Evidence record / openhands
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-openhands-strict-plugin-preflight-resolves-a-revision-without-enabling-the-plugin
Strict plugin preflight resolves a revision without enabling the plugin. The released preflight API resolves remote plugin sources to a full commit SHA, validates paths/manifests and reports structured fetch errors without enabling the plugin. Explicitly allowed local sources do not have a remote resolved SHA.
Channel: tagged-release. Half: capability. Date: 2026-10-16 (SDK v1.55.1).
Operator consequence: Review and retain the resolved remote revision before enabling executable extensions. This gives plugin review a concrete object and avoids custom fetch/error glue, while successful parsing does not approve executable content. No fetched plugin was run here.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-openhands-strict-plugin-preflight-resolves-a-revision-without-enabling-the-plugin
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-openhands-strict-plugin-preflight-resolves-a-revision-without-enabling-the-plugingithub.com/OpenHands/software-agent-sdk/commit/db9c54b71c8c9ed46a2454fc65eee804d3c1e8aatagged commit file2026-10-24-openhands-strict-plugin-preflight-resolves-a-revision-without-enabling-the-pluginOpenHands/software-agent-sdk / openhands-sdk/openhands/sdk/plugin/strict_fetch.py
Versioned source: run artifact