Promote main → release (conflict-resolved)

[M3gA-Mind]

Resolves the merge conflicts that failed the automated Promote main to release workflow (run 30405225559).

Brings 111 commits from main into release, while preserving all 5 commits release owns (the v0.63.6 / v0.63.7 / v0.63.8 cuts and the AppImage userns hotfix #5251).

Merge base was 2219d4207 (chore(release): v0.63.3). main was 111 ahead / 5 behind.

How each conflict was resolved

Version manifests — release's 0.63.8 (higher), main's content kept

Cargo.toml, app/src-tauri/Cargo.toml, app/package.json, app/src-tauri/tauri.conf.json

Release had just cut 0.63.8; main was on 0.63.5. Took 0.63.8. In all four files the version line was the only conflicted hunk — main's dependency and content edits auto-merged cleanly. Verified by diffing each merged file against main's side: version is the sole delta.

Cargo.toml — duplicate dependency key introduced by the merge

This one was not a pick-a-side; the naive merge produced a broken file.

Main migrated tinyhumans-sdk from a git dependency to the vendored vendor/tinyhumans-sdk submodule (ca47efe, with a .gitmodules entry). Release predates that migration and still declares tinyhumans-sdk = { git = ... }. The merge kept both, under the same [dependencies] table.

Verified this was a real break rather than a style question — parsing the un-deduped file gives:

TOMLDecodeError: Cannot overwrite a value (at line 79, column 86)

Cargo would have failed on every build. Dropped release's stale git line, kept main's vendored path dep. This is consistent with the staged submodule pointer and .gitmodules, both of which come from main.

Lockfiles — per-hunk, mirroring the manifests

Cargo.lock (2 hunks), app/src-tauri/Cargo.lock (3 hunks)

• version hunks → 0.63.8, matching the manifests
• tinyhumans-sdk source = "git+…" / reqwest 0.12.28 hunks → main's (a path dependency has no source line, and main's single-version reqwest naming is correct once the git dep is gone)

Not regenerated — the task forbids local cargo builds. Both files parse clean, contain zero residual 0.63.5 references and zero sdk-git-source references, and the openhuman package entry reads 0.63.8. CI is the validator here; if cargo wants to rewrite either lockfile the follow-up is a mechanical regeneration commit.

src/embed/mod.rs (add/add) — main's side

The two sides are byte-identical except two doc-comment lines: release's doctest imports openhuman::embed::Core, main's imports openhuman_core::embed::Core. [lib] name = "openhuman_core" on both sides, so release's path would fail the no_run doctest compile. There is no additive content to union here — only a same-line correctness difference — so main's is taken.

src/api/rest.rs — union (both hunks are main's additions)

Two hunks, both pure additions from main:

1. the parse_api_response_value helper, which normalizes the backend envelope while preserving /auth/me's historical {success,user} shape
2. its call site, Ok(value) => return parse_api_response_value(value)

They are one change and must land together. Release contributed nothing new in either hunk. Verified post-resolution that the function is both defined (L231) and called (L526).

src/openhuman/inference/local/service/lm_studio.rs — main's import list

Release additionally imports LmStudioChatCompletionRequest, LmStudioChatCompletionResponse, LmStudioChatMessage and model_ids.

A union would not compile. Those types exist only on release (defined in src/openhuman/inference/local/lm_studio.rs); the merged copy of that file is main's, so they are absent from the tree entirely. They are also referenced 0 times in the merged file body — main deleted the types and the code using them in the same change. Took main's import list, which matches exactly what the merged body uses.

AGENTS.md — main's section, plus release's rules carried forward

Both sides rewrite the same "backend SDK boundary" section. Main's is the newer, more detailed version documenting the vendored-submodule setup, consistent with the Cargo.toml resolution above, so it supersedes release's.

However main's rewrite drops a rule release states explicitly and main does not state anywhere (checked): no direct reqwest calls for TinyHumans JSON APIs, no duplicated SDK wire types. Rather than let a promotion silently delete a documented prohibition, I took main's section and appended that rule together with the admin/webhook prohibition as a short "Hard rules" block.

vendor/tinyagents — main's 3781540

⚠️ The one resolution that drops something. The pointers genuinely diverged from submodule merge-base ff76d76:

• main 3781540 — 10+ commits release lacks (provider/embedding work: caller-supplied http clients, local embedding dimension discovery, authenticated-ollama credential handling)
• release b6a4120 — 2 commits main lacks: be30296 fix(todos): serialize board deletion and b6a4120 docs(todos): describe raw board lifecycle

Set to main's, because main is the promotion source and the promoted core code compiles against main's tinyagents API surface; reverting to release's older pointer would very likely break the build.

Main already contains an equivalent of the docs commit. be30296 fix(todos): serialize board deletion is genuinely release-only and is not reachable from this pointer. OpenHuman does use that API (src/openhuman/tinyagents/todos.rs), so this wants a follow-up: merge the two tinyagents lines upstream and bump the submodule. Flagging rather than silently choosing.

Release commits preserved — verified

Release commit	Status
220e1a041 v0.63.8	✅ 0.63.8 across all 4 manifests + both lockfiles
42cdf77e7 AppImage userns hotfix (#5251)	✅ auto-merged; userns handling present in both release scripts
14f5fd593 v0.63.7	✅ subsumed by 0.63.8
9c1e2e657 v0.63.6	✅ subsumed by 0.63.8
a40fbb79d Promote main → release (#5242)	✅ shared history

Other submodules audited — all now at main's pointers. vendor/tinycortex differed between branches but release's equals the merge base, so main's wins with nothing lost.

Validation

• No conflict markers anywhere in the tree; no unmerged paths.
• app/package.json and app/src-tauri/tauri.conf.json parse as valid JSON, both at 0.63.8.
• Cargo.toml and app/src-tauri/Cargo.toml parse as valid TOML, both at 0.63.8 — this is what catches the duplicate-key issue above.
• No builds or tests run locally, per the task constraint. CI is the gate, and the lockfiles in particular are unverified locally.

Notes for the merger

• Merge parents are release first, main second, as a promotion should be.
• Do not squash — this is a merge commit carrying main's history into release.
• Follow-up: bump vendor/tinyagents to a commit that also contains be30296.

[greptile-apps]

Too many files changed for review. (113 files found, 100 file limit)

Bypass the limit by tagging @greptile-apps to review.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f99927c4-91ff-463b-9188-e92b310ae505

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1d4f92914d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pass a request id to builder cancellation

When the user clicks Stop and immediately starts another Workflow Copilot turn on the same thread, this fire-and-forget cancel can arrive after the newer turn has registered; because no requestId is passed, the server takes the unscoped None path and cancels whatever turn is currently registered. The backend and flowsBuildCancel already support scoped cancellation specifically to avoid stale Stop clicks killing superseding requests, so the hook needs to mint/retain the build request id and pass it to both buildWorkflow and flowsBuildCancel.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Honor the Sentry shutdown timeout

With a configured Sentry DSN and an unresponsive network/proxy, this blocking .send() has no request timeout; during shutdown the transport calls flush(timeout) and Drop joins the worker thread, but a worker stuck in this POST may never reach the queued flush/shutdown task. That can hang CLI or desktop process exit indefinitely instead of respecting Sentry's shutdown timeout, so the custom client should set a bounded timeout/connect timeout or avoid an unbounded join on the sender thread.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Match cargo-tree owners below the root

I checked cargo tree --invert output: the queried package is printed as the root and its owners are child lines prefixed with tree glyphs (for example └── sentry v...), so this ^sentry v grep never matches the Sentry owner it is meant to forbid. In the Tauri world that means a future Sentry-owned reqwest 0.13 or native-TLS/OpenSSL edge can pass the new TLS policy gate; use --prefix none for the inverted tree too, or match the package name after the tree prefix.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Watch tinyhumans-sdk submodule changes

This commit adds vendor/tinyhumans-sdk as the path dependency for backend routes, but the CI Lite Rust filters only add vendor/motosan-ai-oauth/** and vendor/tinychannels. A later PR that only bumps the SDK gitlink will not set rust-core/rust-core-full, so route or error-classification changes can skip the cargo checks and changed-line coverage even though this vendored SDK is now the source of truth for backend routes. Add the exact gitlink path to both Rust filters.

AGENTS.md reference: AGENTS.md:L180-L185

Useful? React with 👍 / 👎.