triage automation and repository writers may grant ready-for-dev.
+# Labels from any other actor are removed.
+
+on:
+    issues:
+        types: [labeled, unlabeled]
+
+concurrency:
+    group: ready-for-dev-policy-${{ github.event.issue.number }}
+    cancel-in-progress: false
+
+jobs:
+    enforce-label-policy:
+        name: Enforce ready-for-dev label policy
+        if: >-
+            github.event.issue.state == 'open'
+            && github.event.issue.pull_request == null
+            && github.event.label.name == 'ready-for-dev'
+        runs-on: ubuntu-latest
+        timeout-minutes: 5
+        permissions:
+            issues: write
+        outputs:
+            refresh-linked-prs: ${{ steps.policy.outputs.refresh-linked-prs }}
+        steps:
+            - name: Check label actor
+              id: policy
+              env:
+                  GH_TOKEN: ${{ github.token }}
+                  ACTION: ${{ github.event.action }}
+                  ACTOR: ${{ github.event.sender.login }}
+                  REPOSITORY: ${{ github.repository }}
+                  ISSUE_NUMBER: ${{ github.event.issue.number }}
+              run: |
+                  set -euo pipefail
+
+                  if [ "$ACTION" = "unlabeled" ]; then
+                    echo "refresh-linked-prs=true" >> "$GITHUB_OUTPUT"
+                    exit 0
+                  fi
+
+                  permission="$(gh api "repos/$REPOSITORY/collaborators/$ACTOR/permission" --jq .permission 2>/dev/null || true)"
+                  case "$permission" in
+                    write|maintain|admin)
+                      echo "refresh-linked-prs=true" >> "$GITHUB_OUTPUT"
+                      ;;
+                    *)
+                      gh issue edit "$ISSUE_NUMBER" --repo "$REPOSITORY" --remove-label ready-for-dev
+                      echo "refresh-linked-prs=false" >> "$GITHUB_OUTPUT"
+                      ;;
+                  esac
+
+    refresh-linked-pr-gates:
+        name: Refresh PR gates for linked issues
+        needs: enforce-label-policy
+        if: needs.enforce-label-policy.outputs.refresh-linked-prs == 'true'
+        runs-on: ubuntu-latest
+        timeout-minutes: 10
+        permissions:
+            contents: read
+            pull-requests: read
+            actions: write
+        steps:
+            - name: Checkout trusted workflow scripts
+              uses: actions/checkout@v7
+
+            - name: Re-run PR description checks for linked open PRs
+              env:
+                  GH_TOKEN: ${{ github.token }}
+              run: python .github/scripts/refresh_linked_pr_checks.py

{openhands_extensions-0.23.0 → openhands_extensions-0.24.0}/.github/workflows/npm-publish.yml

@@ -31,14 +31,14 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       # Trusted publishing requires Node 22.14.0+ and npm 11.5.1+
       # See: https://docs.npmjs.com/trusted-publishers/
       - name: Set up Node.js for npm trusted publishing
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
           registry-url: https://registry.npmjs.org

{openhands_extensions-0.23.0 → openhands_extensions-0.24.0}/.github/workflows/pr-description-check.yml

@@ -29,7 +29,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout trusted workflow scripts
-              uses: actions/checkout@v4
+              uses: actions/checkout@v7
               with:
                   ref: ${{ github.event.pull_request.base.sha }}
 

{openhands_extensions-0.23.0 → openhands_extensions-0.24.0}/.github/workflows/pypi-publish.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Extract version
         id: extract_version
@@ -72,7 +72,7 @@ jobs:
         run: uv build
 
       - name: Upload distributions
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: python-package-distributions
           path: dist/
@@ -95,7 +95,7 @@ jobs:
 
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           name: python-package-distributions
           path: dist/

{openhands_extensions-0.23.0 → openhands_extensions-0.24.0}/.github/workflows/tests.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7
@@ -21,7 +21,7 @@ jobs:
           python-version: "3.12"
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
 

openhands_extensions-0.24.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.24.0"
+}

{openhands_extensions-0.23.0 → openhands_extensions-0.24.0}/AGENTS.md

@@ -169,7 +169,16 @@ Important notes:
 - `scripts/sync_extensions.py` keeps generated artifacts in sync: Claude Code command files, README catalog section, coverage checks, and vendor symlinks. Run `python scripts/sync_extensions.py --check` (or just push — CI runs it) to verify everything is consistent. Run without `--check` to auto-fix. The "Quick Start" section in `README.md` (OpenHands SDK, Claude Code, and Codex setup instructions) is **manually maintained** above the auto-generated catalog markers and is intentionally not generated by the sync script.
 - The sync script uses PyYAML to parse SKILL.md frontmatter. If you add a skill with a slash trigger (e.g., `triggers: ["/mycommand"]`), the script auto-generates `commands/mycommand.md`. **Note:** Slash triggers in SKILL.md frontmatter are deprecated — prefer adding a `commands/command-name.md` file to the plugin's `commands/` directory instead. Keyword triggers (non-slash) remain the recommended way to activate skills by topic.
 
-- The `ready-for-dev` gates live in `.github/workflows/issue-readiness-check.yml` and `.github/workflows/pr-description-check.yml`, backed by `.github/scripts/check_issue_readiness.py`, `check_pr_description.py`, `refresh_linked_pr_checks.py`, and `post-readiness-comment.mjs`. Issues labeled `bug` or `enhancement` must meet type-specific readiness criteria (reproducible command plus Acceptance Criteria checklist for bugs; Desired Behavior plus Acceptance Criteria checklist for enhancements) to receive the `ready-for-dev` label. Non-draft PRs must keep the `## Why`, `## Summary`, and `## How to Test` template sections filled, and any issue linked via a closing keyword or the `## Issue Number` section must carry `ready-for-dev` unless it predates the 2026-08-25 rollout. Label transitions on an issue re-run the PR Description Check for linked open PRs. Tests live in `tests/test_check_issue_readiness.py`, `tests/test_check_pr_description.py`, and `tests/test_refresh_linked_pr_checks.py`.
+- The GitHub issue-triage automation and repository writers may grant
+  `ready-for-dev`.
+  `.github/workflows/issue-readiness-check.yml` removes a newly applied label
+  unless a user with `write`, `maintain`, or `admin` permission applied it. An
+  `unlabeled` event then lets triage reassess the issue.
+  `.github/workflows/pr-description-check.yml` still requires linked issues to
+  be ready, and label transitions refresh that check through
+  `.github/scripts/refresh_linked_pr_checks.py`. Tests for the PR gates live in
+  `tests/test_check_pr_description.py` and
+  `tests/test_refresh_linked_pr_checks.py`.
 
 ## OpenHands SDK documentation policy
 

{openhands_extensions-0.23.0 → openhands_extensions-0.24.0}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.5
 Name: openhands-extensions
-Version: 0.23.0
+Version: 0.24.0
 Summary: OpenHands extensions, plugins, and skills (Python bindings for the integration catalog)
 License-File: LICENSE
 Requires-Python: >=3.12
 Requires-Dist: deprecation<3,>=2.1
-Requires-Dist: packaging<26,>=24
+Requires-Dist: packaging<27,>=24
 Requires-Dist: pydantic<3,>=2.10

{openhands_extensions-0.23.0 → openhands_extensions-0.24.0}/README.md

@@ -96,7 +96,7 @@ The JS and Python versions are kept in lock-step by `release-please` and guarded
 ## Extensions Catalog
 
 <!-- BEGIN AUTO-GENERATED CATALOG -->
-This repository contains **2 marketplace(s)** with **72 extensions** (62 skills, 10 plugins).
+This repository contains **2 marketplace(s)** with **73 extensions** (63 skills, 10 plugins).
 
 ### large-codebase
 
@@ -115,7 +115,7 @@ OpenHands skills for interacting, improving, and refactoring large codebases
 
 Official skills and plugins for OpenHands — the open-source AI software engineer.
 
-**68 extensions** (60 skills, 8 plugins)
+**69 extensions** (61 skills, 8 plugins)
 
 | Name | Type | Description | Commands |
 |------|------|-------------|----------|
@@ -128,6 +128,7 @@ Official skills and plugins for OpenHands — the open-source AI software engine
 | bitbucket | skill | Bitbucket integration hub. Detects whether the repository is on Bitbucket Cloud or Bitbucket Data Center and directs ... | — |
 | bitbucket-cloud | skill | Bitbucket Cloud (bitbucket.org) specifics — authenticate with BITBUCKET_TOKEN, use the REST API v2, workspace/repo_sl... | — |
 | bitbucket-data-center | skill | Bitbucket Data Center (self-hosted Bitbucket Server) specifics — authenticate with BITBUCKET_DATA_CENTER_TOKEN, use t... | — |
+| canvas-extension-api | skill | Build and validate Apps for Agent Canvas using the supported Canvas Extensions API v1 routed-page contract. | — |
 | city-weather | plugin | Get current weather, time, and precipitation forecast for any city using the free Open-Meteo API. Provides slash comm... | — |
 | code-review | skill | Rigorous code review focusing on data structures, simplicity, security, pragmatism, and risk/safety evaluation. Provi... | `/codereview`, `/codereview-roasted` |
 | code-simplifier | skill | Simplifies and refines code across three dimensions - code reuse, code quality, and efficiency - while preserving all... | `/simplify` |