chore(vendor): update OpenHuman dependencies to latest main

[senamakel]

Summary

• Refresh the 11 OpenHuman vendor submodule pins that were behind their vendors' main; the other 8 direct vendor pins were already current.
• Adapt OpenHuman's browser task construction and policy test to TinyComputer's new browser executable/profile fields.
• Include the Rust layout script helper in its isolated test fixture.
• Update lockfiles and merge current OpenHuman main.

Verification

Passed: pnpm build, pnpm typecheck, pnpm lint, pnpm rust:layout, workspace and app Cargo checks, the OpenHuman CLI build, and pnpm test:scripts (539 passed, 4 skipped). Formatting checks passed before the final upstream merge; they are being rerun.

pnpm test on the current branch still reports failures in existing UI/i18n expectations and several five-second UI waits. The file-keyring Rust E2E run also failed in cli_model_overrides_e2e::core_boot_rejects_a_malformed_configured_master_key. These failures need CI confirmation; this PR does not claim the full test matrix is green.

Summary by CodeRabbit

• Behavior
  • Browser tasks now leave the browser executable and profile unspecified, allowing the host policy to govern browser selection and configuration.
• Tests
  • Added checks confirming browser tasks do not request a specific executable or profile. Existing layout-check expectations remain unchanged.

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Reviewing pending checks
Priority: none
Reviewed head: 78249f4f0acf
Updated: 1791661723 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	1	Active findings	0
Tests	2	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	5

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Pending checks: Rust E2E (mock backend), Build Playwright E2E Artifact, E2E (Playwright / web lane), Desktop E2E (full suite, 3 OS), Storage e2e on MongoDB

Before merge

• Wait for Rust E2E (mock backend), Build Playwright E2E Artifact, E2E (Playwright / web lane), Desktop E2E (full suite, 3 OS), Storage e2e on MongoDB.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 3 files; 0 findings. _Code retrieval was unavailable (model: ladder embeddings returned 400 Bad Request: {"error":{"message":"unknown ladder vectors; known ladders are flash (also chat-v1, flash-v1), instant (also no-think, instant-v1), reasoning (also deepseek), max-reasoning (also max-reasoning-v1), deepseek-flash (also reasoning-v1, agentic-v1), deep (also luna), scribe, uncensored, vectors-oai3 (also embeddings-oai3-v1), vision (also vision-v1, multimodal-v1), image (also images-v1, image-v1), vi), so this review saw the diff alone._ _Memory was unavailable (model: cortex: v1/recall: error sending request for url (http://cortexdb:3141/v1/recall\)\), so this review ran without it._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 3 files; 0 findings. _Code retrieval was unavailable (model: ladder embeddings returned 400 Bad Request: {"error":{"message":"unknown ladder vectors; known ladders are flash (also chat-v1, flash-v1), instant (also no-think, instant-v1), reasoning (also deepseek), max-reasoning (also max-reasoning-v1), deepseek-flash (also reasoning-v1, agentic-v1), deep (also luna), scribe, uncensored, vectors-oai3 (also embeddings-oai3-v1), vision (also vision-v1, multimodal-v1), image (also images-v1, image-v1), vi), so this review saw the diff alone._ _Memory was unavailable (model: cortex: v1/recall: error sending request for url (http://cortexdb:3141/v1/recall\)\), so this review ran without it._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This change only initializes the existing `browser_executable`/`browser_profile` constraint fields to `None` and reformats the layout-gate test; there is no new behaviour branch or error path to cover, and the added assertions pin the defaults the new initializers produce. The change looks sound and safe to merge. _Code retrieval was unavailable (model: ladder embeddings returned 400 Bad Request: {"error":{"message":"unknown ladder vectors; known ladders are flash (also chat-v1, flash-v1), instant (also no-think, instant-v1), reasoning (also deepseek), max-reasoning (also max-reasoning-v1), deepseek-flash (also reasoning-v1, agentic-v1), deep (also luna), scribe, uncensored, vectors-oai3 (also embeddings-oai3-v1), vision (also vision-v1, multimodal-v1), image (also images-v1, image-v1), vi), so this review saw the diff alone._ _Memory was unavailable (model: cortex: v1/recall: error sending request for url (http://cortexdb:3141/v1/recall\)\), so this review ran without it._

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The diff matches the description: submodule-pinned browser task code gains browser_executable/browser_profile fields (with test updates), and the rust-layout test fixture now copies scripts/lib/root-rust-targets.mjs so the isolated script run can resolve its helper import. The formatting-only churn in the test file is harmless. The description honestly reports the failing tests rather than claiming green. Looks sound to merge, with the caveat the author already flagged that CI must confirm the pre-existing test failures. _Code retrieval was unavailable (model: ladder embeddings returned 400 Bad Request: {"error":{"message":"unknown ladder vectors; known ladders are flash (also chat-v1, flash-v1), instant (also no-think, instant-v1), reasoning (also deepseek), max-reasoning (also max-reasoning-v1), deepseek-flash (also reasoning-v1, agentic-v1), deep (also luna), scribe, uncensored, vectors-oai3 (also embeddings-oai3-v1), vision (also vision-v1, multimodal-v1), image (also images-v1, image-v1), vi), so this review saw the diff alone._ _Memory was unavailable (model: cortex: v1/recall: error sending request for url (http://cortexdb:3141/v1/recall\)\), so this review ran without it._

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: The behavioural change is two new optional constraint fields (`browser_executable`, `browser_profile`) defaulting to `None` on the browser task request, plus reformatting of a unit test and the layout-check script test. The new fields have no external surface of their own (they are unset defaults wired through to a struct), and no end-to-end harness change is involved; the diff is otherwise formatting. Coverage looks sound; nothing to report. Waiting on end-to-end jobs: `Rust E2E (mock backend)`, `Build Playwright E2E Artifact`, `E2E (Playwright / web lane)`, `Desktop E2E (full suite, 3 OS)`, `Storage e2e on MongoDB`.
• Unresolved questions/checks: Rust E2E (mock backend), Build Playwright E2E Artifact, E2E (Playwright / web lane), Desktop E2E (full suite, 3 OS), Storage e2e on MongoDB

Evidence and run details

• Models: gpt-5.6-luna, glm-5.3-flash
• Spend: $0.007126
• Tokens: 114343 input · 4560 output · 20112 cached · 0 embedding

Head	State	Pass summary
78249f4f0acf	pending	0 active finding(s), 0 resolved finding(s) (at 1791661723)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T19:51:24.238295Z	78249f4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0f7173bb-6981-4d5a-b7d9-43ba00195804

---

📥 Commits

Reviewing files that changed from the base of the PR and between bc59324 and 78249f4.

---

⛔ Files ignored due to path filters (2)

• Cargo.lock is excluded by !**/*.lock
• crates/openhuman-app/Cargo.lock is excluded by !**/*.lock

---

📒 Files selected for processing (14)

• crates/openhuman-core/src/modules/browser_task.rs
• crates/openhuman-core/src/modules/browser_task_tests.rs
• scripts/__tests__/check-openhuman-rust-layout.test.mjs
• vendor/tinyagents
• vendor/tinybus
• vendor/tinycomputer
• vendor/tinyconnectors
• vendor/tinydocs
• vendor/tinyhumans-sdk
• vendor/tinymcp
• vendor/tinymemory
• vendor/tinyruntime
• vendor/tinysearch
• vendor/tinyskills

---

 ________________________
< I came, I saw, I CI'd. >
 ------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0071 · 114,343 in / 4,560 out · 20,112 cached (18%) · gpt-5.6-luna, glm-5.3-flash
critique:    $0.0037 · 47,992 in  / 2,132 out · 8,208 cached (17%)  · gpt-5.6-luna
security:    $0.0033 · 43,890 in  / 1,736 out · 7,232 cached (16%)  · gpt-5.6-luna
tests:       $0.0000 · 5,662 in   / 182 out   · 1,536 cached (27%)  · glm-5.3-flash
description: $0.0000 · 5,267 in   / 111 out   · 1,408 cached (27%)  · glm-5.3-flash
e2e:         $0.0000 · 7,457 in   / 99 out    · 1,728 cached (23%)  · glm-5.3-flash

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 78249f4f0a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Forward the persistent profile to browser tasks

When an operator selects profile_mode = "persistent" and supplies profile_path, this unconditional None is the only profile value sent on StartTask (the module-level configuration in computer_config.rs carries only browser.executable). Consequently browser action=task cannot reuse the configured cookies and logins even though normal sessions honor the same setting in open_session_with_origin; populate browser_profile from the validated path in persistent mode. OpenHuman owns applying this host configuration at the adapter boundary.

AGENTS.md reference: AGENTS.md:L526-L529

Useful? React with 👍 / 👎.