[oxoxDev]

Summary

• Re-pin the vendored TinyMCP module from v0.20.4 to v0.20.5 (vendor/tinymcp → 8aa26ba074, tag v0.20.5): registry record, release digests, registry test and both lockfiles.
• v0.20.5 brings tinymcp#157: an OAuth origin issuer now matches with or without a trailing slash.
• v0.20.5 also brings tinymcp#158: tinystoragedrivers moves to the zstd 0.14.3 fix for RUSTSEC-2026-0391/0398/0403 (dev/test-only).

Problem

• TickTick MCP sign-in fails: the server advertises its issuer as https://ticktick.com/ while the origin is https://ticktick.com, and the strict comparison rejected the mismatch. Downstream Chottu users cannot sign in to the TickTick MCP.
• The shipped module is still v0.20.4, so the fix does not reach users until the registry pin moves.

Solution

• vendor/tinymcp → 8aa26ba074acf91b0cd1ec07532e759d079c8f67 (v0.20.5).
• records_mcp_connectors.rs: version, release URL and all 17 archive digests taken from the published v0.20.5 release assets (not a local build); registry_tests.rs asserts the same.
• Cargo.lock and crates/openhuman-app/Cargo.lock: tinymcp / tinymcp-bus 0.20.4 → 0.20.5, nothing else (the range's only manifest change in OpenHuman's graph). Mirrors the previous re-pin (4256667).

Submission Checklist

• Tests added or updated (happy path + at least one failure / edge case) — the TinyMCP registry manifest test now asserts v0.20.5 and the release digests; the issuer and storage tests live in the owning tinymcp repo (tinymcp#157/Integrate Zero Claw–style Telegram assistant with OpenHuman #158)
• N/A: no executable logic changed; the diff is a submodule pointer, registry constants and lockfile versions (Diff coverage ≥ 80%)
• N/A: behaviour-only change, no feature rows added, removed or renamed (Coverage matrix updated)
• N/A: no matrix feature rows affected (All affected feature IDs from the matrix are listed in the PR description under ## Related)
• No new external network dependencies introduced (mock backend used per Testing Strategy)
• N/A: no release-cut surface changes (Manual smoke checklist updated if this touches release-cut surfaces)
• N/A: no tracking issue (Linked issue closed via Closes #NNN in the ## Related section)

Impact

• Desktop and CLI core: the TinyMCP module loaded from the registry-pinned release artifact is now v0.20.5. Only the OAuth issuer comparison in the MCP sign-in flow changes behaviour; nothing else in the module changed apart from dependency pins.
• Security/compat: no contract change (bus contract stays at (1, 28)); zstd bump affects tinystoragedrivers dev/test dependencies only.

Related

• Closes: N/A (no tracking issue)
• Follow-up PR(s)/TODOs: none
• Upstream: fix(oauth): match an origin issuer with or without a trailing slash tinymcp#157, fix(deps): move tinystoragedrivers to the zstd 0.14.3 fix (RUSTSEC-2026-0391/0398/0403) tinymcp#158, release v0.20.5

---

AI Authored PR Metadata (required for Codex/Linear PRs)

Linear Issue

• Key: N/A
• URL: N/A

Commit & Branch

• Branch: chore/tinymcp-0.20.5
• Commit SHA: 0a7cb3f

Validation Run

• N/A: no frontend changes (pnpm --filter openhuman-app format:check)
• N/A: no frontend changes (pnpm typecheck)
• Focused tests: cargo test -p openhuman --lib modules::registry (21 passed); cargo test -p openhuman --lib -- mcp (289 passed); node scripts/ci/check-module-pins.mjs OK; scripts/modules/pin-status.mjs reports tinymcp in sync
• Rust fmt/check (if changed): cargo fmt --check exit 0; cargo clippy -p openhuman -p openhuman-cli -p openhuman-tinyhumans -- -D warnings exit 0
• N/A: only the app lockfile's tinymcp-bus version changed; no Tauri sources touched (Tauri fmt/check (if changed))

Validation Blocked

• command: N/A
• error: N/A
• impact: N/A

Behavior Changes

• Intended behavior change: OAuth origin issuer matches with or without a trailing slash.
• User-visible effect: TickTick MCP sign-in completes.

Parity Contract

• Legacy behavior preserved: issuers that already matched exactly still match; module contract (1, 28) and registry layout unchanged.
• Guard/fallback/dispatch parity checks: registry digest/ABI admission checks untouched.

Duplicate / Superseded PR Handling

• Duplicate PR(s): none
• Canonical PR: this PR
• Resolution (closed/superseded/updated): N/A

🤖 Generated with Claude Code

https://claude.ai/code/session_01MiwnTYiLyeqebY2Bq7S1Vc

Summary by CodeRabbit

• Updates
  • TinyMCP is updated to release 0.20.5, with refreshed downloadable packages for the same supported platforms: Arch Linux, Fedora, macOS, Ubuntu, and Windows.
  • The release information now reflects the updated package names and integrity checks for this version, helping ensure downloads match the published release. No changes were made to the supported platforms or available assets.

[tinysweeper]

Tiny Sweeper review

Reviewed head: 0a7cb3fd1eea88bb38cf9e0fab12f4b1797b6b92

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 2 of 5 files; not reviewed: Cargo.lock, crates/openhuman…, and 1 additional unreviewed files.
Pull request purpose (title): chore(modules): re-p…

Diagnostics and supporting details

Full summary

Pull request purpose (title): chore(modules): re-pin TinyMCP to v0.20.5. Re-pins the vendored TinyMCP module from v0.20.4 to v0.20.5, updating the registry module record's version, release URL and all 17 per-platform archive names and SHA-256 digests, plus the lockstep registry test that asserts the published v0.20.5 release manifest.

Unreviewed paths

• Cargo.lock
• crates/openhuman-app/Cargo.lock
• vendor/tinymcp

Review snapshot

Change surface	Files	Review signal	Count
Production	1	Active findings	0
Tests	1	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The registry record for the TinyMCP module (version, release URL, and every PlatformAsset archive name and sha256 digest) moves from 0.20.4 to 0.20.5, and the release-manifest test is renamed and updated in lockstep so it pins the v0.20.5 archive names and digests, with the bus contract version remaining (1, 28). The manifest test functions that continue to cover the other pinned releases (TinyBox v0.23, TinyMCP v0.20.5) sit in the same test file. The whole-pull-request change set also lists Cargo.lock, crates/openhuman-app/Cargo.lock and vendor/tinymcp.

Features

• Modified — TinyMCP module registry record re-pinned to v0.20.5: The tinyhumansai/tinymcp module loaded from the registry now advertises version 0.20.5 and the corresponding release URL, so users load the v0.20.5 artifact rather than 0.20.4. The load policy and bus contract version are unchanged. (crates/openhuman-core/src/modules/registry/records_mcp_connectors.rs pub(crate) const TINYMCP: ModuleRecord = ModuleRecord {)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 2 files; 0 findings. _The code index is behind this pull request (indexed at `03e62a25930d`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 2 files; 0 findings. _The code index is behind this pull request (indexed at `03e62a25930d`), so retrieved context may be out of date._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change bumps the pinned TinyMCP release from 0.20.4 to 0.20.5 and updates the release-manifest test in lockstep, so every new archive name, URL and digest is pinned by `tinymcp_registry_matches_the_published_v0205_release_manifest`, which fails if the record drifts from the published manifest. That is exactly the kind of gating this data-only change needs; no behavioural gap or rule violation found. _The code index is behind this pull request (indexed at `03e62a25930d`), so retrieved context may be out of date._

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The lane reports an answered status and no sensitive content in committed files. It notes the code index is behind the pull request head.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `03e62a25930d`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The lane reports an answered status, having checked the description's claims against the diff and surrounding code: the registry record, its test and the release digests move from 0.20.4 to 0.20.5 in lockstep, the digest set and asset list are consistent between record and test, and the contract version stays at (1, 28) as the body states. It flags one gap: the description says the diff re-pins the vendor/tinymcp submodule pointer, updates both lockfiles and mirrors the previous re-pin, but the diff shown contains only the two registry files, with no submodule pointer or lockfile changes, which is worth confirming before merge though it may be that those paths are not rendered in this diff view. It notes the code index is behind the pull request head.
• Lane summary: The description's claims were checked against the diff and the surrounding code: the registry record, its test, and the release digests all move from 0.20.4 to 0.20.5 in lockstep, the digest set and asset list are consistent between record and test, and the contract version stays at (1, 28) as the body states. One gap: the body says the diff re-pins the `vendor/tinymcp` submodule pointer, updates both lockfiles, and mirrors the previous re-pin, but the diff shown here contains only the two registry files — no submodule pointer and no lockfile changes. That is worth confirming before merge, though it may simply be that those paths are not rendered in this diff view. _The code index is behind this pull request (indexed at `03e62a25930d`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.010764
• Tokens: 203874 input · 3849 output · 27264 cached · 1414 embedding
• Updated: 2026-10-28T12:36:02Z

Head	State	Pass summary
0a7cb3fd1eea	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-28T12:36:02Z)

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 977d0cb8-febd-43c5-8978-f424d12a7454

Commits

Reviewing files that changed from the base of the PR and between 755862c and 0a7cb3f.

Files ignored due to path filters: 2

• Cargo.lock is excluded by !**/*.lock
• crates/openhuman-app/Cargo.lock is excluded by !**/*.lock

Files selected for processing: 3

• crates/openhuman-core/src/modules/registry/records_mcp_connectors.rs
• crates/openhuman-core/src/modules/registry_tests.rs
• vendor/tinymcp

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The TinyMCP registry record and manifest test now use release 0.20.5, including its platform asset names and SHA-256 checksums. The vendored TinyMCP reference also points to a new commit.

Changes: TinyMCP release pin

Layer / File(s)	Summary
Update TinyMCP release pin crates/openhuman-core/src/modules/registry/records_mcp_connectors.rs, crates/openhuman-core/src/modules/registry_tests.rs, vendor/tinymcp	The registry record and test expectations now use version 0.20.5 and its release assets. The vendored TinyMCP reference changed to a new commit. The host keys and asset set remain unchanged.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Possibly related issues

• Issue 8056 concerns registry release pins and digest updates, which this change also updates for TinyMCP.
• Issue 7343 identifies TinyMCP pin lag, which this release update addresses.

Possibly related PRs

• tinyhumansai/openhuman#8409: Updates the same TinyMCP registry record, test, and vendored reference as an earlier release pin.
• tinyhumansai/openhuman#8412: Updates TinyMCP to the prior release through the same registry, test, and vendor mechanism.
• tinyhumansai/openhuman#8327: Updates TinyMCP pins across the registry, tests, and vendored reference.

Merge Risk: Minimal · up to 0a7cb

The TinyMCP release pin is updated, with no actionable merge-blocking risk identified.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the primary change: re-pinning TinyMCP to version 0.20.5.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 2 files. (1 skipped: 1 unsupported.)

Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks each checksum bright,
The new release names match just right.
Across the hosts, the assets align,
A fresh TinyMCP commit joins the line.
The registry test confirms the way,
Then hops along to greet the day.}

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0108

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T12:37:38.977963Z	0a7cb3f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.