openhands-extensions 0.29.0__tar.gz → 0.31.0__tar.gz

{openhands_extensions-0.29.0 → openhands_extensions-0.31.0}/.agents/skills/custom-codereview-guide.md

@@ -27,7 +27,32 @@ Cross-repository work is acceptable when this PR contains only the
 extensions-owned portion and relies on public interfaces from the owning
 repository.
 
-## Blocking checkpoints
+## Issue triage
+
+Issue readiness means the work is clear enough to start—not that the fix is
+complete. Do not require a PR, passing implementation tests, or before-and-after
+fix evidence. Reconsider readiness when new information leaves scope or expected
+behavior unresolved. Read the issue, linked discussion, applicable `AGENTS.md`,
+and adjacent source before asking questions.
+
+For API failures, compare the extension request with the provider's reported or
+supported version, not upstream main. Use dependency pins or deployment evidence.
+Instructions, request arguments, response parsing, and scanner policy belong
+here; use the ownership boundaries above for other failures. State required
+cross-repository changes and their order. An independent upstream defect need
+not block this work. Naming an owner does not authorize edits or duplicate tickets.
+
+Define the smallest useful outcome and explicit non-goals. Cover only affected
+entrypoints, environments, and permissions. For scanners, state whether discovery,
+commenting, and dispatch are allowed for ineligible candidates or after a cap.
+Discovery alone does not authorize unsolicited comments.
+
+Request visual evidence only when needed; otherwise use logs, minimal
+reproductions, or failing tests. Do not repeat answered questions. Match managed
+criteria to current human decisions and authoritative readiness policy. Report
+conflicts instead of repeatedly adding a label that policy removes.
+
+## Implementation review checkpoints
 
 ### Executable instructions and runtime parity
 
@@ -42,6 +67,16 @@ in a clean environment far enough to exercise the changed behavior. Keep local
 and cloud behavior identical unless the documentation names and explains a real
 platform capability difference.
 
+For provider changes, inspect the supported implementation; mocks and local types
+alone do not establish an API contract. Separate static/helper tests, tests with
+simulated services, and real integration evidence. If the version or runtime is
+unavailable, report that limit, not an assumed defect. For packaging changes,
+check source, shipped bundle, and deployed files separately.
+
+For scanners, check eligibility, permissions, caps, retries, unchanged runs, and
+recovery for each action listed under triage. A launch cap does not permit
+unlimited gate comments.
+
 ### Untrusted triggers and credentials
 
 Treat repository events, issue and PR comments, chat messages, catalog fields,
@@ -111,10 +146,9 @@ deep change lacks it, weigh the gap by risk:
   the diff would materially slow or weaken the review.
 - **LOW** risk: never block on missing design context alone.
 
-Approving a same-repository PR removes its `.pr/` directory. If a temporary
-`.pr/` page is the only design explanation, submit a COMMENT review instead of
-approving, so the page remains for the human maintainer's decision, unless the
-PR description already carries the durable equivalent.
+Temporary `.pr/` artifacts remain available during review and are removed through
+a cleanup PR after merge to `main`. Preserve any design explanation needed beyond
+that cleanup in the PR description or permanent documentation.
 
 Design context aids review; it does not excuse correctness, security,
 architecture, or repository-ownership problems.
@@ -130,3 +164,11 @@ Do not comment on punctuation, preferred prose tone, optional DRY cleanup, or
 hypothetical non-standard configurations without a supported failure mode. Before
 raising a finding, verify that the referenced file and behavior are present in
 the current PR head and have not already been addressed in review history.
+
+## Review verdict
+
+Do not approve material code defects or unmet blocking merge/evidence checks.
+Distinguish code defects from missing merge requirements and optional follow-up.
+If GitHub forbids self-approval of a clean PR, use COMMENT and explain why.
+Respect accepted scope and non-goals: block on a pre-existing limitation only if
+this change exposes it.

{openhands_extensions-0.29.0 → openhands_extensions-0.31.0}/.github/workflows/build-vscode-app.yml

@@ -14,15 +14,15 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version: "24"
       - name: Build installable App package
         run: node apps/vscode/scripts/package.mjs
       - name: Validate package files
         run: |
           test -f dist/apps/vscode/canvas-extension.json
           test -f dist/apps/vscode/extension.js
-          test -f dist/apps/vscode/backend/openvscode-linux-amd64.tar.gz
-          test -f dist/apps/vscode/backend/openvscode-linux-arm64.tar.gz
+          test -f dist/apps/vscode/README.md
+          test -z "$(find dist/apps/vscode -type f -name '*.tar.gz' -print -quit)"
       - uses: actions/upload-artifact@v7
         with:
           name: vscode-app-${{ github.sha }}

{openhands_extensions-0.29.0 → openhands_extensions-0.31.0}/.github/workflows/check-extensions.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version: "24"
 
       - name: Install Claude Code CLI
         run: npm install -g @anthropic-ai/claude-code

{openhands_extensions-0.29.0 → openhands_extensions-0.31.0}/.github/workflows/pr-artifacts.yml

@@ -6,84 +6,9 @@ on:
     pull_request_target:
         types: [opened, synchronize, reopened, closed]
         branches: [main]
-    pull_request_review:
-        types: [submitted]
 
 jobs:
-  # Auto-remove .pr/ directory from same-repository PRs when approved.
-    cleanup-on-approval:
-        concurrency:
-            group: cleanup-pr-artifacts-${{ github.event.pull_request.number }}
-            cancel-in-progress: false
-        if: >-
-            github.event_name == 'pull_request_review' &&
-            github.event.review.state == 'approved' &&
-            github.event.pull_request.head.repo.full_name == github.repository
-        runs-on: ubuntu-latest
-        permissions:
-            contents: write
-            pull-requests: write
-        steps:
-            # Use PAT so the push triggers CI workflows that will complete and
-            # satisfy branch protection. We can't use [skip ci] because GitHub Apps
-            # can create stuck checks that block merging.
-            - uses: actions/checkout@v7
-              with:
-                  ref: ${{ github.event.pull_request.head.ref }}
-                  token: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC }}
-
-            - name: Remove .pr/ directory
-              id: remove
-              run: |
-                  if [ -d ".pr" ]; then
-                    git config user.name "allhands-bot"
-                    git config user.email "allhands-bot@users.noreply.github.com"
-                    git rm -rf .pr/
-                    git commit -m "chore: Remove PR-only artifacts [automated]"
-                    git push || {
-                      echo "::error::Failed to push cleanup commit. Check branch protection rules."
-                      exit 1
-                    }
-                    echo "removed=true" >> "$GITHUB_OUTPUT"
-                    echo "::notice::Removed .pr/ directory"
-                  else
-                    echo "removed=false" >> "$GITHUB_OUTPUT"
-                    echo "::notice::No .pr/ directory to remove"
-                  fi
-
-            - name: Update PR comment after cleanup
-              if: steps.remove.outputs.removed == 'true'
-              uses: actions/github-script@v9
-              with:
-                  script: |
-                      const marker = '<!-- pr-artifacts-notice -->';
-                      const body = `${marker}
-                      ✅ **PR Artifacts Cleaned Up**
-
-                      The \`.pr/\` directory has been automatically removed.
-                      `;
-
-                      const comments = await github.paginate(
-                        github.rest.issues.listComments,
-                        {
-                          owner: context.repo.owner,
-                          repo: context.repo.repo,
-                          issue_number: context.issue.number,
-                          per_page: 100,
-                        },
-                      );
-
-                      const existing = comments.find(c => c.body.includes(marker));
-                      if (existing) {
-                        await github.rest.issues.updateComment({
-                          owner: context.repo.owner,
-                          repo: context.repo.repo,
-                          comment_id: existing.id,
-                          body: body,
-                        });
-                      }
-
-  # Inspect the fork through the API; never check out untrusted code with a write token.
+  # Inspect PR artifacts through the API; never check out untrusted code with a write token.
     check-pr-artifacts:
         if: >-
             github.event_name == 'pull_request_target' &&
@@ -144,14 +69,10 @@ jobs:
                         return;
                       }
 
-                      const isFork = headRepository.full_name !== context.payload.repository.full_name;
-                      const cleanup = isFork
-                        ? 'Because this is a fork PR, the workflow will **open or update a cleanup PR against `main` after merge**.'
-                        : 'The directory will be **automatically removed when the PR is approved**.';
                       const body = `${marker}
                       📁 **PR Artifacts Notice**
 
-                      This PR contains a \`.pr/\` directory with temporary PR-specific documents. ${cleanup}
+                      This PR contains a \`.pr/\` directory with temporary PR-specific documents. The directory will be **automatically removed after this PR merges to \`main\`** through a cleanup PR opened or updated by this workflow.
                       `;
 
                       core.warning('.pr/ directory contains temporary PR-only artifacts');
@@ -171,8 +92,8 @@ jobs:
                         });
                       }
 
-  # Fork branches cannot be modified reliably. If artifacts reach the trusted base,
-  # remove them through a pull request so branch protections remain enforced.
+  # Remove artifacts from all merged PRs through the trusted base cleanup path,
+  # preserving branch protections and avoiding a cleanup push during review.
     cleanup-after-merge:
         concurrency:
             group: cleanup-pr-artifacts-${{ github.event.pull_request.base.ref }}

{openhands_extensions-0.29.0 → openhands_extensions-0.31.0}/.github/workflows/tests.yml

@@ -14,6 +14,19 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
 
+      - name: Reject temporary artifacts in release PRs
+        if: >-
+          github.event_name == 'pull_request' &&
+          startsWith(github.head_ref, 'release-please--')
+        run: |
+          set -euo pipefail
+          artifacts="$(git ls-tree -r --name-only HEAD -- .pr)"
+          if [ -n "$artifacts" ]; then
+            echo "::error::Release PR contains temporary .pr artifacts. Merge the cleanup PR and let release-please update this PR before merging."
+            printf '%s\n' "$artifacts"
+            exit 1
+          fi
+
       - name: Install uv
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
@@ -23,7 +36,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version: "24"
 
       - name: Run tests
         run: uv run --group test pytest tests/

openhands_extensions-0.31.0/.npmignore

@@ -0,0 +1,36 @@
+# Retain the Git ignore exclusions npm used before this file was added.
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# pytest cache
+.pytest_cache/
+
+# Virtual environments
+venv/
+.venv/
+env/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+.agents/*
+!.agents/skills/
+.agents/skills/*
+!.agents/skills/custom-codereview-guide.md
+
+# uv lock file (no application code in this repo)
+uv.lock
+
+# npm pack artifacts (also keeps stray tarballs out of the published package)
+*.tgz
+
+# Temporary review artifacts may reach main before the cleanup PR merges.
+/.pr/

openhands_extensions-0.31.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.31.0"
+}

{openhands_extensions-0.29.0 → openhands_extensions-0.31.0}/AGENTS.md

@@ -146,7 +146,7 @@ When editing or adding skills in this repo, follow these rules (and add new skil
 
 ## PR-specific documents (`.pr/`)
 
-When working on a PR that requires design documents, live-test logs, development-only scripts, or other temporary artifacts that should **not** be merged to `main`, store them in a `.pr/` directory at the repository root.
+When working on a PR that requires design documents, live-test logs, development-only scripts, or other temporary artifacts that should be removed after merging to `main`, store them in a `.pr/` directory at the repository root.
 
 ```bash
 mkdir -p .pr
@@ -160,14 +160,15 @@ mkdir -p .pr
 The `PR Artifacts` workflow (`.github/workflows/pr-artifacts.yml`) owns the lifecycle of this directory:
 
 1. **Notification**: When a PR contains `.pr/`, a single comment is posted to the PR conversation alerting reviewers.
-2. **Auto-cleanup on approval**: For same-repository PRs, the directory is automatically removed by a follow-up commit when the PR is approved.
-3. **Post-merge cleanup**: If artifacts reach `main`, including through a fork PR, the workflow opens or updates a cleanup PR against `main`.
+2. **Post-merge cleanup**: After a same-repository or fork PR merges to `main`, the workflow automatically opens or updates a cleanup PR to remove the directory from `main`.
 
 Important notes:
 
 - Do not put anything in `.pr/` that needs to be preserved.
 - The `.pr/` check is informational during development; it posts a notice rather than blocking the PR.
 - Cleanup PRs follow the normal review and required-check protections for `main`.
+- npm packaging excludes `.pr/` while its cleanup PR is pending, so temporary review artifacts do not ship in releases.
+- Release PRs fail the required `test` check while their committed tree contains `.pr/`. Merge the artifact-cleanup PR and let release-please update the release PR before merging it.
 
 ## CI / validation gotchas
 

{openhands_extensions-0.29.0 → openhands_extensions-0.31.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhands-extensions
-Version: 0.29.0
+Version: 0.31.0
 Summary: OpenHands extensions, plugins, and skills (Python bindings for the integration catalog)
 License-File: LICENSE
 Requires-Python: >=3.12

{openhands_extensions-0.29.0 → openhands_extensions-0.31.0}/README.md

@@ -100,7 +100,7 @@ The JS and Python versions are kept in lock-step by `release-please` and guarded
 ## Extensions Catalog
 
 <!-- BEGIN AUTO-GENERATED CATALOG -->
-This repository contains **2 marketplace(s)** with **77 extensions** (66 skills, 11 plugins).
+This repository contains **2 marketplace(s)** with **78 extensions** (67 skills, 11 plugins).
 
 ### large-codebase
 
@@ -119,7 +119,7 @@ OpenHands skills for interacting, improving, and refactoring large codebases
 
 Official skills and plugins for OpenHands — the open-source AI software engineer.
 
-**73 extensions** (64 skills, 9 plugins)
+**74 extensions** (65 skills, 9 plugins)
 
 | Name | Type | Description | Commands |
 |------|------|-------------|----------|
@@ -154,10 +154,10 @@ Official skills and plugins for OpenHands — the open-source AI software engine
 | github-repo-monitor | skill | Create a cron automation that polls a GitHub repository for issue and PR comments containing a configurable trigger p... | `/github-monitor:poll` |
 | github-stale-ci-pr-closer | skill | Warn and close abandoned pull requests whose required CI remains failing. | `/github-stale-ci-pr-closer` |
 | gitlab | skill | Interact with GitLab repositories, merge requests, and APIs using the GITLAB_TOKEN environment variable. Use when wor... | — |
-| gitlab-issue-to-mr | skill | Create an automation that implements GitLab issues when a configurable trigger label is applied. Clones the default b... | `/issue-to-mr:setup` |
+| gitlab-issue-to-mr | skill | Create an automation that implements GitLab issues when a configurable trigger label is applied. Polls the projects d... | `/issue-to-mr:setup` |
 | incident-retrospective | skill | Create an automation that drafts incident retrospectives by gathering incident-channel messages from Slack, collectin... | `/incident-retro:setup` |
 | iterate | skill | Iterate on a GitHub pull request — drive it through CI, code review, and QA until merge-ready. Monitors state, fixes ... | `/iterate`, `/verify`, `/babysit` |
-| jira-issue-to-pr | skill | Deploy a cron-based OpenHands automation that watches a Jira Cloud project for issues labeled with a configurable lab... | — |
+| jira-issue-to-pr | skill | Deploy a cron-based OpenHands automation that opens a GitHub pull request, a GitLab merge request or a Bitbucket pull... | — |
 | jupyter | skill | Read, modify, execute, and convert Jupyter notebooks programmatically. Use when working with .ipynb files for data sc... | — |
 | kubernetes | skill | Set up and manage local Kubernetes clusters using KIND (Kubernetes IN Docker). Use when testing Kubernetes applicatio... | — |
 | learn-from-code-review | skill | Distill code review feedback from GitHub PRs into reusable skills and guidelines. Use when users ask to learn from co... | `/learn-from-reviews` |
@@ -186,11 +186,12 @@ Official skills and plugins for OpenHands — the open-source AI software engine
 | skill-creator | skill | Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an ex... | — |
 | slack-channel-monitor | skill | Create a cron automation that polls up to 10 Slack channels every minute and starts an OpenHands conversation when a ... | `/slack-monitor:poll` |
 | slack-standup-digest | skill | Create an automation that generates an async standup digest from Slack. Searches selected channels for messages since... | `/standup-digest:setup` |
+| software-factory | skill | Set up a GitHub software factory fast: ask only for the repositories and the ticket source (GitHub issues, Jira or Li... | `/software-factory` |
 | ssh | skill | Establish and manage SSH connections to remote machines, including key generation, configuration, and file transfers.... | — |
 | swift-linux | skill | Install and configure Swift programming language on Debian Linux for server-side development. Use when building Swift... | — |
 | technical-writing | skill | Write and revise technical explanations in flowing, direct, conversational prose that stays concise without becoming ... | — |
 | theme-factory | skill | Toolkit for styling artifacts with a theme. These artifacts can be slides, docs, reportings, HTML landing pages, etc.... | — |
-| ticket-to-code-change | skill | Set up Jira or Linear ticket-to-code-change automations for GitHub, GitLab, and Bitbucket. | `/ticket-to-code-change:setup` |
+| ticket-to-code-change | skill | Set up Linear ticket-to-code-change automations for GitHub, GitLab, and Bitbucket. | `/ticket-to-code-change:setup` |
 | upstream-fork-sync | skill | Keep a long-lived fork in sync with its upstream. Creates a cron automation that fetches upstream changes, rebases lo... | `/upstream-fork-sync:setup` |
 | use-jev | skill | Use Jev, a general classifier, for typed choices, scores, and yes/no probabilities in software. | — |
 | uv | skill | Common project, dependency, and environment operations using uv. | — |

openhands_extensions-0.31.0/apps/vscode/README.md

@@ -0,0 +1,15 @@
+# VS Code App
+
+Install this App in Agent Canvas by opening **Apps → Add App** and entering:
+
+```text
+https://github.com/OpenHands/extensions/tree/main/apps/vscode
+```
+
+The App provides a full-height OpenVSCode editor. Before the backend is ready, it shows backend status, an optional workspace-folder input, and revision-bound prepare/start/stop/refresh actions. Once ready, the page contains only the editor iframe.
+
+## Artifact delivery
+
+The repository contains no OpenVSCode binaries. During the explicit **Prepare and start** step, Agent Server downloads only the current platform's pinned OpenVSCode Server `v1.109.5` archive from its public GitHub Release, verifies the manifest-pinned SHA-256 digest, safely extracts it into an App-owned content-addressed cache, and starts it with App-owned home, user-data, and extensions directories. It does not send Agent Server or repository credentials to the artifact host.
+
+The optional folder is persisted in browser storage and forwarded as the editor folder. It is a user convenience, not OS sandboxing.

openhands_extensions-0.31.0/apps/vscode/canvas-extension.json

@@ -0,0 +1,27 @@
+{
+  "schema_version": 1,
+  "name": "vscode",
+  "display_name": "VS Code",
+  "version": "0.1.0",
+  "description": "A managed OpenVSCode editor for the selected Agent Canvas workspace.",
+  "entrypoint": "extension.js",
+  "contributes": {"pages": [{"id": "editor", "title": "VS Code", "path": "/editor"}]},
+  "backend": {
+    "schema_version": 1,
+    "artifacts": {
+      "linux-amd64": {
+        "url": "https://github.com/gitpod-io/openvscode-server/releases/download/openvscode-server-v1.109.5/openvscode-server-v1.109.5-linux-x64.tar.gz",
+        "sha256": "b433bf4f0227321a7014d8460d10a8f958adc0f45aa79bd889e84e65e8f88363",
+        "strip_components": 1
+      },
+      "linux-arm64": {
+        "url": "https://github.com/gitpod-io/openvscode-server/releases/download/openvscode-server-v1.109.5/openvscode-server-v1.109.5-linux-arm64.tar.gz",
+        "sha256": "36d9c14036489b63de84ebace837fcacf7e60e669a0dc715802c5443684ea4dc",
+        "strip_components": 1
+      }
+    },
+    "argv": ["{artifact_dir}/bin/openvscode-server", "--host", "127.0.0.1", "--port", "{port}", "--without-connection-token", "--accept-server-license-terms", "--telemetry-level", "off", "--user-data-dir", "{data_dir}/user", "--extensions-dir", "{data_dir}/extensions", "--server-base-path", "/app-backends/vscode", "{data_dir}"],
+    "health": {"path": "/", "timeout_seconds": 90, "interval_seconds": 0.5},
+    "inherit_environment": ["PATH", "LANG", "LC_ALL", "TMPDIR"]
+  }
+}

{openhands_extensions-0.29.0 → openhands_extensions-0.31.0}/apps/vscode/extension.js

@@ -5,14 +5,32 @@ function folderKey(host) {
   return `${FOLDER_KEY_PREFIX}:${host.backend.id}:${host.backend.orgId || "local"}:${host.extension.name}`;
 }
 
-function button(label, onClick) {
+function button(label, onClick, variant = "secondary") {
   const element = document.createElement("button");
   element.type = "button";
   element.textContent = label;
+  element.style.cssText = [
+    "min-height:40px",
+    "padding:0 18px",
+    "border-radius:8px",
+    "border:1px solid transparent",
+    "font:inherit",
+    "font-size:14px",
+    "font-weight:600",
+    "cursor:pointer",
+    "transition:opacity 120ms ease,background-color 120ms ease",
+    variant === "primary"
+      ? "background:#f3ce49;color:#171717"
+      : "background:#262626;color:#fafafa;border-color:#525252",
+  ].join(";");
   element.addEventListener("click", onClick);
   return element;
 }
 
+function statusLabel(state) {
+  return state.charAt(0).toUpperCase() + state.slice(1);
+}
+
 export function activate(host) {
   return host.registerPage("editor", async ({ container }) => {
     container.style.minHeight = "100vh";
@@ -54,26 +72,55 @@ export function activate(host) {
         return;
       }
 
+      shell.style.justifyContent = "center";
+      shell.style.alignItems = "center";
+      shell.style.padding = "32px";
+      shell.style.boxSizing = "border-box";
+
       const panel = document.createElement("section");
       panel.setAttribute("aria-live", "polite");
+      panel.style.cssText = "width:min(100%,520px);padding:32px;border:1px solid #262626;border-radius:12px;background:#0a0a0a;color:#fafafa;box-sizing:border-box;text-align:center";
       const heading = document.createElement("h2");
-      heading.textContent = "VS Code setup";
-      const detail = document.createElement("p");
-      detail.textContent = status.detail || `Backend status: ${status.state}.`;
-      panel.append(heading, detail);
+      heading.textContent = "Set up VS Code";
+      heading.style.cssText = "margin:0;font-size:24px;line-height:32px;font-weight:600";
+      const description = document.createElement("p");
+      description.textContent = "Start the secure VS Code backend for this Agent Canvas session. The first launch downloads and verifies the pinned editor package.";
+      description.style.cssText = "margin:12px auto 0;max-width:440px;color:#a3a3a3;font-size:14px;line-height:21px";
+      const statusRow = document.createElement("div");
+      statusRow.style.cssText = "display:flex;align-items:center;justify-content:center;gap:8px;margin:20px 0 24px;font-size:13px;color:#a3a3a3";
+      const statusDot = document.createElement("span");
+      statusDot.setAttribute("aria-hidden", "true");
+      statusDot.style.cssText = `width:8px;height:8px;border-radius:999px;background:${status.state === "unhealthy" ? "#fda4af" : "#737373"}`;
+      const detail = document.createElement("span");
+      detail.textContent = status.detail || `Backend status: ${statusLabel(status.state)}`;
+      statusRow.append(statusDot, detail);
+      panel.append(heading, description, statusRow);
+
+      const field = document.createElement("label");
+      field.style.cssText = "display:flex;flex-direction:column;gap:8px;text-align:left";
+      const fieldLabel = document.createElement("span");
+      fieldLabel.textContent = "Workspace folder";
+      fieldLabel.style.cssText = "font-size:13px;font-weight:500;color:#fafafa";
       const folder = document.createElement("input");
       folder.type = "text";
-      folder.placeholder = "Workspace folder path (optional)";
+      folder.placeholder = "Optional path to open in VS Code";
       folder.value = localStorage.getItem(storageKey) || "";
       folder.setAttribute("aria-label", "Workspace folder path");
-      panel.append(folder);
-      const actions = document.createElement("p");
+      folder.style.cssText = "width:100%;height:42px;padding:0 12px;border:1px solid #525252;border-radius:8px;background:#1a1a1a;color:#fafafa;font:inherit;font-size:14px;box-sizing:border-box;outline:none";
+      const hint = document.createElement("span");
+      hint.textContent = "Leave blank to open the default App workspace.";
+      hint.style.cssText = "font-size:12px;color:#8c8c8c";
+      field.append(fieldLabel, folder, hint);
+      panel.append(field);
+
+      const actions = document.createElement("div");
+      actions.style.cssText = "display:flex;justify-content:center;gap:10px;margin-top:24px;flex-wrap:wrap";
       if (status.state === "missing" || status.state === "stopped" || status.state === "unhealthy") {
         actions.append(button("Prepare and start", async () => {
           const selectedFolder = folder.value.trim();
           if (selectedFolder) localStorage.setItem(storageKey, selectedFolder);
           else localStorage.removeItem(storageKey);
-          actions.replaceChildren(document.createTextNode("Preparing..."));
+          actions.replaceChildren(document.createTextNode("Preparing and verifying VS Code..."));
           try {
             let approval = status;
             if (!approval.revision) approval = await request("GET");
@@ -90,14 +137,15 @@ export function activate(host) {
             render(await request("GET"));
           } catch (error) {
             detail.textContent = `Setup failed: ${error.message}`;
-            actions.replaceChildren(button("Prepare and start", () => render(status)));
+            statusDot.style.background = "#fda4af";
+            actions.replaceChildren(button("Try again", () => render(status), "primary"));
           }
-        }));
+        }, "primary"));
       }
       if (status.state === "ready" || status.state === "starting") {
         actions.append(button("Stop", async () => render(await request("POST", `${BACKEND}/stop`))));
       }
-      actions.append(button("Refresh", async () => render(await request("GET"))));
+      actions.append(button("Refresh status", async () => render(await request("GET"))));
       panel.append(actions);
       shell.append(panel);
     };

openhands_extensions-0.31.0/apps/vscode/scripts/package.mjs

@@ -0,0 +1,30 @@
+import { cp, mkdir, readFile, rm } from "node:fs/promises";
+import path from "node:path";
+
+const appRoot = path.resolve(new URL("..", import.meta.url).pathname);
+const root = path.resolve(appRoot, "../..");
+const output = path.resolve(process.env.OUTPUT_DIR ?? path.join(root, "dist"));
+const packageRoot = path.join(output, "apps", "vscode");
+const manifest = JSON.parse(
+  await readFile(path.join(appRoot, "canvas-extension.json"), "utf8"),
+);
+
+for (const [platform, artifact] of Object.entries(manifest.backend.artifacts)) {
+  const url = new URL(artifact.url);
+  if (url.protocol !== "https:" || !url.pathname.endsWith(".tar.gz")) {
+    throw new Error(`${platform}: invalid HTTPS artifact URL`);
+  }
+  if (!/^[0-9a-f]{64}$/.test(artifact.sha256)) {
+    throw new Error(`${platform}: invalid SHA-256`);
+  }
+  if (!Number.isInteger(artifact.strip_components) || artifact.strip_components < 0) {
+    throw new Error(`${platform}: invalid strip_components`);
+  }
+}
+
+await rm(packageRoot, { recursive: true, force: true });
+await mkdir(packageRoot, { recursive: true });
+for (const filename of ["canvas-extension.json", "extension.js", "README.md"]) {
+  await cp(path.join(appRoot, filename), path.join(packageRoot, filename));
+}
+console.log(`Wrote source-installable App package to ${packageRoot}`);