Repository navigation
chore(vendor): bump tinybox, tinymcp, tinycomputer and tinybus to their latest releases - #7863
Conversation
Tiny Sweeper reviewTiny Sweeper reviewed this change across 5 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below. State: Incomplete Review snapshot
Completeness: Incomplete FeaturesNone identified with supported citations. TestsNo supported feature-to-test mapping was produced. Test execution is not inferred. FindingsNo active actionable findings. Could not review: crates/openhuman-core/src/modules/registry/records_extra.rs, crates/openhuman-core/src/modules/registry_tests.rs Before merge
How this fits togetherflowchart LR
n0["approve_browser_action<br/>changed"]:::changed
n1["asset_for"]:::impacted
n2["supported_host_keys"]:::impacted
n3["run"]:::impacted
n4["format"]:::impacted
n5["...cord_publishes_for_every_host_or_for_none"]:::impacted
n6["...s_registry_matches_scoped_runtime_release"]:::impacted
n0 -->|calls| n4
n3 -->|calls| n0
n5 -->|calls| n1
n5 -->|tests| n1
n5 -->|calls| n2
n5 -->|tests| n2
n6 -->|calls| n1
n6 -->|tests| n1
classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff
Agent review detailscritique
security
tests
commits
description
Evidence and run details
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 7 files. (4 skipped: 4… | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly summarizes the main change: updates to the tinybox, tinymcp, tinycomputer, and tinybus vendored components. It is concise and specific.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 7 files. (4 skipped: 4 unsupported.)
- Fix all pre-merge checks with AI
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A rabbit checks each hash in line
Three release paths now shine
A press can carry e7
Or leave its target bare
The test hops through each case
Then nibbles greens with grace
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
There was a problem hiding this comment.
tinysweeper found nothing blocking, but could not review everything, so this is not an approval: crates/openhuman-core/src/modules/registry/records_computer.rs, crates/openhuman-core/src/modules/registry/records_extra.rs, crates/openhuman-core/src/modules/registry/records_mcp_connectors.rs, crates/openhuman-core/src/modules/registry_tests.rs, crates/openhuman-core/src/tools/impl/browser/browser.rs, crates/openhuman-core/src/tools/impl/browser/browser_computer_tests.rs, crates/openhuman-core/src/tools/impl/browser/browser_pending.rs, tinysweeper/tests.
$0.0028 · 266,140 in / 12,378 out · 22,400 cached (8%) · ladder/vectors-oai3, glm-5.3-flash · 1,719 embedded
critique: $0.0011 · 122,619 in / 4,453 out · 13,440 cached (11%) · glm-5.3-flash
security: $0.0006 · 69,513 in / 2,561 out · 8,960 cached (13%) · glm-5.3-flash
description: $0.0006 · 50,892 in / 5,052 out · 0 cached (0%) · glm-5.3-flash
tinysweeper
Bot
added
the
priority: p3
Gitlink 7ceaf5c3 (v0.1.33) -> bcea8a77 (v0.1.34). The registry record is
rewritten by scripts/modules/release-and-repin.mjs --version 0.1.34 from the
release's checksum.toml (17 assets); the registry_tests fixture follows it.
Contract 1.18 -> 1.19 is additive: NetworkPolicy::Allowlist and the
SandboxEvent vocabulary. The host only constructs NetworkPolicy::{default,
Open, Egress} and never matches on it.
Both lockfiles change only the version lines of the tinybox path crates.
Gitlink f5f4f338 (v0.18.4) -> b3694845 (v0.18.5). The registry record is rewritten by scripts/modules/release-and-repin.mjs --version 0.18.5 from the release's checksum.toml (17 assets); the registry_tests fixture follows it. 0.18.5 only adds a pluggable stdio spawner inside tinymcp; tinymcp-bus and its contract are unchanged. Both lockfiles change only the version lines of tinymcp and tinymcp-bus.
Gitlink ce952115 (v0.13.1) -> 060ee987 (v0.14.0). The registry record is rewritten by scripts/modules/release-and-repin.mjs --version 0.14.0 from the release's checksum.toml (17 assets); the registry_tests fixture follows it. Contract 2.17 -> 2.19: - 2.18 gives BrowserAction::Press an optional target, so the host's approval text match and one test literal take the new field. The approval prompt now names a targeted press's element, as it already does for a targeted Type; the approval test covers both shapes. - 2.19 adds the optional ConsequenceHost interface. The host does not serve it, so the existing needs_approval pause stays the only gate. Nested submodule pins (agent-browser, agent-desktop, tinyinference) are unchanged between the two tags. Both lockfiles change only the version lines of the tinycomputer path crates.
Gitlink f11987b0 (untagged, 2 behind) -> d621ed0a (v0.1.6). The two commits only move the workspace version 0.1.5 -> 0.1.6; there is no code change. Every vendored module requires tinybus >=0.1.3, <0.2, so the root [patch] still applies. Three lockfiles carry the tinybus path crates (root, openhuman-app and the storage_probe_module fixture, including its [[patch.unused]] tinybus-macros entry); each changes only those version lines.
9ac377d to
feea386
Compare
There was a problem hiding this comment.
tinysweeper found nothing blocking, but could not review everything, so this is not an approval: crates/openhuman-core/src/modules/registry/records_extra.rs, crates/openhuman-core/src/modules/registry_tests.rs.
$0.0323 · 581,035 in / 32,760 out · 49,408 cached (9%) · ladder/vectors-oai3, glm-5.3-flash · 1,719 embedded
critique: $0.0032 · 105,557 in / 4,908 out · 8,960 cached (8%) · glm-5.3-flash
security: $0.0198 · 314,286 in / 15,183 out · 15,872 cached (5%) · glm-5.3-flash
tests: $0.0030 · 62,971 in / 3,160 out · 24,576 cached (39%) · glm-5.3-flash
description: $0.0044 · 77,899 in / 6,880 out · 0 cached (0%) · glm-5.3-flash
1 participant
Summary
vendor/submodule against its repository's latest release (openhuman main 11626da, 2026-10-15). Four components were behind their latest release; each is bumped in its own commit:chore(modules): bump tinybox to v0.1.34chore(modules): bump tinymcp to v0.18.5chore(modules): bump tinycomputer to v0.14.0(includes the host port for contract 2.18)chore(vendor): bump tinybus to v0.1.6Problem
Several gitlinks and registry records lag their components' published releases.
States come from
gh api repos/tinyhumansai/<repo>/compare/<latest-tag>...<gitlink>.Solution
Module bumps (tinybox, tinymcp, tinycomputer) each update every place a module is pinned:
records_*.rs), both viascripts/modules/release-and-repin.mjs <id> --version X.Y.Z. That rewritesversion,release_urland all 17 assets'archive+sha256verbatim from the release'schecksum.toml; no digest is computed locally;modules/registry_tests.rs, ported from the old record to the new one by host key;scripts/test-rust-with-mock.shreads the tinybox asset from the registry).A repo-wide
git grep(outsidevendor/and lockfiles) finds no remaining old digest or old version for any of the three.Lockfiles: every lockfile that carries a bumped crate changes only the
versionlines of that component's path crates:Cargo.lockandcrates/openhuman-app/Cargo.lockfor all four;tests/fixtures/storage_probe_module/Cargo.lockfor tinybus, including its[[patch.unused]]tinybus-macros entry.The edits were made without a re-resolve. For each lockfile,
grep -E '^[-+][^-+]' | grep -v '^[-+]version = 'over the diff is empty, andcargo metadata --lockedpasses on all three manifests.Contract changes:
NetworkPolicy::Allowlistand theSandboxEventvocabulary. The host only constructsNetworkPolicy::{default, Open, Egress}and never matches on it.NetworkPolicylostCopy; no host site copies it.targettoBrowserAction::Press. The host match inbrowser.rsand one test literal take the new field.approval_targetnow names a targeted press's element in the approval prompt, as it already did for a targetedType, so a model-supplied press target is never hidden from the user.approval_describes_selector_and_locator_targetscovers the targeted and untargeted shapes.ConsequenceHostinterface. The host does not serve it, so the existingneeds_approvalpause stays the only gate (per the contract doc: "A host that serves nothing leaves the pause as the only gate").tinymcp-busis unchanged.tinybus >=0.1.3, <0.2, so the root[patch]still applies.Nested submodule pins inside tinybox and tinycomputer are unchanged between the old and new tags, and
git submodule status --recursiveshows no drift.Not in this PR: tinyagents
At audit time, v2.9.x removed the path-based transcript API (tinyagents#453) that openhuman still used, so it was left to the storage series. Main has since pinned tinyagents to v2.9.0 (8f1bc5f2) along with that migration. This PR leaves the tinyagents gitlink at main's pin.
Submission Checklist
registry_tests.rsfixtures follow each new release, the contract-version asserts move to 1.19 / 2.19, andapproval_describes_selector_and_locator_targetscovers the new targeted / untargetedPressapproval text.browser_pending.rs, exercised by the updated approval test.Impact
Related
AI Authored PR Metadata (required for Codex/Linear PRs)
Linear Issue
Commit & Branch
Validation Run
pnpm --filter openhuman-app format:check: no frontend files changed.pnpm typecheck: no frontend files changed.rustfmt --checkon the changed Rust files;cargo check --locked -p openhuman --libpassed (exit 0) via ci-slot;node scripts/ci/check-module-pins.mjsandcheck-submodule-monotonic.mjspass. The changed test files are not compiled by--lib; CI compiles them.Validation Blocked
command:N/Aerror:N/Aimpact:N/ABehavior Changes
Parity Contract
Duplicate / Superseded PR Handling