v1.19.0

What's Changed

• Enable ACPAgent on RemoteRuntime API by @simonrosenberg in #2190
• Make API breakage workflows fail loudly by @enyst in #2432
• Clarify REST contract deprecation policy by @enyst in #2433
• Highlight API breakage check comments more clearly by @enyst in #2434
• Enforce REST deprecation deadlines by @enyst in #2435
• Remove stale Python API workflow env by @enyst in #2442
• Run API breakage checks on push to main by @enyst in #2443
• Add rich package version 14.3.3 to dependency constraints by @yitao-li in #2414
• Export TokenUsage, page_iterator, and AsyncRemoteWorkspace as public SDK APIs by @enyst in #2445
• Fix apptainer workspace cleanup: kill zombie child processes. by @adityasoni9998 in #2450
• chore(deps): bump pyjwt from 2.11.0 to 2.12.0 by @dependabot[bot] in #2448
• Add docstring guidelines and fix key docstrings for MDX compatibility by @rbren in #2452
• ci: guard package version bumps outside release PRs by @enyst in #2457
• Fix: Add tags to root endpoint for OpenAPI spec by @rbren in #2458
• Fix Python selection in version-bump PR workflow by @neubig in #2430
• Revert PR #2190: Enable ACPAgent on RemoteRuntime API by @enyst in #2451
• test(sdk): reproduce delegate resume compatibility regression by @neubig in #2382
• Enforce REST API deprecation runway in breakage checks by @enyst in #2464
• Use version tag for agent server image in version bump prs by @aivong-openhands in #2427
• Enable ACPAgent on RemoteRuntime API via ACP conversation endpoints by @simonrosenberg in #2465
• Refine temperature/top_p handling for reasoning models by @mayeco in #2277
• chore(deps): bump authlib from 1.6.7 to 1.6.9 by @dependabot[bot] in #2475
• feat(prompt): add AI disclosure policy for external service communications by @xingyaoww in #2476
• feat(build): add OPENHANDS_BUILDKIT_CACHE_MODE env var to control cache export by @simonrosenberg in #2479
• fix: preflight check now validates reasoning_content for thinking models by @juanmichelini in #2420
• Migrate PR review plugin to extensions repository by @juanmichelini in #2324
• Remove multiswebench from CI eval workflow options by @juanmichelini in #2483
• chore(deps): bump pyasn1 from 0.6.2 to 0.6.3 by @dependabot[bot] in #2484
• Add GPT-5.4 to verified models by @juanmichelini in #2487
• fix: synchronize ACP telemetry and refresh remote final state by @simonrosenberg in #2460
• refactor(sdk/subagent): showing tools each subagent has by @VascoSch92 in #2480
• feat: workspace.get_llm() and get_secrets() for OpenHandsCloudWorkspace credential inheritance by @xingyaoww in #2409
• fix: cherry-pick cache_export_seconds telemetry fix to main by @simonrosenberg in #2493
• Add MiniMax-M2.7 to resolve_model_config.py by @juanmichelini in #2500
• chore(deps): bump pypdf from 6.8.0 to 6.9.1 by @dependabot[bot] in #2497
• fix(workflow): remove unused DATASET/SPLIT env vars from run-eval workflow by @VascoSch92 in #2504
• fix(ci): ignore Field deprecated metadata in API breakage check by @enyst in #2508
• chore: add Dependabot configuration for GitHub Actions updates by @aivong-openhands in #2501
• chore(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #2520
• chore(deps): bump actions/download-artifact from 6 to 8 by @dependabot[bot] in #2517
• chore(deps): bump actions/setup-node from 4 to 6 by @dependabot[bot] in #2519
• chore(deps): bump actions/github-script from 7 to 8 by @dependabot[bot] in #2521
• chore(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #2518
• fix(examples): make the LLM profile store example directory-based by @enyst in #2507
• refactor(llm): use litellm params for reasoning support by @enyst in #1990
• Expose terminalbench in run-eval workflow by @neubig in #2360
• fix(tools): return browser timeout as observation by @neubig in #2455
• Add Google Gemini 3.1 verify models by @mayeco in #2276
• feat(workflow): Expected instance_ids format (no spaces) by @VascoSch92 in #2502
• feat(sdk/agent): Parallel Tool Call Execution by @VascoSch92 in #2390
• fix(ci): ignore added Field metadata in SDK API breakage check by @enyst in #2524
• fix(workflow): Normalize instance_ids by stripping spaces instead of failing by @simonrosenberg in #2529
• feat(websocket): add after_timestamp filter for bi-directional event loading by @jpshackelford in #1880
• build: move SDK SHA args after expensive layers for cache reuse by @simonrosenberg in #2522
• Fix Qwen3.5-Flash low submission rate: improve JSON arg parsing and add corrective feedback by @juanmichelini in #2512
• feat(docker): make ACP npm package installation optional via build arg by @simonrosenberg in #2535
• feat(docker): make boto3 installation optional via build arg by @simonrosenberg in #2536
• feat(docker): add extra_build_args to BuildOptions by @simonrosenberg in #2541
• feat(plugin): Add entry_command field to PluginManifest by @jpshackelford in #2230
• Add url field to PluginAuthor to match Claude Code schema by @jpshackelford in #2546
• feat(sdk): Add browser tool usage guidelines to system prompt by @VascoSch92 in #2547
• fix: use asyncio.Event() for thread-safe initialization state by @ixchio in #2383
• fix(sdk): stop sending reasoning_effort to Kimi thinking by @enyst in #2549
• fix: add diagnostics for preflight proxy failures by @simonrosenberg in #2557
• Fix run-eval to use locked LiteLLM dependency by @simonrosenberg in #2559
• fix(sdk): pin LiteLLM version exactly by @rbren in #2558
• fix(ci): rename PAT secret to PAT_TOKEN by @simonrosenberg in #2561
• fix(ci): use /v1/models for proxy health check instead of /health by @simonrosenberg in #2563
• feat: support pre-built base images for faster rebuilds by @simonrosenberg in #2542
• fix(ci): handle dict-valued json_schema_extra in API breakage checker by @enyst in #2568
• feat(sdk/subagent): Resolve ${VAR} env variables in all MCP server config fields by @VascoSch92 in #2492
• feat(sdk): allow acp_model for codex-acp by @simonrosenberg in #2562
• fix(ci): allow additive response oneOf expansion in oasdiff checker by @enyst in #2572
• refactor(tools): remove max_run by @VascoSch92 in #2491
• Release v1.15.0 by @all-hands-bot in #2567
• feat: pass partial_archive_url to evaluation workflow for resume support by @juanmichelini in #2540
• feat: add local_agent_server_mode to OpenHandsCloudWorkspace by @xingyaoww in #2490
• chore(deps): bump lewagon/wait-on-check-action from 1.4.1 to 1.5.0 by @dependabot[bot] in #2581
• refactor(tools/task): change task tool description by @VascoSch92 in #2513
• chore(deps): bump dawidd6/action-download-artifact from 6 to 19 by @dependabot[bot] in #2580
• chore(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #2579
• feat(sdk): add ResourceLockManager for parallel tool execution safety by @VascoSch92 in #2560
• Add trusted-by logos to README by @jamiechicago312 in #2591
• Pass workflow run ID to evaluation job by @juanmichelini in #2594
• feat(workspace): add get_mcp_config() to OpenHandsCloudWorkspace by @malhotra5 in #2595
• fix: Send ConversationErrorEvent when MCP connection fails and improve error handling by @tofarr in #2556
• Add tags support to conversations API by @rbren in #2454
• docs: document existing uv and deno skills by @enyst in #2602
• Fix symlinked CLAUDE.md → AGENTS.md causing duplicate content in system prompt by @xingyaoww in #2601
• feat: switch default base images to nikolaik slim variant by @aivong-openhands in #2551
• sdk: centralize programmatic settings schema by @neubig in #2361
• Warn users when tmux is not installed for better terminal stability by @xingyaoww in #2590
• chore: remove outdated INSTALL_ACP example from build.py docstring by @simonrosenberg in #2608
• feat(observability): support custom ports for self-hosted Laminar by @Shimada666 in #2447
• Deprecate RUNTIME_URL in favor of OH_WEB_URL by @enyst in #2429
• Adjust RUNTIME_URL deprecation metadata for v1.15.0 by @enyst in #2612
• Add sdk-release skill to guide through the release process by @xingyaoww in #2611
• fix(ci): switch Gemini defaults to 3.1 Pro by @enyst in #2615
• Release v1.16.0 by @all-hands-bot in #2614
• (security fix) validate random branch inputs by @enyst in #2621
• docs: update README trusted-by logos for dark mode by @jamiechicago312 in #2625
• feat(sdk): Support additional AWS Bedrock authentication methods by @sjathin in #2598
• feat(acp): add Gemini CLI as supported ACP server by @simonrosenberg in #2619
• fix(workspace): avoid logging forwarded env values by @simonrosenberg in #2630
• Add minimax-m2.7 to verified models by @juanmichelini in #2627
• fix: too short skill description sent in the prompt by @enyst in #2635
• fix(conversation): sanitize remote error logging by @simonrosenberg in #2631
• feat(tools/grep): declare resources for parallel execution by @VascoSch92 in #2640
• feat(tools/glob): declare resources for parallel execution by @VascoSch92 in #2639
• chore(uv): add 7-day exclude-newer guardrail by @enyst in #2648
• docs(review): flag too-new package uploads in reviewer prompt by @enyst in #2650
• chore(deps): bump requests from 2.32.5 to 2.33.0 by @dependabot[bot] in #2647
• fix(terminal): filter terminal query sequences from captured output by @jpshackelford in #2334
• Add converse-nemotron-super-3-120b to resolve_model_config.py by @juanmichelini in #2645
• chore(deps): bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #2577
• feat(tool/file_editor): file editor resources by @VascoSch92 in #2638
• feat(tools/list_directory): declare resources for parallel execution by @VascoSch92 in #2641
• fix: add httpx[socks] dependency for SOCKS proxy support by @xingyaoww in #2664
• feat(skill): add manage-evals skill for evaluation triggering and comparison by @xingyaoww in #2634
• fix(agent-server): avoid blocking event loop on state lock by @neubig in #2622
• feat(tools/tom_consult): declare resources for parallel execution by @VascoSch92 in #2663
• fix(acp): install Node 22 for ACP and defer remote ACP init until run by @simonrosenberg in #2656
• Release v1.16.1 by @all-hands-bot in #2665
• chore(deps): bump cryptography from 46.0.5 to 46.0.6 by @dependabot[bot] in #2672
• chore(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #2661
• fix(tools): prevent duplicate WithRisk/WithSummary Action classes in sub-agent conversations by @VascoSch92 in #2649
• fix: propagate acp_model to metrics for accurate cost attribution by @simonrosenberg in #2677
• Add dashscope/qwen3.6-plus to resolve_model_config.py by @juanmichelini in #2681
• fix(sdk): use AI agent in disclosure example by @enyst in #2675
• Add contributors section to README by @jamiechicago312 in #2658
• feat: add automation context tags to conversations by @malhotra5 in #2632
• chore(deps): bump lewagon/wait-on-check-action from 1.5.0 to 1.6.0 by @dependabot[bot] in #2660
• feat(security): defense-in-depth security analyzers by @Fieldnote-Echo in #2472
• feat(skills): add shell command execution in frontmatter for dynamic context by @VascoSch92 in #2582
• Apptainer gpu passthrough by @neubig in #2695
• fix(acp): add activity heartbeat to prevent idle runtime kill during conn.prompt() by @simonrosenberg in #2698
• feat(sdk): add redact_url_params() for URL query parameter redaction by @simonrosenberg in #2700
• fix(agent-server): sanitize 422 error responses to prevent secret leakage by @simonrosenberg in #2679
• fix(acp): retry transient ACP server errors (JSON-RPC -32603) by @simonrosenberg in #2699
• Add instruction to verify PR status before pushing by @xingyaoww in #2696
• Bump pytest to >=9.0.0 to unblock Dependabot by @aivong-openhands in #2705
• Fix auto-title race condition: extract message before background task by @rbren in #2599
• docs: add cross-repo testing skill for SDK ↔ OH Cloud e2e workflow by @xingyaoww in #2477
• Fix _extract_summary popping real tool parameters named "summary" by @xingyaoww in #2633
• fix(deps): upgrade litellm to fix fastapi import bug in Responses API by @xingyaoww in #2714
• fix: ERROR when agent finishes on final iteration (#2659) by @trayanmomkov in #2720
• feat(agent-server): expose settings schema by @neubig in #2651
• Migrate Claude ACP package name by @simonrosenberg in #2702
• fix: Incremental view construction by @csmith49 in #2586
• fix(sdk): recover malformed tool history via condensation by @enyst in #2613
• chore(deps): bump slackapi/slack-github-action from 2.1.1 to 3.0.1 by @dependabot[bot] in #2578
• feat(agent-server): register builtin agents on startup by @VascoSch92 in #2710
• Deprecate DelegateTool in favor of TaskToolSet by @VascoSch92 in #2668
• chore(deps): bump pygments from 2.19.2 to 2.20.0 by @dependabot[bot] in #2731
• chore(deps): bump fastmcp from 3.1.0 to 3.2.0 by @dependabot[bot] in #2643
• chore(deps): bump aiohttp from 3.13.3 to 3.13.4 by @dependabot[bot] in #2732
• chore(test): update docstring link to correct PR (#2264) by @kushalsai-01 in #2733
• refactor(tools): built-in agents by @VascoSch92 in #2511
• fix(sdk): Use concise error message for tool validation errors by @VascoSch92 in #2748
• fix(llm): cap auto-detected max_output_tokens when it fills the entire context window by @csmith49 in #2747
• feat(tools/task): make TaskManager thread-safe for parallel execution by @VascoSch92 in #2719
• fix: add prompt-level defense against repo context injection attacks by @sumleo in #2543
• fix(sdk): recover dict/list args with trailing garbage in tool calls by @VascoSch92 in #2753
• chore(deps): bump litellm from 1.82.6 to 1.83.0 by @dependabot[bot] in #2750
• feat(tools/gemini): declare file-path resources for parallel execution by @VascoSch92 in #2723
• Add trinity-large-thinking to resolve_model_config.py by @juanmichelini in #2760
• Update PR template to match OpenHands/OpenHands repository by @jamiechicago312 in #2730
• feat(tools/terminal): tmux pane pool for parallel terminal execution by @VascoSch92 in #2669
• feat: add experimental QA changes workflow by @xingyaoww in #2717
• feat: Expose agent final response via REST API endpoint by @xingyaoww in #2690
• chore(deps): bump pypdf from 6.9.1 to 6.9.2 by @dependabot[bot] in #2646
• Add openrouter/z-ai/glm-5.1 to resolve_model_config (fixes #2768) by @juanmichelini in #2769
• fix(agent-server): await conversation teardown in EventService.close() by @VascoSch92 in #2734
• Add support for EXTENSIONS_REF environment variable by @juanmichelini in #2607
• docs: document gh workflow run for integration tests in ADDINGMODEL.md by @juanmichelini in #2783
• Unify skills modules: move context/skills to sdk/skills by @csmith49 in #2774
• Move marketplace definitions to openhands.sdk.marketplace module by @csmith49 in #2786
• fix(sdk): metrics desync between LLM and Telemetry after restore by @VascoSch92 in #2736
• fix: restore self-contained /agent-server with uv-managed Python by @simonrosenberg in #2765
• Skip PyPI publishing for GitHub pre-releases by @xingyaoww in #2800
• fix: use GITHUB_SHA env var for image tag in server workflow by @simonrosenberg in #2799
• test: add additional regression tests for restore_metrics telemetry sync (#13843) by @Jinhaooo in #2793
• fix(ci): keep REST release-based and enforce SDK deprecation runway by @enyst in #2802
• Fix remaining tmux session leaks in agent-server startup and task cleanup by @rbren in #2805
• refactor(settings): split agent and conversation settings schemas by @neubig in #2789
• feat: Extensions module by @csmith49 in #2801
• fix: redact sensitive credentials from command logs by @simonrosenberg in #2815
• Release v1.17.0 by @all-hands-bot in #2812
• fix: override exclude-newer in version-bump-prs workflow by @xingyaoww in #2817
• fix: normalize Anthropic-style tool calls in the SDK agent path by @juanmichelini in #2685
• feat(observability): add init_laminar_for_external helper for webhook integrations by @juanmichelini in #2820
• test(agent-server): add regression test for tags forwarding on conversation create by @xingyaoww in #2822
• feat(agent-server): expose model switching (switch_profile) in agent-server REST API by @VascoSch92 in #2795
• feat(sdk): accept inline system_prompt kwarg on Agent by @xingyaoww in #2826
• Enforce test directory allowlist and fix orphaned tests by @xingyaoww in #2836
• chore(deps): bump pillow from 12.1.1 to 12.2.0 by @dependabot[bot] in #2832
• chore(deps): bump cryptography from 46.0.6 to 46.0.7 by @dependabot[bot] in #2833
• Integrate GraySwan security changes by @MadhaviSG in #2787
• chore(ci): bump poetry version to 2.3.3 in version-bump-prs workflow by @aivong-openhands in #2831
• fix: strip deployment prefixes from LiteLLM proxy model names by @jpshackelford in #2693
• fix(sdk): preserve security policy filename contract by @enyst in #2838
• chore(deps): bump dawidd6/action-download-artifact from 19 to 20 by @dependabot[bot] in #2764
• feat(pr-review): enable sub-agent delegation for file-level reviews by @xingyaoww in #2839
• chore(ci): use GITHUB_TOKEN for label and stale workflows by @simonrosenberg in #2844
• chore(deps-dev): bump pytest from 9.0.2 to 9.0.3 by @dependabot[bot] in #2834
• Add claude-opus-4-7 model support by @juanmichelini in #2852
• feat(terminal): standardize send_keys special key support across backends by @sjathin in #2807
• Persist ACP session id across agent-server restarts by @simonrosenberg in #2869
• feat(sdk/tools): add explicit invoke_skill tool for progressive-disclosure skills by @VascoSch92 in #2835
• reduce noise in laminar observability by @dinmukhamedm in #2871
• feat(sdk): split AgentSettings into LLM/ACP discriminated union by @simonrosenberg in #2861
• feat(acp): stream ACPToolCallEvents live from session_update by @simonrosenberg in #2868
• Make confirmation mode critical in conversation schema by @neubig in #2870
• chore(deps): bump lewagon/wait-on-check-action from 1.6.0 to 1.7.0 by @dependabot[bot] in #2842
• chore(deps): bump actions/github-script from 8 to 9 by @dependabot[bot] in #2843
• refactor(sdk): extract LLM response classification and dispatch from Agent.step() by @VascoSch92 in #2743
• feat: add title_llm_profile support for auto-titling by @simonrosenberg in #2515
• fix(acp): show the real model in logs and serialized state by @simonrosenberg in #2881
• feat: add Conversation.fork() as a first-class SDK primitive by @xingyaoww in #2841
• fix(sdk): reorder schema properties so security_risk precedes content fields by @VascoSch92 in #2745
• feat(workspace): make health_check_timeout configurable on DockerWorkspace and ApptainerWorkspace by @ixchio in #2688
• ci: use MAINTAINERS as reviewer assignment fallback by @enyst in #2875
• fix(ci): pass extensions-version so sub-agent review script is used by @xingyaoww in #2890
• Add kimi-k2.6 model to resolve_model_config.py by @juanmichelini in #2894
• fix(sdk/llm): Codex subscription mode: empty responses, rejected params, and reasoning item 404s by @VascoSch92 in #2798
• chore: use OPENHANDS_BOT_GITHUB_PAT_EVAL_DISPATCH for eval dispatch by @simonrosenberg in #2895
• chore: use OPENHANDS_BOT_GITHUB_PAT_PUBLIC in public-repo workflows by @simonrosenberg in #2898
• Change llm.base_url prominence from CRITICAL to MAJOR by @neubig in #2899
• fix(llm): pass stream_options to preserve cache token metrics in streaming mode by @xingyaoww in #2897
• test: use default agent preset for integration tests by @xingyaoww in #1996
• feat(agent-server): add token-level streaming support to agent server WebSocket by @VascoSch92 in #2751
• fix(skills): Load installed skills in load_user_skills() by @sjathin in #2884
• chore(deps): bump python-multipart from 0.0.22 to 0.0.26 by @dependabot[bot] in #2878
• Add encryption support for mcp_config field in AgentBase by @tofarr in #2900
• Release v1.18.0 by @all-hands-bot in #2908
• fix(tools): Gracefully handle missing PS1 metadata instead of crashing by @VascoSch92 in #2742
• fix(llm): pin prompt_cache_key to conversation id by @VascoSch92 in #2907
• fix(llm): preserve Responses function_call.id for byte-identical repl… by @VascoSch92 in #2916
• fix(conversation): repin prompt_cache_key on switch_profile by @VascoSch92 in #2920
• Add cancel-eval workflow to kill evaluation jobs by @juanmichelini in #2914
• feat: add repository cloning and skill loading methods to OpenHandsCloudWorkspace by @malhotra5 in #2912
• fix(sdk): add security_risk to prompt-based tool calling example by @VascoSch92 in #2746
• feat: Add secrets support for MCP config variable expansion by @jpshackelford in #2873
• Fix CVE-2026-34444: Update lupa to 2.8 by @aivong-openhands in #2925
• fix: pin ACP npm package versions in agent-server Dockerfile by @simonrosenberg in #2927
• fix(security): first-message WebSocket auth to prevent token leakage by @simonrosenberg in #2790
• chore: point pr-review workflow to extensions@main by @xingyaoww in #2928
• Release v1.18.1 by @all-hands-bot in #2929
• nit(sdk/critic): delete dead code by @VascoSch92 in #2938
• docs(sdk): clarify tool call matching invariants by @neubig in #2942
• fix(state): warn when falling back to InMemoryFileStore without persistence_dir by @StatPan in #2936
• Add device-code login for OpenAI subscriptions by @xingyaoww in #2945
• ci: rename eval dispatch token env vars by @enyst in #2933
• ci: support fork PR review workflows by @enyst in #2931
• feat(settings): add from_persisted loaders by @neubig in #2949
• Add OpenHands issue duplicate automation workflow by @enyst in #2909
• docs: align README setup notes with current repo workflow by @smolpaws in #2952
• fix: handle Pydantic MCP server objects in expand_mcp_variables by @jpshackelford in #2962
• chore(deps): bump lxml from 6.0.2 to 6.1.0 by @dependabot[bot] in #2961
• fix(sdk/conversation): preserve prompt_cache_key for sub-agent LLMs by @VascoSch92 in #2973
• Add GPT-5.5 model configuration by @juanmichelini in #2975
• feat(settings): add enable_sub_agents toggle to LLMAgentSettings by @xingyaoww in #2948
• Release v1.19.0 by @neubig in #2974

New Contributors

• @yitao-li made their first contribution in #2414
• @Shimada666 made their first contribution in #2447
• @sjathin made their first contribution in #2598
• @Fieldnote-Echo made their first contribution in #2472
• @trayanmomkov made their first contribution in #2720
• @kushalsai-01 made their first contribution in #2733
• @sumleo made their first contribution in #2543
• @Jinhaooo made their first contribution in #2793
• @MadhaviSG made their first contribution in #2787
• @StatPan made their first contribution in #2936

Full Changelog: v1.14.0...v1.19.0