​

Agent Canvas 1.31.0

​

Highlights

• GitHub token secret hidden on Enterprise when GitHub is connected — On a self-hosted (OpenHands Enterprise) instance where GitHub is connected under Settings > Integrations, the GitHub code review template’s GitHub token secret field is hidden on the setup form and on the review step. The field keeps its default, so the created automation still names GITHUB_PERSONAL_ACCESS_TOKEN, and the bundle falls back to the connected integration’s token. Without GitHub connected, and on OpenHands Cloud and local backends, the field is shown as before. See GitHub PR Review Assistant.
• OAuth-only MCP library entries install through the server’s own OAuth — Entries whose only option is OAuth, such as Sentry, now connect through the MCP server’s own OAuth discovery and dynamic client registration instead of doing nothing on Install. The install dialog also reports when no option can be installed, instead of leaving Install unresponsive. See OAuth Authentication.
• Clearer message for an abandoned OAuth sign-in — When an OAuth MCP install pop-up is closed without finishing sign-in, the dialog now says the sign-in was not completed instead of reporting a connection timeout. See Troubleshoot MCP Connections.
• Editing an automation keeps its repositories — Edit now lists the automation’s saved repositories. Repository changes are saved when the automation service supports it and the automation is a prompt or plugin preset; otherwise the repositories are read-only. See Edit an automation.

​

Fixes

• A repository typed as a full URL is sent without a provider, so its clone does not receive GitHub credentials for another host.
• The DigitalOcean web bridge (MARS) accepts the typed session key on LAN or Docker binds that have no baked key.
• DigitalOcean sessions are preserved through Canvas authentication recovery.

​

Maintenance

• Removed the in-repo specs/ directory.

​

Full Changelog

• GitHub release notes
• Compare v1.30.1 to v1.31.0