Bump tinyconnectors to direct-route Composio triggers

[senamakel]

Summary

• Moves the vendor/tinyconnectors gitlink from 25330d2 to the merged 00c5609 (Offer Composio triggers on the direct route to hosts that receive webhooks tinyconnectors#72, "Offer Composio triggers on the direct route to hosts that receive webhooks"). Contract 1.21 -> 1.22, additive.
• The new tinyconnectors carries opt-in direct-route Composio triggers (a webhooks flag on the direct credential/configure request) plus webhook signature verification and delivery decoding behind an opt-in bus webhook feature, new optional fields on ComposioTriggerMetadata, and new Error variants.
• OpenHuman code needs two minimal compile fixes: webhooks: false on the ComposioDirectCredential it builds, and ..Default::default() on the trigger metadata it constructs (the three new fields are empty by default).
• The branch also contains earlier auto-checkpoint commits that captured stale submodule checkouts; one commit restores every other vendor/* pointer to main's, so the net diff against main is the tinyconnectors gitlink plus the two code lines.

Problem

OpenHuman pins an older tinyconnectors; hosts cannot use the new direct-route trigger support until the pin moves.

Solution

Bump the pin and adapt the two struct literals. Because webhooks defaults to false, OpenHuman behaviour is unchanged.

Submission Checklist

• Tests added or updated: N/A, no behaviour change; existing composio tests cover the touched code paths
• Diff coverage: N/A, two single-line struct-literal additions
• Coverage matrix: N/A, behaviour-only change
• Feature IDs: N/A
• No new external network dependencies introduced
• Manual smoke checklist: N/A, not a release-cut surface
• Linked issue: N/A

Impact

None for OpenHuman users: no API or behaviour change; the direct route's trigger/webhook support stays off (webhooks: false). Validation run locally:

• cargo check -p openhuman -p openhuman-cli --all-targets: compiles clean (no error[E...]).
• cargo test -p openhuman --lib: passed (composio filter and wider lib run, 0 failed).
• rustfmt --check on the touched files: clean. Workspace cargo fmt -- --check and cargo clippy -p openhuman -p openhuman-cli -p openhuman-tinyhumans -- -D warnings report existing unused-import / needless-borrow findings in files this PR does not touch (also present on main locally); left alone.

Related

• Closes: N/A
• Upstream change: Offer Composio triggers on the direct route to hosts that receive webhooks tinyconnectors#72

---

AI Authored PR Metadata

Linear Issue

• Key: N/A
• URL: N/A

Commit & Branch

• Branch: bump-tinyconnectors-direct-triggers

Summary by CodeRabbit

• Bug Fixes
  • Composio trigger events now receive default values for metadata that isn’t explicitly set, improving consistency in event records.
• Changes
  • Direct Composio credentials now keep webhooks disabled, aligning credential behavior with the updated integration configuration.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T13:52:25.027923Z	69f4715	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 946414a1-6e83-49f2-9df6-c44420d43187

📥 Commits

Reviewing files that changed from the base of the PR and between 69f4715 and 67915ce.

📒 Files selected for processing: 1

• scripts/ci/module-pin-exemptions.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

Composio trigger metadata now fills unspecified fields from defaults, and module credentials set webhooks to false. The vendor/tinyconnectors reference changes, and CI pin-exemption configuration records the expected pin description and accepted drift.

Changes: Composio Defaults

Layer / File(s)	Summary
Composio metadata and credentials crates/openhuman-core/src/integrations/composio/bus/trigger_subscriber.rs, crates/openhuman-core/src/integrations/composio/client/credential.rs	Trigger metadata fills unspecified fields from ComposioTriggerMetadata::default(). module_credential sets webhooks to false.

tinyconnectors Reference

Layer / File(s)	Summary
tinyconnectors pin and exemption vendor/tinyconnectors, scripts/ci/module-pin-exemptions.json	The subproject reference changes to commit 00c5609b34c8eb20ee2e3a6d2afa9c6e1c429e24. CI pin-exemption configuration records its expected pin description and accepted drift.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Suggested reviewers: m3ga-mind

Merge Risk: ⚪ Minimal · up to 67915

The change sets Composio direct-route webhooks to disabled, fills trigger metadata defaults, and bumps the tinyconnectors pin with a matching CI exemption. No concrete merge-blocking risk was found, and behavior should remain unchanged.

### Architecture Summary

Architecture risk: 🔵 Low · up to 67915

The change affects 2 systems.

Changed systems: crates, scripts

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — crates (service) was modified; 2 changed files map to changed impact.
• observed — scripts (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in crates/openhuman-core/src/integrations/composio/bus/trigger_subscriber.rs: Trigger metadata now initializes fields not explicitly set from ComposioTriggerMetadata::default().
• observed — Modified behavior in crates/openhuman-core/src/integrations/composio/client/credential.rs: module_credential now sets the module credential’s webhooks field to false.
• observed — Modified behavior in scripts/ci/module-pin-exemptions.json: The previously empty exemptions array now contains a tinyconnectors record with an exact expected pin description and a reason describing the accepted drift.
• observed — Modified behavior in vendor/tinyconnectors: The vendor/tinyconnectors subproject commit reference was updated from 25330d26510206b906de3aae66d08bc2c4bba6fe to 00c5609b34c8eb20ee2e3a6d2afa9c6e1c429e24.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the primary change: updating tinyconnectors to support direct-route Composio triggers.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the metadata fields,
And sets the webhook flag to rest.
A connector finds its pinned commit,
With CI noting what to expect.
The carrot patch applauds the change,
While moonlit paws tap out a test.}

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 69f471563e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper completed its review; deterministic results follow.

State: Incomplete
Priority: none
Reviewed head: 67915ce6993c
Updated: 2026-10-15T14:22:16Z

Review snapshot

Change surface	Files	Review signal	Count
Production	2	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	2

Completeness: Incomplete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Could not review: crates/openhuman-core/src/integrations/composio/client/credential.rs, scripts/ci/module-pin-exemptions.json

Before merge

• Complete the critique review for crates/openhuman-core/src/integrations/composio/client/credential.rs, scripts/ci/module-pin-exemptions.json.

How this fits together

flowchart LR
  n0["DirectCredential<br/>changed"]:::changed
  n1["direct_tool_for_mock_with_key"]:::impacted
  n2["for_tool"]:::impacted
  n3["..._reads_go_through_the_hosts_runtime_proxy"]:::impacted
  n4["...s_come_back_without_route_lifted_identity"]:::impacted
  n1 -->|uses| n0
  n2 -->|uses| n0
  n3 -->|calls| n1
  n3 -->|tests| n1
  n3 -->|calls| n2
  n3 -->|tests| n2
  n4 -->|calls| n1
  n4 -->|tests| n1
  n4 -->|calls| n2
  n4 -->|tests| n2
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Loading

Agent review details

critique

• Conclusion: Success
• Scope reviewed: incomplete; unanswered: crates/openhuman-core/src/integrations/composio/client/credential.rs, scripts/ci/module-pin-exemptions.json
• Lane summary: The change adds `..Default::default()` to a `ComposioTriggerMetadata` literal, filling the remaining fields with defaults. The struct's definition lives in the `tinyconnectors_bus` submodule, which is not checked out, so I could not verify it derives `Default` or inspect what the defaulted fields mean — everything below reflects that limit. `mod.rs` re-exports the type, and its docs say the serde form is a wire contract pinned in tests, which suggests non-unit-semantic fields like `received_at` exist, but I cannot confirm the field set. No defect is demonstrable from what I can see: the literal previously set `id` and `uuid`, and the added rest-pattern only compiles if the struct implements `Default`, so the change cannot silently fail to compile — at worst the defaulted values (e.g. empty strings, epoch timestamps) could produce history entries with wrong metadata, which I cannot rule in or out without the submodule. Given that the only inputs to this code path are the destructured fields already present, and the change's only observable effect is the value of unshown fields, I am reporting no finding at higher than low confidence and have settled on none rather than speculate: the reachable consequences I could construct (dropped triggers, misrouted events, archive failures) all trace back to fields I could not inspect, so asserting one would be padding. The rest of the handler — the direct-mode gate, the triage gates, the envelope construction — is unchanged by this diff and reads as consistent with its documented fail-open/fail-closed behaviour. This looks safe to merge pending the author confirming the defaulted fields on `ComposioTriggerMetadata` are semantically empty, not meaningful (e.g. a timestamp that the archive sorts or filters by). No findings: the diff is a one-line initializer rest-pattern whose correctness turns entirely on a type definition I was not shown, and inventing a defect for it would be padding rather than review. If `Default` for `ComposioTriggerMetadata` sets any field to something other than its semantically-empty value (e.g. a `received_at` timestamp used for dedup or ordering), that would be a real bug — the author is best placed to confirm it is not, since the type lives in a submodule not visible from here. Empty findings list is deliberate: every candidate failure mode requires an assumption about unseen code that the evidence does not support making, let alone at reportable confidence. The change does not touch any repository rule from AGENTS.md — it adds no dynamic imports, no analytics, no test file, and stays within the composio domain directory, so there is no rule violation to report either. Final: no findings, low-confidence residual concern about `Default` on a submodule type documented as a wire contract, not convertible into a defensible comment. Merging is fine if the author knows what `Default` yields for the remaining fields; if not, they should check before merging. That is the review. The file is otherwise unchanged from line 1 through line 271 except for this added line 107, and the surrounding code I read is coherent. Ending here rather than manufacturing a finding about unshown code — the summary already states the residual concern explicitly, so nothing is lost. Done. 2 files could not be reviewed: crates/openhuman-core/src/integrations/composio/client/credential.rs, scripts/ci/module-pin-exemptions.json. _The code index is behind this pull request (indexed at `343c5183dc11`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 3 files; 0 findings. _The code index is behind this pull request (indexed at `343c5183dc11`), so retrieved context may be out of date._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: I need to verify two things before a verdict: whether the Composio trigger payload type actually gained a `webhooks` field (i.e. whether `..Default::default()` is silently filling a new field that direct-route triggers expect to be set), and whether `DirectCredential::direct_request_payload`'s new `webhooks: false` is opt-in as the exemption reason claims or whether it disables existing behaviour. I also want to see the surrounding subscriber and credential code to judge what test coverage the behavioural lines need. Requesting reads of the trigger subscriber, the credential file, the `ComposioTriggerMetadata` type and the `tinyconnectors-bus` contract definitions it touches. _The code index is behind this pull request (indexed at `343c5183dc11`), so retrieved context may be out of date._

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: _The code index is behind this pull request (indexed at `343c5183dc11`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, glm-5.3-flash
• Spend: $0.002166
• Tokens: 161057 input · 6511 output · 0 cached · 117 embedding

Head	State	Pass summary
67915ce6993c	incomplete	0 active finding(s), 0 resolved finding(s) (at 2026-10-15T14:22:16Z)

[tinysweeper]

tinysweeper found nothing blocking, but could not review everything, so this is not an approval: crates/openhuman-core/src/integrations/composio/client/credential.rs, scripts/ci/module-pin-exemptions.json.

             $0.0022 · 161,057 in / 6,511 out · 0 cached (0%) · ladder/vectors-oai3, glm-5.3-flash · 117 embedded
critique:    $0.0011 · 55,412 in  / 2,243 out · 0 cached (0%) · glm-5.3-flash
security:    $0.0008 · 85,020 in  / 2,435 out · 0 cached (0%) · glm-5.3-flash
tests:       $0.0001 · 12,773 in  / 162 out   · 0 cached (0%) · glm-5.3-flash
description: $0.0001 · 5,431 in   / 94 out    · 0 cached (0%) · glm-5.3-flash