build: tinybus by version range, patched to nested vendor (0.1.5)

[senamakel]

Part of tinyhumansai/openhuman#7610, #7543, #7523

tinybus deps become >=0.1.3, <0.2 (no path dependency); [patch.crates-io] points at nested vendor/tinybus, bumped to 0.1.5. Build, 1446 tests and clippy 1.98 pass.

Summary by CodeRabbit

• Chores
  • Updated build configuration to resolve compatible TinyBus versions consistently from the bundled source. This change affects how the project selects components during builds; it does not add or remove end-user features or change the app’s visible behavior.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T17:56:56.269483Z	a876429	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9ba0df9f-e3af-41ef-b727-d3c76c33eaa0

📥 Commits

Reviewing files that changed from the base of the PR and between 90ea7ef and a876429.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• Cargo.toml
• vendor/tinybus

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The manifest now specifies compatible version ranges for tinybus and tinybus-module, and patches three TinyBus crates to vendored paths. The vendor/tinybus submodule reference also changed.

Changes: TinyBus dependency update

Layer / File(s)	Summary
TinyBus dependency resolution Cargo.toml, vendor/tinybus	The manifest accepts tinybus and tinybus-module versions from 0.1.3 up to, but not including, 0.2. It patches tinybus, tinybus-macros, and tinybus-module to vendored paths. The vendor/tinybus submodule reference changed.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to a8764

No concrete build or behavior regression is established, so the change appears mergeable. The vendored source diff could not be inspected.

### Architecture Summary

Architecture risk: 🔵 Low · up to a8764

The change affects 1 system.

Changed systems: Cargo.toml

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — Cargo.toml (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in Cargo.toml: tinybus and tinybus-module changed from exact 0.1.2 dependencies at vendored paths to version ranges >=0.1.3, <0.2; tinybus retains disabled default features and its macros and modules features.
• observed — Modified behavior in Cargo.toml: A [patch.crates-io] section was added to resolve tinybus, tinybus-macros, and tinybus-module from their vendored submodule paths.
• observed — Modified behavior in vendor/tinybus: The vendor/tinybus submodule pointer now references commit eb5cf727071a6eb12f9efa3db8ec59e54039f336 instead of 356bb24f30d7863d81569c7e1f07a7ae60feda48.

Pre-merge checks · 5

Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately and concisely describes the main change: using a TinyBus version range and patching it to the nested vendor at version 0.1.5.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the crate-version range,
Then follows the patch paths, neat and plain.
The TinyBus pointer hops ahead,
To a newer commit where it’s led.
One manifest, one submodule change.}

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a87642912c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve direct paths to the vendored TinyBus crates

When tinycomputer is consumed from a parent workspace, Cargo ignores this dependency manifest's [patch.crates-io]; unless that parent duplicates all three patches, these version-only dependencies are resolved from crates.io, where the comment states TinyBus is unavailable, and the build fails before compilation. The previous direct paths made the pinned gitlink self-contained, and repository guidance explicitly requires retaining exact path dependencies unless a new module capability necessitates changing them. Keep the path entries while addressing host crate unification through a mechanism that does not make every parent workspace supply hidden patches.

AGENTS.md reference: AGENTS.md:L356-L361

Useful? React with 👍 / 👎.

[tinysweeper]

Tiny Sweeper review

The change repoints the two TinyBus workspace dependencies from submodule path dependencies to crates-io version ranges (>=0.1.3, <0.2) backfilled by a [patch.crates-io] block over the same vendored submodule, matching the stated intent of building by version range with a patch to the nested vendor. No lane reported a defect in the diff itself. Multiple reviewers were unable to verify the vendored submodule contents or the lockfile state in this deployment, leaving whether the patched crates satisfy the version requirement and whether Cargo.lock still records the removed path entries unresolved. The tests lane reports no behavioural change, and the commits lane found nothing sensitive. Several lanes note the code index is behind this pull request (indexed at a083057), so retrieved context may be out of date.

State: Ready for maintainer review
Priority: none
Reviewed head: a87642912cf4
Updated: 2026-10-13T23:31:53Z

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

Cargo.toml is modified to replace the TinyBus dependency entries' submodule paths with crates-io version ranges (>=0.1.3, <0.2) retained with their default-features and feature list, and a new [patch.crates-io] section is added mapping tinybus, tinybus-macros, and tinybus-module back to nested vendor/tinybus submodule paths. The review evidence reports no other files changed and no behavioural change in tests.

Features

• Modified — TinyBus dependency declared by crates-io version range with patch override: The host dependency is rewired from a submodule path to a crates-io version range, letting a host workspace (OpenHuman) override the same crates-io entries with its own single copy while standalone builds resolve through the nested submodule via [patch.crates-io]. Reviewers could not confirm the patched crates satisfy >=0.1.3, <0.2 because the vendored submodule is not readable in this deployment. (Cargo.toml#tokio = { version = "1", features = ["macros", "rt-multi-thread", "time"] }, Cargo.toml#agent-desktop-linux = { path = "vendor/agent-desktop/crates/linux" })

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The mechanism is the standard way to let a host workspace override a non-published crate, and the ranges and patch entries are described as mutually consistent (a range requirement paired with an exact-version patch override).
• Lane summary: This change replaces the vendored TinyBus path dependencies with crates-io version ranges (>=0.1.3, <0.2) plus a [patch.crates-io] section pointing back at the same submodule paths, and rewrites Cargo.lock accordingly. The mechanism is the standard way to let a host workspace override a non-published crate, and the ranges and patch entries are mutually consistent (a range requirement paired with an exact-version patch override), but I could not verify one point: `tinybus` (and `tinybus-module`) are not on crates.io, and the diff does not update Cargo.lock to match. I was not permitted to read `vendor/tinybus` or fetch Cargo.lock from the index, so I cannot confirm whether the lockfile still records the removed `version = "0.1.2"` path entries; if it does not, `cargo build --locked` fails for everyone. _The code index is behind this pull request (indexed at `a083057e1159`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Nothing in the diff itself was identified as a reportable defect, and no untrusted-input path, secret, or permission change was found.
• Lane summary: The change repoints the two TinyBus workspace dependencies from submodule path dependencies to crates-io version ranges backfilled by a `[patch.crates-io]` block over the same vendored submodule, which is a coherent arrangement for letting a host workspace substitute its own copy. The vendored submodule is not readable in this deployment, so I could not verify that `vendor/tinybus/crates/tinybus-macros` exists or that the patched versions satisfy `>=0.1.3, <0.2`; nothing in the diff itself is a reportable defect, and I found no untrusted-input path, secret, or permission change here. _The code index is behind this pull request (indexed at `a083057e1159`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Positive: Nothing sensitive found in what this pull request commits.
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The change matches the described intent of building by version range and patching to the nested vendor.
• Lane summary: The change rewires the workspace to take tinybus, tinybus-macros and tinybus-module as version ranges with a [patch.crates-io] redirect to the nested vendor/tinybus submodule, matching the described "build by version range, patched to nested vendor" intent. The one visible gap is that the submodule's own manifests were not verifiable from here (vendor/tinybus is not checked out), so I cannot confirm the patched crates publish the 0.1.5 version the body claims; nothing in the diff itself is a defect. _The code index is behind this pull request (indexed at `a083057e1159`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000279
• Tokens: 116384 input · 3433 output · 20096 cached · 102 embedding

Head	State	Pass summary
a87642912cf4	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-13T23:31:53Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0003 · 116,384 in / 3,433 out · 20,096 cached (17%) · ladder/vectors-oai3, deepseek-v4.1-flash · 102 embedded
critique:    $0.0001 · 46,746 in  / 1,016 out · 7,168 cached (15%)  · deepseek-v4.1-flash
security:    $0.0001 · 47,217 in  / 900 out   · 6,912 cached (15%)  · deepseek-v4.1-flash
description: $0.0001 · 20,288 in  / 769 out   · 6,016 cached (30%)  · deepseek-v4.1-flash