automation: Docs update for OpenHands v1.19.0 release

[all-hands-bot]

Release

• Version: v1.19.0
• Published: 2026-09-16T19:24:24Z
• URL: https://github.com/OpenHands/OpenHands/releases/tag/v1.19.0
• Prerelease: no

Release summary

OpenHands v1.19.0 introduces four user-facing features: scoping agent profiles to specific MCP servers, GPT-6 Astra model support in the Codex ACP picker, tracking authenticated Canvas arrivals (analytics), and surfacing automation disablement reasons in the UI. Bug fixes include recognizing Azure DevOps SSH remotes, HTML-escaping injected runtime config in the static server (XSS fix), avoiding redundant automation SDK version refetches, tying the client ACP registry pin to agent-server, applying inferred issue type labels in CI, and admitting plugin sources in catalog bundles. The release also bumps the SDK to 1.48.0 and automation to 1.12.1, and includes extensive test coverage improvements.

Documentation review checklist

• feat: scope an agent profile to specific MCP servers (PR #17289) — Documentation needed. Agent profiles can now be scoped to specific MCP servers via mcp_server_refs. This is a new user-facing capability that changes how profiles interact with MCP servers. The Agent Profiles page should document how to scope a profile to selected MCP servers, and the MCP page may need a cross-reference. Source: feat: scope an agent profile to specific MCP servers OpenHands#17289
• feat: add GPT-6 Astra model support (PR #17164) — Probably no documentation change. The GPT-6 Astra model is added to the Codex ACP model picker internally; ACP agents manage their own model list from the SDK registry. The ACP Agents page already states the provider list is sourced from the SDK registry. No user-facing configuration step is introduced. Source: feat: add GPT-6 Astra model support OpenHands#17164
• feat: track authenticated Canvas arrivals (PR #17083) — Probably no documentation change. This is an internal analytics enhancement tracking authenticated arrivals. No user-facing feature or configuration change. Source: feat: track authenticated Canvas arrivals OpenHands#17083
• feat: surface automation disablement reason in the UI (PR #17425) — Documentation needed. The automation detail page now shows a human-readable disablement reason, structured detail, and a timestamp. The Managing Automations page should document this new UI element and what the disablement reasons mean. Source: feat: surface automation disablement reason in the UI OpenHands#17425
• fix: recognize Azure DevOps SSH remotes (PR #17375) — Needs maintainer confirmation. The fix allows Azure DevOps SSH remote URLs (git@ssh.dev.azure.com:v3/...) to be correctly parsed. The Azure DevOps integration doc may benefit from a note that SSH remotes are now supported, but this is an internal parsing fix with no configuration change. Source: fix: recognize Azure DevOps SSH remotes OpenHands#17375
• fix(static-server): HTML-escape injected runtime config (PR #17175) — Probably no documentation change. Security fix for XSS in the static server. No user-facing feature or configuration change. Source: fix(static-server): HTML-escape injected runtime config and set Cache-Control: no-store on credential injection OpenHands#17175
• fix: avoid redundant automation SDK version refetches (PR #16991) — Probably no documentation change. Internal performance fix for React Query caching. No user-facing behavior change. Source: fix: avoid redundant automation SDK version refetches OpenHands#16991
• fix(acp): tie client ACP registry pin to agent-server (PR #17423) — Probably no documentation change. Internal fix aligning ACP registry pins and adding a CI gate. No user-facing configuration change. Source: fix(acp): tie the client ACP registry pin to agent-server, drop the codex shim OpenHands#17423
• fix(ci): apply inferred issue type labels (PR #17218) — Probably no documentation change. CI workflow improvement for issue labeling. No user-facing documentation impact. Source: fix(ci): apply inferred issue type labels OpenHands#17218
• fix(automations): admit plugin sources in catalog bundles (PR #17403) — Needs maintainer confirmation. The bundle-source validator now accepts plugins/ package directories. The Plugins or Prebuilt Automations page may benefit from a note if catalog bundles are documented. Source: fix(automations): admit plugin sources in catalog bundles OpenHands#17403
• chore: bump SDK to 1.48.0 and automation to 1.12.1 (PR #17479) — Documentation needed. The Agent Canvas release notes pattern should be followed to create a v1.19.0 release notes page. SDK and automation version bumps should be reflected. Source: chore: bump SDK to 1.48.0 and automation to 1.12.1 OpenHands#17479

Pull request review

• feat: scope an agent profile to specific MCP servers OpenHands#17289 — Introduces mcp_server_refs on agent profiles, allowing users to scope which MCP servers a profile can access. Files are all in src/ (UI components, constants, routes). New user-facing settings UI feature. Docs impact: Agent Profiles page needs a new section on MCP server scoping.
• feat: add GPT-6 Astra model support OpenHands#17164 — Adds GPT-6 Astra to the Codex ACP model picker. Files in src/constants/acp-providers.ts and tests. The model list is sourced from the SDK registry, so no docs change needed — the ACP Agents page already explains this.
• feat: track authenticated Canvas arrivals OpenHands#17083 — Analytics tracking for authenticated Canvas arrivals. Files in src/api/main-app-auth.ts. Internal analytics, no user-facing docs impact.
• feat: surface automation disablement reason in the UI OpenHands#17425 — Surfaces automation disablement reason in the UI with a banner component. Files in src/components/features/automations/detail/, src/routes/automation-detail.tsx, src/types/automation.ts. New UI element on automation detail page. Docs impact: Managing Automations page should document the disablement reason banner.
• fix: recognize Azure DevOps SSH remotes OpenHands#17375 — Fixes parsing of Azure DevOps SSH remote URLs. Files in src/utils/parse-git-remote-url.ts. Bug fix with no new configuration. Minimal docs impact; possibly a note in Azure DevOps integration doc.
• fix(static-server): HTML-escape injected runtime config and set Cache-Control: no-store on credential injection OpenHands#17175 — HTML-escapes injected runtime config and sets Cache-Control: no-store. Files in scripts/static-server.mjs. Security fix, no user-facing docs impact.
• fix: avoid redundant automation SDK version refetches OpenHands#16991 — Refactors automation SDK version query to React Query with proper caching. Files in src/hooks/query/use-automation-sdk-version.ts. Internal performance fix, no docs impact.
• fix(acp): tie the client ACP registry pin to agent-server, drop the codex shim OpenHands#17423 — Ties client ACP registry pin to agent-server, drops codex shim, adds CI sync check. Files in package.json, scripts/check-sdk-version-sync.mjs, src/constants/acp-providers.ts. Internal tooling fix, no docs impact.
• fix(ci): apply inferred issue type labels OpenHands#17218 — Applies inferred issue type labels in CI readiness check. Files in .github/scripts/. CI improvement, no docs impact.
• fix(automations): admit plugin sources in catalog bundles OpenHands#17403 — Admits plugin sources in catalog bundle validation. Files in src/manifests/manifest-validation.ts. Fix to bundle validator; may warrant a note if catalog bundles are documented.
• chore: bump SDK to 1.48.0 and automation to 1.12.1 OpenHands#17479 — Bumps SDK to 1.48.0 and automation to 1.12.1. Files in package.json, config/defaults.json, AGENTS.md. Version bump that should be reflected in release notes.

Human testing required

• MCP server scoping — Create an agent profile, configure multiple MCP servers, then scope the profile to a subset. Start a conversation and verify only the scoped MCP servers' tools are available. Expected: tools from non-scoped MCP servers should not appear in the agent's tool list.
• Automation disablement reason — Disable an automation manually and verify the detail page shows the reason banner with a human-readable message and timestamp. Trigger a permanent dispatch failure (if possible) and verify the corresponding reason is shown. Expected: the banner displays the correct disablement reason and timestamp.
• Azure DevOps SSH remote — Clone a repo using git@ssh.dev.azure.com:v3/org/project/repo and open it as a workspace. Expected: the repo name and branch are correctly displayed, and Pull/Push/PR actions are available.

Suggested documentation locations

• openhands/usage/agent-canvas/agent-profiles.mdx — Add a section on scoping agent profiles to specific MCP servers (PR #17289)
• openhands/usage/agent-canvas/managing-automations.mdx — Document the automation disablement reason banner (PR #17425)
• openhands/usage/agent-canvas/release-notes/v1.19.0.mdx — New release notes page following the v1.18.0 pattern (PR #17479 and all release items)
• enterprise/integrations/azure-devops.mdx — Optional note that SSH remotes are now recognized (PR #17375)
• overview/model-context-protocol.mdx — Cross-reference to MCP server scoping in agent profiles (PR #17289)

Source links

• https://github.com/OpenHands/OpenHands/releases/tag/v1.19.0
• feat: scope an agent profile to specific MCP servers OpenHands#17289
• feat: add GPT-6 Astra model support OpenHands#17164
• feat: track authenticated Canvas arrivals OpenHands#17083
• feat: surface automation disablement reason in the UI OpenHands#17425
• fix: recognize Azure DevOps SSH remotes OpenHands#17375
• fix(static-server): HTML-escape injected runtime config and set Cache-Control: no-store on credential injection OpenHands#17175
• fix: avoid redundant automation SDK version refetches OpenHands#16991
• fix(acp): tie the client ACP registry pin to agent-server, drop the codex shim OpenHands#17423
• fix(ci): apply inferred issue type labels OpenHands#17218
• fix(automations): admit plugin sources in catalog bundles OpenHands#17403
• chore: bump SDK to 1.48.0 and automation to 1.12.1 OpenHands#17479

This issue was created by an AI agent (OpenHands) on behalf of the user.

[all-hands-bot]

A draft documentation PR is ready for human review: #807

This comment was created by an AI agent (OpenHands) on behalf of the user.