Finding / openhands

2026-10-24-openhands-plugin-manifests-can-carry-executable-automations-and-azure-devops-joins-the-event-path

Plugin manifests can carry executable automations, and Azure DevOps joins the event path. A plugin can supply an openhands.automation.plugin.v1 specification through its manifest, with script or conversation entrypoints. Conversation entrypoints require a profile; declared runtime requirements cover tools, MCP references and secret references. The schema calls for an exact required profile match, not a loose extra-permissions allowance. Source validation rejects credential-bearing URLs and limits Cloud plugin sources to the supported GitHub forms. Automation 1.24.0 adds Azure DevOps as an event source, advertises which Git providers runs can clone from, and permits changing a preset’s repository selection. Canvas 1.32.0 consumes the advertised clone capabilities instead of presenting only GitHub repositories.

Channel: tagged-release. Half: capability. Date: 2026-10-19 (automation 1.21.0); 2026-10-22 (automation 1.24.0).

Operator consequence: On automation 1.25.1 and Canvas v1.33.0, evaluate packaging repeatable work as a reviewed plugin instead of maintaining separate form-filling and trigger glue. Review executable entrypoints, source revision, and the required profile together; a manifest is code-distribution metadata, not a safety certificate. The new provider path broadens the work an automation can own, while the serial human decision remains what code and credentials deserve unattended execution. No plugin was fetched for execution or run here.

Receipt

Finding metadata

Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0

Finding ID: 2026-10-24-openhands-plugin-manifests-can-carry-executable-automations-and-azure-devops-joins-the-event-path

Profile citations

Source links

Primary links, including exact changelog lines when available.