OpenHands Enterprise 0.70.0
Released September 22, 2026.Highlights
- Refreshed UI — Updated conversation and Settings experiences now align with OpenHands Agent Canvas for a more intuitive developer and admin experience.
- Organization-Scoped Secrets — Admins can create shared secrets for use across the Organization, reducing duplicate credential setup and centralizing access.
- User Budget Dashboard — Users can view their usage and monthly budget consumption under Settings > Your Budget for better spend visibility.
- OAuth MCP Support — Users can authenticate to MCP servers with OAuth, including supported services like GitLab and Atlassian Rovo, using their own identity.
- Organization-Visible Automations — Users can see Automations across their Organization, including who created them and which identity they run as; Admins can disable or delete them.
- Automation Git Sync — Admins can sync Automations with a Git repository for version history, backup, and pull request-based review workflows.
Features
Enterprise Server
- feat: DB-driven free/default/verified model flags by @juanmichelini in https://github.com/OpenHands/enterprise/pull/191
- feat: surface runtime ingress startup failures by @ak684 in https://github.com/OpenHands/enterprise/pull/332
- feat: PLTF-3553 Add org condenser max_tokens rollout configuration by @aivong-openhands in https://github.com/OpenHands/enterprise/pull/337
- feat: enforce daily quota and surface structured 429 with settings link by @neubig in https://github.com/OpenHands/enterprise/pull/201
- feat(budgets): add upgrade preflight and post-upgrade reconciliation gate by @hieptl in https://github.com/OpenHands/enterprise/pull/362
- feat: add system_prompt and disabled_skills to conversation start API by @hieptl in https://github.com/OpenHands/enterprise/pull/335
- feat(super-admins): flag-gate super-admin list discovery (OHE-3196) by @tofarr in https://github.com/OpenHands/enterprise/pull/390
- feat(budgets): normalize per-member cycle baselines with provenance by @hieptl in https://github.com/OpenHands/enterprise/pull/365
- feat: org-scoped secrets — backend Phase 1 (OHE-2568) by @tofarr in https://github.com/OpenHands/enterprise/pull/391
- feat(analytics): emit PostHog events for HubSpot contact sync by @malhotra5 in https://github.com/OpenHands/enterprise/pull/392
- feat(frontend): OpenHands-Neo settings theme aligned with agent-canvas by @FraterCCCLXIII in https://github.com/OpenHands/enterprise/pull/174
- feat(secrets): org-scoped secrets UI — share checkbox and permission-gated actions [OHE-2568] by @tofarr in https://github.com/OpenHands/enterprise/pull/449
- feat(mcp): run OAuth MCP installs from the app server by @hieptl in https://github.com/OpenHands/enterprise/pull/404
- feat(conversations): add tags to start/update requests and a tags__contains search filter by @hieptl in https://github.com/OpenHands/enterprise/pull/432
- feat: add exact name filter to GET /api/organizations by @hieptl in https://github.com/OpenHands/enterprise/pull/447
- feat(budgets): show each user their own budget and usage by @hieptl in https://github.com/OpenHands/enterprise/pull/448
- feat(orgs) : OHE-3303 : expose is_visible on organization listings by @tofarr in https://github.com/OpenHands/enterprise/pull/461
Software Agent SDK
- feat(agent-server): add OpenAI Responses gateway by @enyst in https://github.com/OpenHands/software-agent-sdk/pull/4694
- feat(sdk): StreamContext mints the stream identity and closes every stream by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/4822
- feat(profiles): scope which secrets an agent profile receives by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/4931
- feat(agent-server): conversation-scoped runtime APIs and clients by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/4966
- feat(sdk): extend existing conversation and workspace APIs for automation by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/5010
- feat(workspace): add AgentSandboxWorkspace (Kubernetes, kubernetes-sigs/agent-sandbox) by @aleks-stefanovic in https://github.com/OpenHands/software-agent-sdk/pull/4516
- feat(agent-server): publish python-minimal image by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/5088
- feat(profiles): scope saved secrets at lookup by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/5017
- feat(agent-server): add docker runtime mode for per-conversation containers by @rbren in https://github.com/OpenHands/software-agent-sdk/pull/3403
- feat(plugin): add the Agent Plugins mcp.json loader by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/5093
Automation
- feat: add user-authenticated KV access by @tofarr in https://github.com/OpenHands/automation/pull/445
- feat: scope git sync to organizations so cloud deployments can sync by @hieptl in https://github.com/OpenHands/automation/pull/429
- feat: make automation sandbox cleanup delay configurable by @hieptl in https://github.com/OpenHands/automation/pull/459
- feat: select an agent profile for delegated automation work by @neubig in https://github.com/OpenHands/automation/pull/479
- feat: allow raw automations to start disabled by @XiaoFeiCode in https://github.com/OpenHands/automation/pull/387
OpenHands Cloud (Helm Chart)
- feat: PLTF-3553 Add Helm values for org condenser defaults by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1214
- feat: wire the git sync wrapping secret and a /workspace volume by @hieptl in https://github.com/OpenHands/OpenHands-Cloud/pull/1213
- feat(openhands): add budget preflight and reconciliation gate hook jobs by @hieptl in https://github.com/OpenHands/OpenHands-Cloud/pull/1251
- feat(replicated): OHE-3231 expose the automation conversation archive delay as a ConfigOption by @hieptl in https://github.com/OpenHands/OpenHands-Cloud/pull/1244
- feat: configure Keycloak admin login through Replicated by @ak684 in https://github.com/OpenHands/OpenHands-Cloud/pull/1269
Bug Fixes
Enterprise Server
- fix: OHE-3155 : lazily repair free-tier LiteLLM allowlists on org upgrade by @tofarr in https://github.com/OpenHands/enterprise/pull/338
- fix: refresh Bitbucket Data Center tokens for automation sandboxes by @ak684 in https://github.com/OpenHands/enterprise/pull/334
- fix(budgets): recover missing member cycle baselines after upgrade by @hieptl in https://github.com/OpenHands/enterprise/pull/347
- fix: restore Git identity after sandbox resume by @ak684 in https://github.com/OpenHands/enterprise/pull/333
- fix(metrics): OHE-3110 : omit misleading “No budget limit” line in conversation metrics modal by @tofarr in https://github.com/OpenHands/enterprise/pull/349
- fix: bulk-repair cross-user managed LLM key ownership by @ak684 in https://github.com/OpenHands/enterprise/pull/353
- fix: expose desired and applied budget state by @ak684 in https://github.com/OpenHands/enterprise/pull/357
- fix: fail budget maintenance on reconciliation errors by @ak684 in https://github.com/OpenHands/enterprise/pull/356
- fix: gate Cloud on an explicit ACP provider allowlist by @simonrosenberg in https://github.com/OpenHands/enterprise/pull/336
- fix(sandbox): allow max_num_sandboxes=1 by accepting 0 in pause_old_sandboxes by @hieptl in https://github.com/OpenHands/enterprise/pull/386
- fix: upgrade postcss to 8.5.18+ to fix path traversal vulnerability by @mamoodi in https://github.com/OpenHands/enterprise/pull/396
- fix: Update js-yaml for CVE remediation by @mamoodi in https://github.com/OpenHands/enterprise/pull/401
- fix: resolve duplicate migration revision 162 (rename to 164, make idempotent) by @tofarr in https://github.com/OpenHands/enterprise/pull/445
- fix(bitbucket-dc): validate tokens against /projects so scoped PATs pass by @hieptl in https://github.com/OpenHands/enterprise/pull/423
- fix: Tag Enterprise telemetry by deployment kind by @malhotra5 in https://github.com/OpenHands/enterprise/pull/441
- fix: replace stale custom LLM key when switching back to the managed default profile by @juanmichelini in https://github.com/OpenHands/enterprise/pull/425
- fix: heal stale org-level BYOR LLM key on conversation start (#421) by @juanmichelini in https://github.com/OpenHands/enterprise/pull/437
- fix(sandbox): make resume state-aware and preserve conflict semantics by @hieptl in https://github.com/OpenHands/enterprise/pull/422
Software Agent SDK
- fix(tools): add logging filter to redact secrets from libtmux log output by @all-hands-bot in https://github.com/OpenHands/software-agent-sdk/pull/4871
- fix(sdk): add sk-oh-* OpenHands API key pattern to redact_api_key_literals by @all-hands-bot in https://github.com/OpenHands/software-agent-sdk/pull/4947
- Fail over to fallback LLM immediately on hard quota exhaustion by @all-hands-bot in https://github.com/OpenHands/software-agent-sdk/pull/4917
- fix(llm): remove LLM.modify_params past its v1.47.0 removal deadline by @enyst in https://github.com/OpenHands/software-agent-sdk/pull/4954
- fix(acp): materialise only the running provider’s file secrets by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/4927
- fix(sdk): generate titles with Responses and subscription streaming by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/4968
- fix(ts-client): reject browser-only downloads early in Node.js by @BORAN002 in https://github.com/OpenHands/software-agent-sdk/pull/4982
- fix(sdk): strip inline reasoning from LLM-generated titles by @aniketwaghh in https://github.com/OpenHands/software-agent-sdk/pull/4703
- fix(agent-server): enforce the paginated search limit by @mkuri in https://github.com/OpenHands/software-agent-sdk/pull/4991
- fix(agent-server): use a minimal Debian Python/Node runtime by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/5077
- fix(sdk): don’t deep-copy the agent LLM in ask_agent by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/5085
- fix(agent-server): delegate MCP OAuth callback to FastMCP instead of forking it by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/4821
- fix(agent-server): preserve Docker conversation metadata route by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/5112
- fix(agent-server): preserve legacy conversations in Docker catalogs by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/5128
- fix(agent-server): stop rescanning Docker conversations by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/5137
- fix(agent-server): preserve Docker proxy root paths by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/5140
- fix(deps): hold fastmcp below 4 so browser tools keep working in unlocked installs by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/5153
- fix(plugin): enforce package path containment in plugin formats by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/5101
- fix(agent-server): create Docker conversation workspaces by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/5130
- fix(agent-server): block Docker restarts during deletion by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/5132
- fix(agent-server): expose Docker host gateway by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/5164
- fix(tests): track upstream reasoning_effort support for kimi-k2.5 by @simonrosenberg in https://github.com/OpenHands/software-agent-sdk/pull/5183
- fix(workspace): preserve caller’s AgentContext in load_skills_from_agent_server() by @vnktadithya in https://github.com/OpenHands/software-agent-sdk/pull/4876
- fix(sdk): stamp the output item id on Responses stream deltas by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/5204
- fix(agent-server): use MCP OAuth credentials passed inline on the agent by @hieptl in https://github.com/OpenHands/software-agent-sdk/pull/5078
- fix(secret): resolve this server’s own LookupSecret URLs in-process by @lkshrk in https://github.com/OpenHands/software-agent-sdk/pull/5026
- Fix #5205: Reset agent_settings when deleting active ACP profile by @jpshackelford in https://github.com/OpenHands/software-agent-sdk/pull/5206
Automation
- fix(presets): install SDK into the run virtualenv by @palrohitg in https://github.com/OpenHands/automation/pull/460
- fix: tolerate transient SQLite write contention by @neubig in https://github.com/OpenHands/automation/pull/462
- fix: route automation commands through SDK workspaces by @neubig in https://github.com/OpenHands/automation/pull/481
- fix: release request sessions before route telemetry by @neubig in https://github.com/OpenHands/automation/pull/458
- fix: cut redundant/noisy PostHog telemetry events by @malhotra5 in https://github.com/OpenHands/automation/pull/486
- fix(git-sync): preserve selected agent profiles by @neubig in https://github.com/OpenHands/automation/pull/501
- fix: Add deployment kind to automation telemetry by @malhotra5 in https://github.com/OpenHands/automation/pull/497
- fix: let org members create automations by @hieptl in https://github.com/OpenHands/automation/pull/496
OpenHands Cloud (Helm Chart)
- fix: validate embedded storage capacity for bundled MinIO by @ak684 in https://github.com/OpenHands/OpenHands-Cloud/pull/1220
- fix: stop cert-manager from claiming uploaded LiteLLM TLS secrets by @ak684 in https://github.com/OpenHands/OpenHands-Cloud/pull/1221
- fix(replicated): PLTF-3561 drop dead laminar-query-engine status informers by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1255
- fix(replicated): PLTF-3561 drop dead laminar-quickwit status informers by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1256
- fix(replicated): PLTF-3560 cover all LiteLLM credentials in restart checksum by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1258
Maintenance
Enterprise Server
- test: add a postgres test-database harness by @jlav in https://github.com/OpenHands/enterprise/pull/321
- test: point the shared database fixtures at postgres by @jlav in https://github.com/OpenHands/enterprise/pull/322
- test: drop the per-file sqlite engine fixtures by @jlav in https://github.com/OpenHands/enterprise/pull/323
- chore: Add quint-specs folder with quint lockfile by @aivong-openhands in https://github.com/OpenHands/enterprise/pull/293
- test(budgets): add the org-budgets Quint spec and oracle instrumentation by @aivong-openhands in https://github.com/OpenHands/enterprise/pull/370
- revert: remove instance-level admin user lifecycle API by @neubig in https://github.com/OpenHands/enterprise/pull/325
- docs: clarify DEPLOYMENT_MODE vs app_mode for cloud/self-hosted detection by @juanmichelini in https://github.com/OpenHands/enterprise/pull/454
- refactor: remove vestigial /api/refresh-tokens endpoint and dead token-fetch code by @tofarr in https://github.com/OpenHands/enterprise/pull/435
Software Agent SDK
- ci: enable API compliance and condenser test labels by @enyst in https://github.com/OpenHands/software-agent-sdk/pull/4204
- fix(ci): open PR for merged artifact cleanup by @enyst in https://github.com/OpenHands/software-agent-sdk/pull/4933
- chore: forbid getattr and setattr in SDK by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/4906
- ci: check Python API breakage on release PRs by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/4971
- chore: remove merged PR artifacts by @all-hands-bot in https://github.com/OpenHands/software-agent-sdk/pull/5020
- chore: enable Dependabot uv ecosystem by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/5050
- chore: isolate Dependabot uv updates by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/5060
- ci: accept the existing search limit schema repair by @enyst in https://github.com/OpenHands/software-agent-sdk/pull/5032
- test(ts-client): migrate from Jest to Vitest by @neubig in https://github.com/OpenHands/software-agent-sdk/pull/5075
- test(examples): exclude agent-sandbox example from example tests by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/5083
- ci(version-bump-prs): push the TypeScript client bump with the bot PAT by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/5089
- chore(agent-server): remove deprecated desktop URL endpoint past its 1.49.0 deadline by @enyst in https://github.com/OpenHands/software-agent-sdk/pull/5105
- refactor(sdk): delegate plugin skills discovery to load_skills_from_dir by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/5086
- test(plugin): end-to-end tests for the Agent Plugins package format by @VascoSch92 in https://github.com/OpenHands/software-agent-sdk/pull/5160
Automation
- ci: bring .pr/ artifact workflow to parity with software-agent-sdk by @all-hands-bot in https://github.com/OpenHands/automation/pull/435
- fix(ci): pull MinIO test image from Quay by @palrohitg in https://github.com/OpenHands/automation/pull/447
- fix(ci): let triage and repository writers own readiness by @neubig in https://github.com/OpenHands/automation/pull/507
OpenHands Cloud (Helm Chart)
- fix(ci): send the run identifiers the E2E binding selects on [ref PLTF-3540] by @dylan-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1228
- ci: block the openhands release PR on a red unstable E2E [ref PLTF-3540] by @lilagrc in https://github.com/OpenHands/OpenHands-Cloud/pull/1149
- fix(e2e): complete new-user login past the 2FA-settings reminder by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1242
- fix(replicated-deploy): Make the Replicated deploy job re-runnable and its failures more legible by @dylan-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1243
- chore: PLTF-3548 raise preflight memory recommendation to 32Gi by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1249
- test(e2e): cover budget maintenance incidents by @saurya in https://github.com/OpenHands/OpenHands-Cloud/pull/1117
- chore: PLTF-3561 Add laminar app-server and consumer pod logs to support bundle by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1253
- test: rename end-to-end test for budgets by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1263
- build: retry helm package to tolerate transient chart-dependency download failures by @aivong-openhands in https://github.com/OpenHands/OpenHands-Cloud/pull/1264