Triage every open pull request and issue

Milestone: Nov 9 - Nov 13 · Parent: tinyhumansai/team#45

On Nov 9 this repo had 3 open PRs and 3 open issues. Try each PR and check each issue against main.

Done when

Every open PR and issue has a triage comment from this pass
Summary comment here

How to triage each item:

Read it, and for a PR check out the branch and try the change: build it, run the tests it touches, and exercise the behaviour it claims (for an issue, try to reproduce it on current main).
Check CI, conflicts, unanswered review feedback, and whether it is a genuine, in-scope contribution.
Leave a comment with the outcome and a next step: ready to merge (and why), needs changes (specific), duplicate or already fixed (link it), or close (with the reason).
Link it to the epic or issue it belongs to, and label it.

Milestone tracking task to triage every open PR and issue (3 PRs, 3 issues) against main: try/read each, leave triage comments with next steps, label them, and post a summary. It's coordination work within a timeboxed milestone, not a bug or new feature.

Labelled priority: p2.

Status update, 2026-11-11 14:50 IST: PRs closed #108, #160. The tables below are the triage as it was done; rows for those items are now settled.

tinymcp: open PR triage (tinymcp#166, team#45)

Official main e098e53 = openhuman's pin (v0.20.6), bus contract (1, 28). Tested on our CI runner: #164 merged onto main, with build, clippy, tests and a behavioural red control. Main's full --lib run has its own timing flakes on Linux in tinybus_module::directories and registry::boot (6 failed with the box idle; all pass solo). Context check (openhuman#8608): none of the 3 PRs touches McpAuthConfig or server env handling.

PR	Verdict	Reason	Next step
#164 OAuth public client (closes #163)	needs changes (small)	CI and CF green; the red control bites (always `client_secret_post` → the `["none"]` test fails). Stores less secret, not more. One correct CodeRabbit README wording nit is open.	Author rewords README.md:315 (or answers), then maintainer review and merge.
#160 tinybox-bus v0.1.36→v0.2.3	close	Lock-only while Cargo.toml pins tag v0.1.36, so every `--locked` job fails. The bump is needed though: on 0.1.x, jailed stdio refuses the 2.x TinyBox openhuman ships.	Close; maintainer does a hand bump (Cargo.toml tag plus lock) to an official-main tag.
#108 tool annotations (fork draft)	superseded / already fixed	`McpRemoteTool.annotations` landed in #104 (contract 1.28). Only the cached `McpTool` is missing, and openhuman has no timeout-retry use of annotations. 364 behind, 1 conflict.	Close, pointing at #104; a small `McpTool` PR later if a host needs it (openhuman builds `McpTool` literals).

Cross-repo finding: tinymcp refuses the TinyBox that openhuman ships (reproduced)

tinymcp's jailed stdio refuses openhuman's shipped TinyBox v0.2.5. tinymcp is built on tinybox-bus v0.1.36 (contract 1.21), and is_compatible((2,3)) is false, so jailed.rs:211 returns Unsupported before any resource is reserved. Proven on our CI runner: the existing refusal test passes with the fake module at (2,3), and the real constants are (1,21) vs (2,3) → false. openhuman jails every stdio MCP server by default and never marks one operator_trusted, so by reading every stdio MCP server in the app is refused; remote servers aren't affected. Fix: a hand bump of tinymcp's tinybox-bus tag to v0.2.5 (not #160), fix the misleading "too old" message, release, then the openhuman pin. Details: tinymcp-sr006.md.

Issues

Issue	Verdict	Reason	Next step	Priority
#168 Windows `npx` → os error 193	still real	Windows `executable_candidates` tries the bare name before PATHEXT, and any file counts as executable off Unix (`spawn_env/mod.rs:353-369`, :335). By reading; CF is Linux.	Fix in tinymcp (PATHEXT first), classify as a launch error, add the both-files test.	p1
#167 registry 404/422 as raw errors	still real	404 → `Error::Http` via `shared.rs` read_body, not UnknownServer; `fetch_page` sends `search` for any non-empty query (`official/mod.rs:432-434`); openhuman doesn't classify either.	tinymcp: 404 → UnknownServer, no short search. openhuman: treat it as expected user state.	p2
#163 OAuth public client	still real	main always registers `client_secret_post`; CF repro: main's line gets the 400 from a public-only stand-in.	Fixed by #164 (one README nit left); merging it closes this.	p1
#165 MCP 2026-07-28	still real (tracking)	Latest is 2025-11-25 (`tinymcp-bus/transport/types.rs:9`); not started.	Keep open as a p3 tracker; include #164's auth in the review.	p3
#49 curated servers at runtime	still real (feature)	`CURATED_SERVERS` is a compiled const (`curation/servers.rs:14`), with no runtime merge.	Maintainer decides: build the host-file design, or close as won't-do.	p3

Triage summary: this repo is at zero open PRs and zero open issues.

Fixed and merged:

Register as a public client when the authorization server only supports none #163: OAuth registers as a public client when the server accepts only none (fix(oauth): register as a public client when the server accepts only none (#163) #164).
Jailed stdio refuses the TinyBox 2.x that openhuman ships: tinymcp is still on tinybox-bus 0.1.36 (contract 1.21) #169: jailed stdio builds on tinybox-bus v0.2.5, so the shipped TinyBox is accepted (Build jailed stdio on tinybox-bus v0.2.5 so the shipped TinyBox is accepted #171).
Official MCP registry: lookup of an unlisted server (404) and searches under 3 characters (422) surface as raw HTTP errors and reach Sentry #167: an unlisted registry server is reported as unknown, and too-short searches are skipped (Report an unlisted registry server as unknown, and skip too-short searches #176).
On Windows, a stdio MCP server with command npx spawns the extensionless npx shell script and fails with os error 193 #168: a stdio server that cannot be started is reported as a launch failure (Report a stdio server that cannot be started as a launch failure #177).
Feature: add curated servers at runtime without a release #49: a host can add curated servers at runtime, and they are never badged official (Let a host add curated servers at runtime, never badged official #178).

Also merged:

An upstream registry row never gets the official badge (Never take the official badge from an upstream registry row #170).
OAuth endpoints are guarded by default (Guard OAuth endpoints by default, exempting only operator-declared local servers #172).
Every registry row is kept when curated servers lead a first page (Keep every registry row when curated servers lead a first page #173).
A bare Windows command resolves through PATHEXT (Resolve a bare Windows command through PATHEXT before the bare name #175).

Contract history: 1.29, 1.30, 1.31, 1.32. #165 was closed until its spec is released.

Navigation Menu

Repository navigation

Triage every open pull request and issue #166

Done when

tinymcp: open PR triage (tinymcp#166, team#45)

Cross-repo finding: tinymcp refuses the TinyBox that openhuman ships (reproduced)

Issues

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Triage every open pull request and issue #166

Description

Done when

Activity

tinysweeper commented on Nov 9, 2026

M3gA-Mind commented on Nov 11, 2026

tinymcp: open PR triage (tinymcp#166, team#45)

Cross-repo finding: tinymcp refuses the TinyBox that openhuman ships (reproduced)

Issues

M3gA-Mind commented on Nov 11, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions