OpenHands Enterprise 0.64.0
Released September 09, 2026.Highlights
- Shared LLM Provider Connections — Organization-level provider connections can now back multiple members’ managed profiles
- GPG Commit Signing — Users can configure GPG commit signing with a Set GPG Key button in settings
- Organization Lifecycle Tools — Superadmins can seed new orgs via invitations; Git providers can be connected/disconnected post-auth from Settings → Integrations
- Automation Permissions — Split into separate view and manage roles
Features
Enterprise Server
- feat: add ENABLE_BYOR_EXPORT env var and frontend feature flag by @tofarr in https://github.com/OpenHands/enterprise/pull/232
- feat: configurable GPG commit signing at user level (OHE-3115) by @tofarr in https://github.com/OpenHands/enterprise/pull/264
- feat: add Set GPG Key button to app settings by @tofarr in https://github.com/OpenHands/enterprise/pull/274
- feat: add database-driven feature flag library (OHE-3101) by @tofarr in https://github.com/OpenHands/enterprise/pull/217
- feat(org): shared LLM provider connections (cloud) by @juanmichelini in https://github.com/OpenHands/enterprise/pull/219
- feat: link daily quota increase requests by @neubig in https://github.com/OpenHands/enterprise/pull/283
- feat: add cron script to clean stale app_conversation_start_task rows by @tofarr in https://github.com/OpenHands/enterprise/pull/290
- feat: OHE-3197 : Unify ENABLE_BILLING resolution through the feature flag env fallback by @tofarr in https://github.com/OpenHands/enterprise/pull/301
- feat: split automations permission into view and manage by @tofarr in https://github.com/OpenHands/enterprise/pull/304
- feat: add GET /organizations//members/ by @hieptl in https://github.com/OpenHands/enterprise/pull/313
- feat: connect and disconnect Git providers post-auth from Settings > Integrations by @hieptl in https://github.com/OpenHands/enterprise/pull/309
- feat(enterprise): allow superadmin to seed a new org via a normal invitation by @lilagrc in https://github.com/OpenHands/enterprise/pull/292
- feat(enterprise): instance-level admin user lifecycle API (disable/enable/delete) by @neubig in https://github.com/OpenHands/enterprise/pull/181
- feat: OHE-3178 : add per-conversation event index for efficient search by @tofarr in https://github.com/OpenHands/enterprise/pull/327
Software Agent SDK
- feat: add manifest to installed canvas extension responses by @hieptl in https://github.com/OpenHands/software-agent-sdk/pull/4611
- feat(sdk): add ask_oracle tool by @enyst in https://github.com/OpenHands/software-agent-sdk/pull/3673
- feat(agent-server): add INSTALL_ACP_PROVIDERS build arg by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/4687
- feat: move TypeScript client into monorepo by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/4702
- feat(agent-server): add INSTALL_CAPABILITIES build arg by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/4698
- feat: add ACP-less agent-server image fallback by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/4805
- feat(observability): allow selecting Laminar instruments by @Shimada666 in https://github.com/OpenHands/software-agent-sdk/pull/4434
- feat(acp): centralize ACP npm installation metadata by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/4832
- feat(agent-server): add /sockets/session/ with a non-Event envelope by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/4807
- feat(acp): add Kimi Code, plus the hardening the other provider PRs share by @ysntony in https://github.com/OpenHands/software-agent-sdk/pull/4714
- feat(sdk): register Pi as a built-in ACP provider by @Deep070203 in https://github.com/OpenHands/software-agent-sdk/pull/4419
- feat(acp): add OpenCode as a built-in ACP provider by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/4827
- feat: add GPT-6 Astra model support by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/4861
- Add claude-sonnet-5 to PROMPT_CACHE_MODELS by @swabeinvader in https://github.com/OpenHands/software-agent-sdk/pull/4043
- feat(plugin): map client extensions under the dev.openhands namespace by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/4496
Runtime API
- feat: OHE-3139 : Split cleanup CronJob into per-phase jobs by @tofarr in https://github.com/OpenHands/runtime-api/pull/729
- feat: overlay database warm-runtime configs onto ConfigMap entries by name by @ak684 in https://github.com/OpenHands/runtime-api/pull/731
- feat: Add coverage gate to unit test workflow by @tofarr in https://github.com/OpenHands/runtime-api/pull/737
Automation
- feat: add structured task outcomes to preset finish tool by @malhotra5 in https://github.com/OpenHands/automation/pull/334
- feat: replace the parse-only source registry with a provider descriptor and verifier registry by @VascoSch92 in https://github.com/OpenHands/automation/pull/378
- feat: persist accepted events to deduplicate redeliveries and expose events that matched nothing by @VascoSch92 in https://github.com/OpenHands/automation/pull/381
- feat: report lifetime per-status run counts on the runs list by @hieptl in https://github.com/OpenHands/automation/pull/383
- feat: report live run phases for dashboard visibility by @hieptl in https://github.com/OpenHands/automation/pull/388
- feat: add in-service Slack Socket Mode via a supervised stream transport by @VascoSch92 in https://github.com/OpenHands/automation/pull/384
- feat: split automation permissions into view and manage by @tofarr in https://github.com/OpenHands/automation/pull/415
- feat: auto-disable for consecutively failing automations [PLTF-3374] by @dylan-openhands in https://github.com/OpenHands/automation/pull/397
- feat: route events to an existing conversation via a derived conversation id by @VascoSch92 in https://github.com/OpenHands/automation/pull/385
- feat: add ready-for-dev issue and PR readiness gates by @neubig in https://github.com/OpenHands/automation/pull/380
- feat: restrict automation edits to the creator by @hieptl in https://github.com/OpenHands/automation/pull/427
OpenHands Cloud (Helm Chart)
- feat(local-kind): PLTF-3527 enable Agent Canvas at /canvas by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1168
- feat(replicated): PLTF-3456 enable automations by default for new installs by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1158
- feat(runtime-api): sync split cleanup CronJob from runtime-api#729 by @tofarr in https://github.com/OpenHands/OpenHands-Cloud/pull/1178
- feat(e2e): PLTF-3514 dispatch e2e test revision bumps to saas-deploy by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1148
- feat: enable warm-runtime config overlay mode for Replicated by @ak684 in https://github.com/OpenHands/OpenHands-Cloud/pull/1183
- feat: configure Enterprise SSO for Replicated VM deployments by @jpelletier1 in https://github.com/OpenHands/OpenHands-Cloud/pull/1116
- feat: add CronJob to clean stale app_conversation_start_task rows by @tofarr in https://github.com/OpenHands/OpenHands-Cloud/pull/1196
- feat: enable appConversationStartTaskClean CronJob by default by @tofarr in https://github.com/OpenHands/OpenHands-Cloud/pull/1197
- feat(skills): PLTF-3531 add upgrade-rollback-runbook skill by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1204
- feat(skills): PLTF-3531 add gke-install cluster-install skill by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1205
- feat(skills): PLTF-3531 add eks-install cluster-install skill by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1203
- feat: diagnose runtime ingress failures in support bundles by @ak684 in https://github.com/OpenHands/OpenHands-Cloud/pull/1208
Bug Fixes
Enterprise Server
- fix: delete MCP servers from a null mcp_config entry by @hieptl in https://github.com/OpenHands/enterprise/pull/270
- fix: remove —forked from test commands to fix coverage measurement by @tofarr in https://github.com/OpenHands/enterprise/pull/277
- fix: include registered marketplaces in the conversation skills listing by @hieptl in https://github.com/OpenHands/enterprise/pull/286
- fix: stop polling behind the re-auth modal once the session expires by @hieptl in https://github.com/OpenHands/enterprise/pull/298
- fix: stop title updates clobbering conversation metadata by @hieptl in https://github.com/OpenHands/enterprise/pull/299
- fix(budgets): make LiteLLM spend reporting resilient by @ak684 in https://github.com/OpenHands/enterprise/pull/242
- fix: prevent invalid proxy tokens after managed profile changes by @saurya in https://github.com/OpenHands/enterprise/pull/209
- fix(analytics): use detected automation trigger by @neubig in https://github.com/OpenHands/enterprise/pull/147
- fix: Updated release please config to include uv.lock by @tofarr in https://github.com/OpenHands/enterprise/pull/330
- fix: prevent cross-user managed LLM key attribution by @ak684 in https://github.com/OpenHands/enterprise/pull/317
- fix(ui): disable telemetry UI in self-hosted enterprise by @ak684 in https://github.com/OpenHands/enterprise/pull/326
Software Agent SDK
- fix(agent-server): keep crash recovery result on interrupted action branch by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/4488
- fix(workspace): honor explicit provider host when injecting git clone tokens by @rsd-darshan in https://github.com/OpenHands/software-agent-sdk/pull/4571
- fix(agent-server): replace global _lifecycle_lock with per-conversation locks by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/4570
- fix(tools): unique user_data_dir per conversation to prevent SingletonLock collisions by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/4602
- fix(sdk): bound AsyncExecutor.close() so it cannot hang forever by @AaronAbuUsama in https://github.com/OpenHands/software-agent-sdk/pull/4548
- fix(agent-server): detect all secret-bearing fields for the plaintext-save warning, not just llm.api_key by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/4618
- fix: enable condenser for subscription LLMs via existing completion dispatch by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/4517
- fix(sdk): resolve structured builtin tool specs remotely by @malhotra5 in https://github.com/OpenHands/software-agent-sdk/pull/4691
- fix(agent-server): stop fanning streaming deltas out to every subscriber by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/4689
- fix(acp): never inject workspace project skills into an ACP agent (#4019) by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/4699
- fix(sdk): mask model output in the durable MessageEvent by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/4783
- fix(sdk): match nested repo paths by ancestry, not string prefix by @alanhuangyoo in https://github.com/OpenHands/software-agent-sdk/pull/4767
- fix(tools): mask secrets in every tool’s observation at the shared chokepoint by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/4788
- fix(agent-server): keep the idle timer alive during streamed completions by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/4790
- fix(sdk): remove secrets from subprocess env by @smolpaws in https://github.com/OpenHands/software-agent-sdk/pull/4801
- fix(sdk): persist events before publishing them, return the assigned seq by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/4806
- fix(llm): allow security_risk param on read-only tools like finish by @sideeffffect in https://github.com/OpenHands/software-agent-sdk/pull/4153
- fix(sdk): require fastmcp>=3.2.0 so expired MCP OAuth tokens refresh by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/4857
- fix(sdk): pick up a user message that arrives during an async step by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/4194
- fix(agent-server): propagate load_memory preference to all launch paths by @vnktadithya in https://github.com/OpenHands/software-agent-sdk/pull/4566
- fix: respect OH_PERSISTENCE_DIR for all ~/.openhands paths by @jpshackelford in https://github.com/OpenHands/software-agent-sdk/pull/4476
- fix(ci): align ready-for-dev gates with OpenHands pipefail-safe approach by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/4607
- fix(tests): stop pinning LLM capability tests to upstream metadata by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/4879
- fix(ci): centralize release publication dispatches by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/4886
- fix(agent-server): restore subscription credentials in pre-flight validation by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/4898
- fix(llm): register litellm_proxy alias pricing so spans aren’t silently $0 by @juanmichelini in https://github.com/OpenHands/software-agent-sdk/pull/4836
- fix(extensions): compose local source with repo_path by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/4839
Runtime API
- fix: redact sensitive URL query parameters in pod crash logs by @all-hands-bot in https://github.com/OpenHands/runtime-api/pull/706
- fix: treat empty ADMIN_PASSWORD as unset so admin routes stay disabled by @ak684 in https://github.com/OpenHands/runtime-api/pull/730
- fix: OHE-3187 : clean up warm runtimes orphaned by split-brain claim by @tofarr in https://github.com/OpenHands/runtime-api/pull/735
Automation
- fix: capture automation failure modes as status states by @malhotra5 in https://github.com/OpenHands/automation/pull/345
- fix: treat missing tarball objects as permanent and defer superseded deletes until commit by @hieptl in https://github.com/OpenHands/automation/pull/356
- fix: auto-disable unhealthy automations by @malhotra5 in https://github.com/OpenHands/automation/pull/352
- fix: scope automation management to the org instead of the owner by @VascoSch92 in https://github.com/OpenHands/automation/pull/399
- fix: require preset automations to use finish tool by @malhotra5 in https://github.com/OpenHands/automation/pull/405
- fix: Forward X-Org-Id during automation auth by @malhotra5 in https://github.com/OpenHands/automation/pull/403
- fix(automation): purge expired local-mode run workspaces by @trungminhdo4-glitch in https://github.com/OpenHands/automation/pull/277
OpenHands Cloud (Helm Chart)
- fix(local-kind): PLTF-3527 use bundled MinIO for conversation/event storage by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1163
- fix(replicated): drop the KOTS update check that ruins the target cursor by @dylan-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1175
- fix: Disable agent-canvas telemetry by default for self-hosted by @lilagrc in https://github.com/OpenHands/OpenHands-Cloud/pull/1156
- fix(e2e): PLTF-3515 give the Tavily test its own conversation by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1146
- fix: rename warm-runtime default config to v1_current to match the app default spec lookup by @ak684 in https://github.com/OpenHands/OpenHands-Cloud/pull/1181
- fix: give the Runtime API admin password a real KOTS field with a generated default by @ak684 in https://github.com/OpenHands/OpenHands-Cloud/pull/1182
- fix: advertise the runtime API ingress to fuse mounts by @ak684 in https://github.com/OpenHands/OpenHands-Cloud/pull/1184
- fix(chart): render reaper archive volume under a volumes: key (staging reaper outage) by @tofarr in https://github.com/OpenHands/OpenHands-Cloud/pull/1185
- fix(ci): bypass broken deploy-gate check temporarily by @tofarr in https://github.com/OpenHands/OpenHands-Cloud/pull/1186
- fix: make E2E repo-test prompt explicitly instruct file edit by @tofarr in https://github.com/OpenHands/OpenHands-Cloud/pull/1189
Maintenance
Enterprise Server
- refactor(frontend): remove legacy max-budget settings control by @saurya in https://github.com/OpenHands/enterprise/pull/213
- chore: remove dead code by @tofarr in https://github.com/OpenHands/enterprise/pull/271
- chore: remove redundant comments across enterprise codebase by @tofarr in https://github.com/OpenHands/enterprise/pull/272
- chore: remove comments referencing previous functionality by @tofarr in https://github.com/OpenHands/enterprise/pull/273
- test: replace mocked sessions with SQLite fixtures in org invitation store by @tofarr in https://github.com/OpenHands/enterprise/pull/276
- docs: fix stale, wrong, and inapplicable documentation references by @tofarr in https://github.com/OpenHands/enterprise/pull/275
- chore: remove Reo tracking integration by @neubig in https://github.com/OpenHands/enterprise/pull/227
- refactor: PLTF-3545 PLTF-3546 flatten enterprise/ into the repo root and move to uv by @jlav in https://github.com/OpenHands/enterprise/pull/312
Software Agent SDK
- docs: document SDK repository boundaries by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/4587
- chore(ci): clarify issue readiness bot comment and reference templates by @jpshackelford in https://github.com/OpenHands/software-agent-sdk/pull/4625
- Relax ready-for-dev heading check to accept h2 headings by @all-hands-bot in https://github.com/OpenHands/software-agent-sdk/pull/4632
- docs(examples): align Ask Oracle conventions by @enyst in https://github.com/OpenHands/software-agent-sdk/pull/4655
- refactor(agent-server): share ACP provider payload as a parent-independent Docker layer by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/4651
- test(agent-server): cover conversation reads not serializing behind an unrelated start by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/4685
- ci: enforce SDK and TypeScript client version parity by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/4779
- refactor(agent-server): remove the VNC/desktop stack entirely by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/4792
- refactor(agent-server,ci): remove overdue org_config field and catch this class of gap in check_deprecations.py by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/4795
- ci: remove the endpoint-audit PR comment, report via the job summary by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/4825
- test(acp): live conformance + model-acceptance probes for built-in providers (#4830 P0) by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/4834
- ci(typescript-client): run integration tests against the branch’s agent-server by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/4844
- perf(sdk): make EventLog.append cost flat against conversation length by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/4697
Automation
- perf: remove redundant readiness query by @Linxiushen in https://github.com/OpenHands/automation/pull/303
- refactor: extract a transport-neutral accept_event() from the webhook handler by @VascoSch92 in https://github.com/OpenHands/automation/pull/367
- chore: add Dependabot configuration by @neubig in https://github.com/OpenHands/automation/pull/372
- docs: document automation repository boundaries by @neubig in https://github.com/OpenHands/automation/pull/369
- ci: enforce minimum 76% coverage on unit tests by @tofarr in https://github.com/OpenHands/automation/pull/419
OpenHands Cloud (Helm Chart)
- ci: check the agent-server tag against the enterprise SDK pin by @jlav in https://github.com/OpenHands/OpenHands-Cloud/pull/1167
- ci: make the Replicated deploy check blocking, with a break-glass label [PLTF-3535] by @dylan-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1187
- test: harden 003 legacy conversations spec (from #1176, without 005 canvas spec) by @tofarr in https://github.com/OpenHands/OpenHands-Cloud/pull/1200
- docs(skills): PLTF-3531 use —context=0 for helm diff in upgrade-rollback runbook by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1206
- test(e2e): verify managed LLM key ownership by @ak684 in https://github.com/OpenHands/OpenHands-Cloud/pull/1207