OpenHands

A permitted GitHub mention can now ask OpenHands to create a branch, commit and push using an automation’s token. Choose who may start that work before judging the patch.

Start with Canvas v1.33.0 on one bounded repository; the install command and prerequisites follow. Before enabling automation, review saved monitors, keep production secrets off the default local runtime, and configure Docker authentication before exposing a port. DigitalOcean Managed Agents remains public preview. Enterprise child launching, the DigitalOcean bridge and agent delegation require explicit enablement. Three repairs listed below remain on main and are absent from these Canvas and SDK releases.

Where it stands, 2026-10-24: Install and release status

Channel. Install Canvas v1.33.0, a non-prerelease published 23 October 2026: npm install -g @openhands/agent-canvas@1.33.0, then agent-canvas, with Node >=24 and uv. Alternatives are the desktop installers or ghcr.io/openhands/agent-canvas:1.33.0. Match separately managed services to agent-server 1.58.1 and automation 1.25.1; the remote-server minimum is now 1.55.0. Canvas bundles extensions 0.35.0. Enterprise source 1.79.0 is a separate release; it does not establish which version Cloud is running.

These repairs are on main, outside the listed releases. See the warnings for command-line keys, ACP credential forwarding and Debian certificates beside the released behavior they affect.

Changes that need your attention

Review who may start unattended work, credential boundaries, Enterprise and optional backends, or engines and dependencies.

Decide who may start unattended work

Decide who may turn a mention into code. Inspect the deployed GitHub monitor, token scope and bypass lists before enabling it. Its defaults are repository-write authorization and implement mode. The poller checks repository permissions, with token-owner and explicit-allowlist bypasses; the fallback template puts authorization and work restrictions in the agent prompt. Choose reply for narrower work; anyone plus implement lets arbitrary commenters request code changes with your token.

Check each saved monitor. Do not assume a catalog update migrated it.

Try the factory on one bounded repository. Software-factory guidance became default-enabled on 20 October; its recipe assembles issue-to-PR, review and triage jobs with credentials and checkpoints. Installing the guidance does not start those jobs. Evaluate this specialist orchestration before writing your own.

On that repository, measure accepted changes against time spent approving work, reviewing patches and handling failures. Give the factory a second repository only if it saves more supervision than it creates.

Review the plugin revision before enabling it. Plugin manifests now carry script or conversation automations; conversation runners require a profile. Use strict preflight to resolve a remote source to a SHA without enabling it, then review that revision and its profile together. Canvas shows the creator as the automation’s run-as identity; members can save their own drafts.

Review the migrated profile before delegating. Skills and routing now belong to profiles. Inspect both before enabling task_tool_set, still outside Standard tools. Children inherit exactly the parent’s MCP configuration; tool restrictions are separate. Test extra-tool, extra-MCP and nested-delegation requests before removing your own checks.

Keep credentials inside the runtime boundary

Keep production secrets off the default local runtime. In the release, local launches preserve their selected profile, and tmux now removes inherited credentials excluded by sanitization. Canvas still exports the stack key as OPENHANDS_AUTOMATION_API_KEY, sanitization leaves that alias, and the key opens saved-secret values without a profile check.

Together these imply a terminal path around profile exclusions; no live secret retrieval was attempted.

The command-line patch remains on main. Removing a child process’s session key from its command-line arguments is outside Canvas v1.33.0. See the remaining local-runtime credential exposure.

Give Docker its server key before exposing the port. Setting only LOCAL_BACKEND_API_KEY still skips exporting OH_SESSION_API_KEYS_0, and an empty server key list permits unauthenticated requests. Set both to the same value, or leave both unset for generation.

Require HTTP 401 from the protected API using GET /api/conversations/search without X-Session-API-Key. Keep off-loopback session-key injection disabled.

Check what a credential request delivered. In-conversation secret requests shipped in Canvas v1.28.0, and v1.33.0 masks their input by default. Local updates and Docker updates filter names through the profile, but the UI can report success after filtering, while this Canvas update path sends no secret update to Cloud.

Test a saved-but-excluded credential and inspect what reaches the conversation.

Back up encrypted state before rotating keys. SDK 1.57.0 supports old-key decryption via OH_PREVIOUS_SECRET_KEYS and new-key encryption via OH_SECRET_KEY; writes to unreadable settings return HTTP 409. Keep old keys until migration completes. Without an explicit encryption key, the first session key is the fallback, so rotating authentication keys also affects decryption. Handle automation storage and provider-key revocation separately.

Configure Enterprise and optional backends deliberately

Choose whole-conversation Docker deliberately. Enable OH_CONVERSATION_RUNTIME=docker and set OH_CONVERSATION_IMAGE=ghcr.io/openhands/agent-server:1.58.1-python to match the bundled server version, 1.58.1. It creates a separate server and keys per conversation with an explicit environment, including configured telemetry credentials.

For mixed local/Docker requests, OH_CONVERSATION_RUNTIME_SELECTABLE=1 requires Docker setup and a secret key, while request CPU/memory values replace server defaults. Enforce resource ceilings externally.

Without an explicit override, the launcher binds on all interfaces for the Docker default; firewall that listener. The guide also promises automatic networking for selectable mode, but that launcher branch does not test the selectable flag. Verify the bind address and container-to-host callbacks in selectable mode.

Check sandbox sharing before adopting Enterprise Compose. The packaged stack uses Canvas 1.32.0, SDK 1.58.1 and automation 1.25.1, and defaults to FEWEST_CONVERSATIONS, sharing sandboxes across conversations. Inspect workspace separation and effective grouping. Enterprise uses PolyForm Free Trial 1.0.0; Kubernetes needs a Helm-enabled license and registry credentials.

Enable Enterprise child conversations explicitly. Enterprise child launching defaults off; enablement requires OH_ENABLE_CHILD_CONVERSATION_LAUNCHER, web_url, compatible sandbox images and Canvas handling.

Treat the daily quota as a remote-SaaS counter. It meters attributed new sandboxes, excluding Docker, E2B, process backends, warm starts and resumes; some failed asynchronous starts retain reservations. Check metered starts and how reservations settle before planning capacity around this counter.

Set Enterprise admission policy explicitly. REQUIRE_VERIFIED_EMAILS defaults to false. Audit it alongside SUPER_ADMIN_EMAILS, empty by default, which grants matching stored emails instance super-admin on OAuth v2 login. New identity providers start disabled; existing providers migrate enabled, and disabling does not revoke sessions or tokens. Test new-user admission and existing-user linking separately: the registration switch gates only new-user creation.

Enable the DigitalOcean bridge explicitly. The DigitalOcean bridge again requires MARS_WEB=1. Recheck sign-in and VM size before creating resources.

Verify the engine and dependencies you run

Identify the engine before applying standalone advice. Canvas offers Pi and OpenCode as local ACP engines. Record the launched package, version and server before applying either standalone profile. The Gemini model-selection transport repair remains in OpenHands’ ACP adapter. Record requested and reported model IDs before comparing spend.

Test MCP auth on the selected engine. Stable can install remote OAuth-only library entries through the server’s OAuth and preserves credentials after refresh failure; test the actual operation on your engine.

Forwarding MCP OAuth credentials into ACP agents remains on main, outside SDK v1.58.1.

Retest TypeScript run budgets. Client 1.56.0 starts forwarding previously ignored maxIterations and stuckDetection settings, including constructor defaults. Record an actual stop before removing an external guard. These settings do not cap spend.

Check installed dependencies. SDK 1.58.1 requires LiteLLM <1.106, excluding 1.107.0, identified as compromised in the supplier’s 23 October account. Inspect older or independently resolved environments.

Current SDK, automation and Enterprise locks repair certifi against TLS interception by an on-path attacker holding compromised CA keys. Check Python, vendored and OS trust stores separately.

Repairing the SDK’s Debian CA snapshot remains on main, outside SDK v1.58.1.

What is unresolved

• Credential isolation. A released alias repair plus local/Docker tests refusing an excluded saved secret would settle the terminal path. A tag fixing the Docker key-export gap plus the protected-route 401 would settle that separate defect. Inspect terminal environments and effective credentials in both tests.
• Monitor authority. Exercise an unauthorized commenter, an allowlisted non-writer and a permitted writer against the deployed monitor. Record who starts work and which token is used before granting unattended access.
• Cloud availability and output access. Require a dated record of the version Cloud is running and a cross-member read test before applying Enterprise’s org-readable automation-transcript rule to Cloud. Keep credentials out of shared run output.
• Residual dependency exposure. SDK locks PyJWT 2.14.0 and fsspec 2025.9.0; automation locks fsspec 2026.3.0. Their advisories describe uncaught request-level exceptions, potentially HTTP 500s, from deeply nested pre-verification JWT payloads and Python execution through attacker-controlled ReferenceFileSystem templates. Check installed versions and trace their consumers to establish what is reachable.