Finding / openhands
2026-10-24-openhands-strict-plugin-preflight-resolves-a-revision-without-enabling-the-plugin
Strict plugin preflight resolves a revision without enabling the plugin. The released preflight API resolves remote plugin sources to a full commit SHA, validates paths/manifests and reports structured fetch errors without enabling the plugin. Explicitly allowed local sources do not have a remote resolved SHA.
Channel: tagged-release. Half: capability. Date: 2026-10-16 (SDK v1.55.1).
Operator consequence: Review and retain the resolved remote revision before enabling executable extensions. This gives plugin review a concrete object and avoids custom fetch/error glue, while successful parsing does not approve executable content. No fetched plugin was run here.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-openhands-strict-plugin-preflight-resolves-a-revision-without-enabling-the-plugin
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-openhands-strict-plugin-preflight-resolves-a-revision-without-enabling-the-plugingithub.com/OpenHands/software-agent-sdk/commit/db9c54b71c8c9ed46a2454fc65eee804d3c1e8aatagged commit file2026-10-24-openhands-strict-plugin-preflight-resolves-a-revision-without-enabling-the-pluginOpenHands/software-agent-sdk / openhands-sdk/openhands/sdk/plugin/strict_fetch.py