Repository navigation
chore: finish upstream module roll-up integration - #8512
Merged
Merged
Conversation
Contributor
|
Important Review skippedToo many files! This PR contains 369 files, which is 69 over the limit of 300. To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch. Usage-priced reviews support at most 300 files.
 |
Removed the tinystoragedrivers-types dependency from the app's lockfile since nothing references it anymore, and updated the vendored tinywallet submodule to a newer commit. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Update the vendored tinywallet submodule to the latest upstream commit. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Bump the vendored tinywallet submodule to a newer commit. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Update the vendored tinywallet submodule to the latest upstream commit. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Wrap the repair-start barrier and turn join in ten-second timeouts so a regression that stalls cancellation fails the test instead of hanging the suite. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The cancellation test now reports the number of non-supplemental model calls when the supplemental repair fails to start, making intermittent failures easier to diagnose. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Added a total call counter to the gated repair model so the panic message reports both overall and non-supplemental model call counts, making it easier to diagnose why the supplemental repair never started. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The cancellation test waited only 10 seconds for the model to signal that repair had started, which could flake on slower CI machines. The timeout is now 60 seconds so the test waits for the signal rather than racing it. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
…uests Adapt the channel tests to the reworked progressive transport API, replacing the boxed Send variant with SendTyped and supplying the new channel, conversation, and sequencing fields. The signed-in test helper is now awaited and output-event turn ids are non-optional, keeping the suite aligned with the updated request shapes. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Adjust the test imports so ChannelRef, ConversationKind, and ConversationRef come from the tinychannels_bus root rather than the module_progressive module, matching where those types now live. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
…tools example The tools closure moved recorded_calls into the async block while also referencing it, which would not compile. Cloning it outside the async move lets the Ping tool take ownership without a borrow conflict. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The non-security-module build of provider_host_is_local previously always returned false, so localhost and private addresses were never treated as local. It now normalises the host and classifies loopback, private, link-local and unspecified IPv4/IPv6 addresses, with tests covering the new behaviour. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The fallback path in provider_host_is_local now returns false for every host when the security-module feature is disabled, instead of classifying loopback, private, and link-local addresses itself. The duplicated host parsing and its test were removed so local-host detection has a single implementation behind the security module. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Shortened the wait for the supplemental repair to start from 60s to 5s and added the turn's finished state to the panic message, so a stalled run fails fast and the diagnostic shows whether the turn already completed. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The shared config fixture now turns off secrets encryption so hosted-client tests can store credentials in disposable workspaces without booting the TinySecurity module that the encrypted store depends on. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
…heck The local-model URL heuristic now also accepts localhost names and loopback, private, link-local, or unspecified IP literals directly, so it no longer depends on TinySecurity's module classifier being loaded while the host resolves its own API endpoint. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
…port The hosted adapter tests no longer boot TinySecurity, and config() already disables config-secret encryption for their disposable workspace, so storing a session token needs no module-owned cipher scope. The one-time environment setup and master key initialization are removed as dead weight. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The unreachable embedder fixture now installs a lightweight egress guard that emits the host disclosure event directly, so the disclosure path can be exercised without loading a native TinySecurity artifact. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
…registry lock Test configs now set secrets.encrypt to false so credential storage does not require an encryption key, and the registry lock is acquired through the async variant in async tests to avoid blocking the runtime. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The three cloud transcription tests each built the same Config by hand, so a test_config helper now centralises that setup and takes the optional API URL as a parameter. This removes the duplication and keeps the secret encryption setting consistent across the tests. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Updated the runtime tests to assert that controller extensions include the Inference domain group alongside Hosted, matching the current forwarding behaviour. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Test config helpers now set secrets.encrypt to false so tests don't depend on an encryption backend being available. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Reformatted two expressions to satisfy rustfmt and changed the realtime test to mutate the default config's secrets field instead of overriding the whole struct. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The self-hosted CI installer now stages the pinned TinySecurity module alongside the other test modules, and the asset list and installation test cover it. The core test suite exercises keyring and privacy decisions through this module, so it must be available on the verified local-file callback path. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Extend the CI installer test to verify that TinySecurity is resolved from the registry with a valid checksum and that the install command includes it alongside the other callback modules, so policy tests have the module they need. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The config-based store, get, and has helpers now delegate to AuthService instead of the state-dir variants, so API keys are persisted and read through the same profile path as other provider tokens. Blank keys are rejected up front and read failures are logged and treated as absent. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
…te-dir variants The store, get, and has helpers that take a Config now delegate to their existing state-dir counterparts instead of duplicating the AuthService lookup logic, so all paths share one implementation. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
clear_api_key now builds the auth service from the configured state directory and encryption flag instead of from_config, so removal targets the same store that stored the key. Test fixtures disable secret encryption since they only need a local credential to satisfy model readiness. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The helper that seeds a pending nudge now runs the failing shell call twice with distinct call ids, so the fixture matches the failure count the middleware expects before it nudges. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
…t copy wallet_host.rs carried its own copy of native_intent_matches_quote and web3_approval_matches_request plus their helpers, identical to tinywallet_bus::intent (which the wallet roll-up extracted from here). Call the crate's matchers so a matcher fix lands in one place: the TRC-20 binding fix (tinywallet#124) reaches the host with the next vendor/tinywallet bump. No behaviour change at the current pin.
Collaborator
|
Correction to the last bullet of the security/credentials note above. The two openhuman-app |
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
|
|
||
| #[test] | ||
| fn lookup_openai_bearer_token_returns_session_expired_error_when_refresh_fails_on_expired_token() { | ||
| #[tokio::test] |
There was a problem hiding this comment.
Keep the refresh-failure tests out of a tokio runtime
This test is built entirely on the premise written in its own comment: "no tokio runtime available (so try_refresh_oauth_token returns Err)". Converting it to `#[tokio::test]` makes that premise false. The token is 5 minutes past expiry with `refresh_token: Some("refresh")`, so `lookup_openai_oauth_credentials` enters the refresh branch and calls `try_refresh_oauth_token`, which in `security/credentials/openai_oauth/store.rs` does `if let Ok(handle) = tokio::runtime::Handle::try_current()` — now `Ok` — and then `tokio::task::block_in_place(|| handle.block_on(refresh_access_token(&cfg, &refresh)))`. `#[tokio::test]` defaults to the current-thread flavor, where `block_in_place` panics ("can call blocking only when running on the multi-threaded runtime"), so the test panics instead of getting the `authentication token is expired` error it asserts on. The same applies to `lookup_openai_bearer_token_returns_ok_when_nearly_expiring_and_refresh_fails` if its profile also carries a `refresh_token` (that line is outside the diff, so I could not confirm it): 30 seconds to expiry is inside the 2-minute skew, so it would hit the same `block_in_place`. Only that test's expectation (`Ok(Some(..))`) differs, not the path taken. The fix is not to add `flavor = "multi_thread"`: that would let the refresh proceed and issue a real request to the OpenAI token endpoint, which the repository forbids ("Tests must not call real backend or third-party services; avoid time-based flakes and real network access in unit tests"). Give the refresh a deterministically failing target instead — set `OPENAI_CODEX_OAUTH_TOKEN_URL` (read only under `#[cfg(test)]` via `local_refresh_url_override`, loopback-only) to a `wiremock::MockServer` that answers 500, the way the mock-server test in this same file already does, and keep the test async.
[RULE] tokio-runtime-assumption ·
|
|
||
| #[test] | ||
| fn disconnect_openai_oauth_clears_profile() { | ||
| #[tokio::test] |
There was a problem hiding this comment.
Drop the nested runtime in the async disconnect test
The body of this test still contains ```rust runtime() .block_on(disconnect_openai_oauth(&config)) .unwrap(); ``` where `runtime()` is the file-local `tokio::runtime::Runtime::new()`. That was fine while the test was a plain `#[test]`; now that the function is an `async fn` driven by `#[tokio::test]`, the poll happens inside a runtime context and `Runtime::block_on` on a second runtime panics with "Cannot start a runtime from within a runtime". The test never reaches the `openai_oauth_status` assertions. Since `disconnect_openai_oauth` is already async, await it on the test's own runtime: replace that block with `disconnect_openai_oauth(&config).await.unwrap();`.
[RULE] tokio-runtime-assumption ·
tinysweeper
Bot
added
priority: p1
Brings in tinyhumansai#8510 (cron live_agents), tinyhumansai#8520 and tinyhumansai#8526 (voice const).
…gain Alpha's job runs every millisecond, so it is legitimately due again when the second pass over the same agent starts. That pass dispatching it shows the scope the first pass released was free; a refused scheduler start errors.
vendor/tinychannels moves from 6b0197ef to 8aca8d3, the TinyChannels #164 head, whose workspace version is 0.2.0, so the version requirements in openhuman-core and openhuman-cli move from "0.1" to "0.2". 8aca8d3 restores the channel API shapes the base code was written for: boxed progressive results, an optional output turn_id, the ClearHistory session_scope, the Route capabilities and configured_channel, flat read receipt and reaction actors, and the send error's unsupported flag. Return those call sites and their tests to the base code. Edit outcomes are again EditUnsupported only when the provider says so, so a single Forbidden or BadFormat edit no longer disables progressive edits for the whole provider. EditMessage now takes a boxed intent, and the bus capabilities_for table is gone, so thread projection uses the host table in channels::capabilities.
TinyChannels removed both configs (6b42fd5a). No provider ever served them, and openhuman has no UI, docs or runtime path that reads them; only the secret encrypt and decrypt pass touched their tokens. Remove the re-exports and those secret branches. ChannelsConfig ignores unknown keys, so an existing [channels.matrix] or [channels.webhook] section still loads and is dropped on the next save.
Dropping the Matrix and Webhook configs makes serde ignore an existing [channels_config.matrix] or [channels_config.webhook] section, and the next save removes it. Log one warning per section at load naming it, never its values, so the user knows why it disappears.
At the #164 head the progressive transport result is boxed again and Delete, Typing and OutputEvent carry an optional turn_id. Box the hosted callback's result as the base code did and update the channel tests.
The lib tests and two library sites still used the 6b0197ef shapes that the #164 head (and the app's generated chatWire types) no longer have: - user_error carries no message or error_retryable; the frontend's user_error type never had them, so cron stops setting them - the turn timing payload reports total_ms, not elapsed_ms - relay final-message parts are already outbound parts - channel events use source_timestamp, a SenderRef actor and a reaction identity without the custom flag, so host_tests return to base - the progressive transport result is boxed, the prepared inbound has history_key_ignores_thread, the delivery terminal result a receipt and the outbound intent its channel, conversation and turn references
…eanup Regenerate both lockfiles for the tinychannels 0.2.0 repin. Its module also pulls tinyvoice-bus from tinyvoice cf64444 by git, next to the vendored copy. Drop the user_error message and error_retryable fields from the embed facade test and the Matrix and Webhook imports from the config harness, and rewrap the two re-export lists rustfmt now joins.
The tui had been narrowed to the 6b0197ef web events (output_chars on tool results, no skill or display fields, nested test contexts, and no sub-agent rows). At the #164 head the web events are back to the shapes main's tui was written for, so restore crates/openhuman-tui to main.
…tions The #164 head declares the legacy migration source collections next to the dotted ones (tinychannels 3740b576), so docs:generate lists the channel_remote_*, channels_delivery_* and unprefixed whatsapp_* names.
…e it The bridge was a process-wide RwLock, so a cron test that installed an empty bridge leaked into channel_origin_fails_when_the_channel_runtime_is_not_running, which then saw 'configured channel module is unavailable'. HookSlot is per-thread under cfg(test) and process-wide otherwise.
The pinned tinyagents (c3d7d32) derives JsonSchema on RunMode without rename_all, so the thread wire schema named its variants Build/Plan and chat-wire:check wanted to regenerate threadWire.generated.ts to match. The runtime wire never serializes that type; it carries the mode_label strings build/plan. Describe the schema with a local mirror that uses those labels, and test that every schema value round-trips through parse_mode_label. Remove the mirror once the pin includes tinyagents bafab14.
…s 0.3.6 series)
Brings tinywallet#124's intent fixes to the host through tinywallet_bus::intent: TRC-20 intents are bound to the quote's token, recipient and amount, and EVM native recipients compare case-insensitively. No manifest changes, so neither lockfile moves.
Resolves the wallet_host.rs conflict with tinyhumansai#8529 by keeping this branch's use of tinywallet_bus::intent, and drops tinyhumansai#8529's host-side wallet_host_trc20.rs: vendor/tinywallet ffe91c6 carries the same TRC-20 binding in the crate matcher. tinyhumansai#8529's native_trc20_* tests are kept. Also applies rustfmt's import order to sandbox/ops.rs, which arrived unformatted from main (tinyhumansai#8318).
tinysweeper
Bot
added
priority: p3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up integration for the changes merged in #8487. This updates OpenHuman’s adapters for current upstream module APIs, completes the async TinySecurity credential call sites, refreshes generated storage schemas, and adds native channel/storage projection regressions. Shared permission queries use TinySecurity’s audited API; artifact materialization reserves the full private workspace before writing. Prompt screening takes configuration from the owning request or supplied host config, and positive native tests run with explicit isolated host contexts.
This branch also fixes disabled-autonomy authorization so registered tools and shell commands do not require TinySecurity when
[autonomy] enabled = false. Channel restrictions, unknown-tool denial, and scheduled-turn restrictions remain enforced. Scheduler agent test contexts now carry the config required by prompt screening. Failure recovery classifies the original tool outcome before redaction, while persisting only sanitized summaries, so withheld details cannot erase a terminal policy denial.Upstream prerequisites
This remains a draft until module changes are merged and published as compatible releases. TinyAgents #590 has merged; the following remain open:
Local validation
Latest host batch:
e809d5845250b5dd73c51b08a63dc59762d3a1ae. Normal push hooks pass (formatting, frontend lint/typecheck, strict core/CLI/TinyHumans/Tauri clippy, and UI tokens). Full local and hosted CI remain under repair.b9fe55f320, profile/channel/session nextest slice: 117/117 passed. This includes the actual native Telegram provider (typing before reply, exact reply text), all six host-pipeline cases, canonical encrypted profile storage, explicit secret ownership, keyring denial/rollback, cleanup preserving concurrent updates, native error scrubbing, and the cold-turn prompt contract.6b0197ef: 1,798/1,798 workspace all-feature library tests, 69/69 bus tests without default features, strict all-target/all-feature clippy, the native dependency boundary and negative controls, official source-artifact build, and three real native artifact tests pass. The actor now sends text-only typed intents as provider text while retaining delivery identity; rich parts retain their envelope. All eight review threads were answered and resolved, and a new review requested.058ae8c: 1,313/1,313 nextest cases, strict all-target/all-feature clippy, and the exact CI 90% per-file coverage gate pass. Native master/cipher, device, and audited permission verifiers run from repository and external working directories. Permission vocabulary coverage is 100%; audited dispatch is 92.86%. Hosted macOS and Windows Rust jobs pass; Ubuntu was still pending at the last check.Still incomplete: