[senamakel]

Summary

Bumps the workspace to 0.2.5 so a release can carry #145, the fix that lets the openshell backend run against a real gateway. The release also carries the agent37 backend (#143, #144), merged since 0.2.4.

Related issue

None.

API or behavior changes

Version numbers only: the workspace version and the sibling crate pins in [workspace.dependencies].

Validation

• cargo check -p tinybox-openshell -p tinybox-module --locked: passes

windows-latest feature-tests is expected to stay red: its run_native_shell_* tests also fail on main.

After this merges, a v0.2.5 tag at the merged commit publishes the release.

Co-authored-by: Medulla medulla@tinyhumans.ai

Summary by CodeRabbit

• Chores
  • Updated the workspace package version from 0.2.4 to 0.2.5.
  • No changes to public interfaces or end-user features are reported. This update contains no noted changes to how the product looks or behaves; the release information is limited to the package version update.

[tinysweeper]

Tiny Sweeper review

Reviewed head: efbab8a79a18ea97374fa5bfcbc0937d94987637

Findings

No active actionable findings.

Resolved this pass

• Bump workspace dependency versions alongside the package version
• Bump workspace dependency versions alongside the package version
• Bump workspace dependency versions alongside the package version

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 1 of 2 files; not reviewed: Cargo.lock.

Diagnostics and supporting details

Full summary

Pull request purpose (title): chore(release): tinybox 0.2.5. This pull request, "chore(release): tinybox 0.2.5", bumps the workspace to 0.2.5 so a release can carry #145 (the fix letting the `openshell` backend run against a real gateway) plus the agent37 backend work (#143, #144) merged since 0.2.4. The whole-pull-request diff spans `Cargo.toml` and `Cargo.lock` with 27 additions and 27 deletions: `[workspace.package].version` moves 0.2.4 → 0.2.5, and every internal sibling pin in `[workspace.dependencies]` (`tinybox-agent37`, `tinybox-bus`, `tinybox-core`, `tinybox-host`, `tinybox-jail`, `tinybox-linux`, `tinybox-microvm`, `tinybox-docker`, `tinybox-openshell`, `tinybox-ssh`, `tinybox-sync`, `tinybox-drivers`) moves in lockstep; the pinned `tinystoragedrivers` git dependencies are unchanged. The commits lane notes one earlier finding still open, though it reports no sensitive content. No push delta is available for this review state.

Unreviewed paths

• Cargo.lock

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	3
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

`[workspace.package] version` in `Cargo.toml` is raised from 0.2.4 to 0.2.5, and every internal path dependency in `[workspace.dependencies]` — `tinybox-agent37`, `tinybox-bus`, `tinybox-core`, `tinybox-host`, `tinybox-jail`, `tinybox-linux`, `tinybox-microvm`, `tinybox-docker`, `tinybox-openshell`, `tinybox-ssh`, `tinybox-sync` and `tinybox-drivers` — is bumped to the matching 0.2.5, with a corresponding `Cargo.lock` update. Git-pinned `tinystoragedrivers` entries stay at 2.1.2. No dependency, feature, permission, or code changes are introduced.

Features

• Modified — Workspace release version bump to 0.2.5: Raises the workspace package version so a `v0.2.5` tag at the merged commit can publish a release carrying the `openshell` real-gateway fix (Fit OpenShell names and read its lifecycle phase #145) and the agent37 backend work (Add the agent37 hosted HTTP sandbox backend #143, Admit agent37 module Exec through its own HTTP channel #144). No crate code or behaviour changes. (Cargo.toml members = [)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change is a pure version bump: `[workspace.package]` moves to 0.2.5 and every internal path dependency in `[workspace.dependencies]` moves with it, which resolves the earlier concern about workspace dependency versions drifting from the package version. `Cargo.lock` at this commit already carries 0.2.5 for the workspace crates, so there is nothing left inconsistent within this file. _The code index is behind this pull request (indexed at `6c0d6c2453b1`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The version bump to 0.2.5 is applied consistently: every internal path dependency in `[workspace.dependencies]` (including `tinybox-drivers`) moves to the matching version, and a search of the tree finds no remaining `0.2.4` reference. The earlier finding about mismatched workspace dependency versions is fixed, and the diff introduces no dependency, permission or code change that could carry a security consequence. _The code index is behind this pull request (indexed at `6c0d6c2453b1`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The commits lane answered that there is no sensitive content in committed files, while noting that one earlier finding is still marked open.
• Lane summary: No sensitive content in committed files. (1 earlier finding(s) still open) _The code index is behind this pull request (indexed at `6c0d6c2453b1`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change is a pure version bump: `[workspace.package] version` and every internal sibling pin in `[workspace.dependencies]` move to 0.2.5, and the lockfile already resolves all `tinybox-*` crates at 0.2.5 with no `0.2.4` remaining anywhere in the tree. The description matches the diff exactly, and the earlier concern about stale sibling pins is resolved. _The code index is behind this pull request (indexed at `6c0d6c2453b1`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.005411
• Tokens: 217866 input · 20005 output · 44160 cached · 79 embedding
• Updated: 2026-11-05T10:17:13Z

Head	State	Pass summary
6c0d6c2453b1	changes requested	1 active finding(s), 0 resolved finding(s) (at 2026-11-05T09:53:12Z)
efbab8a79a18	ready for maintainer review	0 active finding(s), 3 resolved finding(s) (at 2026-11-05T10:17:13Z)

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The manifest updates the workspace package version and all listed internal tinybox-* path-dependency versions from 0.2.4 to 0.2.5.

Changes: Version declarations

Layer / File(s)	Summary
Workspace and dependency versions Cargo.toml	The workspace package and listed internal tinybox-* path dependencies, including tinybox-drivers, now specify version 0.2.5 instead of 0.2.4.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Possibly related issues

• tinyhumansai/tinybox issue 27: This PR updates the workspace and sibling crate versions to 0.2.5, addressing the version alignment described in the issue; the other release tasks are outside this diff.

Possibly related PRs

• tinyhumansai/tinybox#139: This PR continues the version updates from 0.2.4 introduced in PR #139.
• tinyhumansai/tinybox#145: The release objectives include PR #145, while this diff itself changes only version declarations.

Suggested reviewers: m3ga-mind, sanil-23

Merge Risk: Minimal · up to efbab

The version declarations are consistent, with no identified issue blocking merge after normal release checks.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the release version bump to tinybox 0.2.5, which matches the main change in the pull request.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the manifest with care
The workspace version hops to five
Its tinybox neighbors follow along
Their path pins match the new release
Then carrots await in the burrow
While tags and numbers settle in}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d5e6bfd4-9829-4478-a394-9d4f00b93a78

Commits

Reviewing files that changed from the base of the PR and between f3693f4 and efbab8a.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 1

• Cargo.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T10:18:36.536298Z	efbab8a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tinysweeper]

Requesting changes: 1 lane(s) blocking, worst finding is high.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

Diagnostics

Total spend: $0.0000

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6c0d6c2453

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update the internal dependency requirements with the release

For this 0.2.5 release, all twelve internal path dependencies in [workspace.dependencies] still specify version = "0.2.4". Although those compatible caret requirements accept the new local packages, they leave the declared dependency floors at the previous release. AGENTS.md explicitly requires release PRs to update “package versions and matching local dependency constraints”; bump these requirements to 0.2.5 alongside the workspace version and lockfile.

AGENTS.md reference: AGENTS.md:L287-L289

Useful? React with 👍 / 👎.

[tinysweeper]

The previously-blocking findings are resolved. Clearing the changes request.

Diagnostics

Total spend: $0.0054