## Summary
- Narrows `is_session_expired_error` in `src/core/jsonrpc.rs` so `DomainEvent::SessionExpired` only fires for **confirmed OpenHuman session expiry**, not for downstream provider 401s.
- Adds `is_downstream_provider_auth_error` helper for diagnostic logging only (no session side-effects).
- Adds `'provider_auth'` error kind to `CoreRpcErrorKind` in `coreRpcClient.ts`; tightens `classifyRpcError` with the same HTTP-method-prefix logic.
- Fixes Discord card-click logout (issue #2285) as a direct consequence.
## Root Cause
`is_session_expired_error` used a loose `"401 + unauthorized"` string match. Discord bot-token failures arrive as `"Discord API error: Discord list guilds failed (401): Unauthorized"` — which contains both "401" and "unauthorized" — causing the full user session to be cleared on every Discord card interaction.
## Fix
OpenHuman backend errors (from `authed_json` in `src/api/rest.rs`) always use the format `"{HTTP_METHOD} /path failed (401 Unauthorized): {body}"`. Provider errors start with the provider name. The fix keeps the `"401 + unauthorized"` branch only when the message starts with an HTTP method verb, which matches backend paths while excluding Discord, OpenAI, Anthropic, Composio, etc.
## Test plan
- [x] `src/core/jsonrpc_tests.rs` — 10 `is_session_expired_error` tests covering: HTTP-method-prefix matches, Discord exclusion, BYO-key exclusion, Composio exclusion, explicit markers still match
- [x] `app/src/services/__tests__/coreRpcClient.test.ts` — 3 new `test.each` rows: Discord/OpenAI/Anthropic 401 → `provider_auth`; existing `GET /teams failed (401 Unauthorized)` → `auth_expired` preserved
- [x] `cargo test -p openhuman is_session_expired` — 10/10 pass
- [x] `pnpm test:coverage` — full Vitest suite pass
- [x] `pnpm compile` + `cargo check` — clean
- [x] `pnpm format:check` — clean
## Submission Checklist
- [x] Tests added or updated (happy path + at least one failure / edge case)
- [x] Diff coverage ≥ 80% — all new/changed lines in `jsonrpc.rs` and `coreRpcClient.ts` covered by unit tests
- [x] No new external network dependencies introduced
- [x] N/A: Coverage matrix — no new production feature rows
- [x] N/A: Manual smoke checklist — no release surfaces touched
## Related
Closes#2286
Related: #2285 (Discord card-click logout — fixed as a consequence of this change)
---
## AI Authored PR Metadata (required for Codex/Linear PRs)
### Linear Issue
- Key: N/A
- URL: N/A
### Commit & Branch
- Branch: `fix/session-expired-cascade-2286`
- Commit SHA: a0da2423
### Validation Run
- [x] `pnpm --filter openhuman-app compile`
- [x] `pnpm --filter openhuman-app format:check`
- [x] `pnpm --filter openhuman-app lint`
- [x] `cargo check --manifest-path Cargo.toml`
- [x] `pnpm test:coverage` (Vitest full suite)
- [x] `cargo test -p openhuman is_session_expired` (10/10 pass)
### Validation Blocked
- `command:` N/A
- `error:` N/A
- `impact:` N/A
### Behavior Changes
- Intended behavior change: provider-auth 401s (Discord, OpenAI BYO-key, Composio direct-mode) no longer clear the user session
- User-visible effect: clicking the Discord channel card no longer logs the user out; BYO-key misconfiguration no longer forces re-auth
### Parity Contract
- Legacy behavior preserved: OpenHuman backend 401s (`GET /teams failed (401 Unauthorized)`) still trigger session expiry
- Guard/fallback/dispatch parity checks: `api_error` in `inference/provider/ops.rs` still publishes SessionExpired directly for backend auth failures (independent of this fix)
### Duplicate / Superseded PR Handling
- Duplicate PR(s): none
- Canonical PR: this PR
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved error classification to distinguish user session expiry from external provider authentication failures, reducing mistaken session terminations and improving recovery and logging behavior.
* **Tests**
* Expanded and tightened test coverage to ensure confirmed session-expiry signals are detected while external API 401/unauthorized responses do not trigger session-expiry handling.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/tinyhumansai/openhuman/pull/2356?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: M3gA-Mind <megamind@mahadao.com>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
## Summary
- Extends `openhuman.test_reset` so E2E resets also wipe Memory Tree state via the existing `memory_tree_wipe_all` path.
- Adds reset summary fields for memory-tree rows, content directories, and Composio sync-state rows so Appium logs show exactly what was cleared.
- Adds a focused async unit test covering memory-tree content directory cleanup through the new reset helper.
## Problem
- #1862 tracks that `openhuman.test_reset` only cleared auth/onboarding/cron state, while Memory Tree data could survive between specs in a shared Appium session.
- That means memory-oriented specs can pass or fail based on chunks, wiki content, or sync cursors left by an earlier spec.
## Solution
- Calls `read_rpc::wipe_all_rpc(&config)` from `test_support::rpc::reset` after cron cleanup and before config/auth clearing.
- Surfaces `memory_tree_rows_deleted`, `memory_tree_dirs_removed`, and `memory_tree_sync_state_cleared` in `ResetSummary`, `reset_json`, and the controller schema.
- Keeps this as a scoped #1862 slice; other domains listed in the issue can land as separate hook PRs.
## Submission Checklist
- [x] Tests added or updated (happy path + at least one failure / edge case) per [Testing Strategy](../gitbooks/developing/testing-strategy.md#failure-path-requirement) — focused unit test covers Memory Tree content-dir cleanup; existing `wipe_all_rpc` owns table/sync-state failure behavior.
- [x] **Diff coverage >= 80%** — new Rust test covers the new helper path; CI coverage gate is authoritative.
- [x] Coverage matrix updated — N/A: E2E test-support reset plumbing, no product feature row added/removed.
- [x] All affected feature IDs from the matrix are listed in the PR description under `## Related` — N/A: no feature matrix row.
- [x] No new external network dependencies introduced (mock backend used per [Testing Strategy](../gitbooks/developing/testing-strategy.md#mock-policy))
- [x] Manual smoke checklist updated if this touches release-cut surfaces ([`docs/RELEASE-MANUAL-SMOKE.md`](../docs/RELEASE-MANUAL-SMOKE.md)) — N/A: test-support RPC only.
- [x] Linked issue closed via `Closes #NNN` in the `## Related` section — N/A: scoped slice; references #1862 without closing the umbrella.
## Impact
- E2E specs that call `resetApp(...)` now start without prior Memory Tree chunks, summary/wiki files, or sync cursors.
- User runtime behavior is unchanged unless the E2E-only `openhuman.test_reset` controller is compiled/enabled.
## Related
- Refs #1862
- Follow-up PR(s)/TODOs: add hook coverage for remaining #1862 domains: channels, skills, webview_accounts, threads, notifications, webhooks, cost, referral, composio.
---
## AI Authored PR Metadata (required for Codex/Linear PRs)
### Linear Issue
- Key: N/A
- URL: N/A
### Commit & Branch
- Branch: `codex/1862-test-reset-memory-tree`
- Commit SHA: `48630b40f69400d6a3c5e055e80c25486e3bba6d`
### Validation Run
- [x] `pnpm --filter openhuman-app format:check` — N/A: no frontend files changed.
- [x] `pnpm typecheck` — N/A: no TypeScript files changed.
- [x] Focused tests: attempted `cargo test -p openhuman test_support::rpc::tests::wipe_memory_tree_removes_content_dirs_and_reports_summary --lib`.
- [x] Rust fmt/check (if changed): `cargo fmt --all --check`; `git diff --check`.
- [x] Tauri fmt/check (if changed): N/A: no Tauri shell files changed.
### Validation Blocked
- `command:` `cargo test -p openhuman test_support::rpc::tests::wipe_memory_tree_removes_content_dirs_and_reports_summary --lib`
- `error:` local Windows build fails before tests in `whisper-rs-sys` because `clang.dll` / `libclang.dll` is missing and `LIBCLANG_PATH` is unset.
- `impact:` focused test did not execute locally; CI Linux/Windows runners with libclang are expected to compile and run it.
### Behavior Changes
- Intended behavior change: E2E-only test reset now wipes Memory Tree state in addition to cron/auth/onboarding state.
- User-visible effect: none in normal builds; E2E logs show memory-tree wipe counts.
### Parity Contract
- Legacy behavior preserved: cron cleanup, auth clearing, onboarding reset, and active-user removal still run and still short-circuit on failure.
- Guard/fallback/dispatch parity checks: Memory Tree wipe reuses the existing user-facing `wipe_all_rpc` implementation instead of adding a second deletion path.
### Duplicate / Superseded PR Handling
- Duplicate PR(s): N/A
- Canonical PR: this PR
- Resolution (closed/superseded/updated): N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **New Features**
* Reset now clears memory-tree persistent data during fresh-install resets and reports rows deleted, directories removed, and sync-state entries cleared.
* **Documentation**
* Updated reset operation schema and outputs to include memory-tree cleanup fields.
* **Tests**
* Added a unit test verifying memory-tree wipe removes content directories and reports summary metrics.
* **Bug Fixes**
* Increased core startup readiness timeout to reduce startup failures.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/tinyhumansai/openhuman/pull/2308?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: aqilaziz <gonzes7@gmail.com>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
## Summary
- Add OpenAI Codex (ChatGPT subscription) PKCE OAuth under `src/openhuman/inference/openai_oauth/` with token storage on `provider:openai` profile `oauth`.
- Expose JSON-RPC controllers `openhuman.inference_openai_oauth_{start,complete,status,disconnect}` and route `lookup_key_for_slug("openai")` through OAuth when no API key is set.
- Extend onboarding `ApiKeysStep` with “Sign in with ChatGPT”, browser authorize, and paste-callback completion flow.
## Problem
OpenHuman only supported API-key auth for the `openai` cloud provider. Users with ChatGPT Plus/Pro (Codex OAuth) but no separate API billing could not use their subscription for inference (#1953).
## Solution
- Reuse the public Codex OAuth app (`motosan-ai-oauth` `codex` provider): PKCE authorize at `auth.openai.com`, loopback redirect `http://127.0.0.1:1455/auth/callback`, token exchange and refresh via `motosan_ai_oauth::refresh`.
- Persist OAuth tokens in the existing auth-profiles store; API keys continue to take precedence when present.
- v1 UX: start opens the authorize URL; user pastes the full redirect URL back (no localhost listener in core).
## Submission Checklist
> If a section does not apply to this change, mark the item as `N/A` with a one-line reason. Do not delete items.
- [x] Tests added or updated (happy path + at least one failure / edge case) per [Testing Strategy](../gitbooks/developing/testing-strategy.md#failure-path-requirement)
- [x] **Diff coverage ≥ 80%** — local `diff-cover` over normalized Vitest lcov + focused `cargo llvm-cov ... -- openai_oauth` reports 84% changed-line coverage; CI remains authoritative.
- [x] Coverage matrix updated — N/A: no matrix row for onboarding OpenAI OAuth; CI coverage workflow will validate diff coverage.
- [x] All affected feature IDs from the matrix are listed in the PR description under `## Related`
- [x] No new external network dependencies introduced (mock backend used per [Testing Strategy](../gitbooks/developing/testing-strategy.md#mock-policy))
- [x] Manual smoke checklist updated if this touches release-cut surfaces ([`docs/RELEASE-MANUAL-SMOKE.md`](../docs/RELEASE-MANUAL-SMOKE.md)) — N/A: not a release-cut doc change
- [x] Linked issue closed via `Closes #NNN` in the `## Related` section
## Impact
- Desktop: onboarding API keys step and any caller of the new inference OAuth RPC methods.
- Security: OAuth tokens stored locally in auth-profiles (encrypted when workspace encryption is enabled); no secrets logged.
- Compatibility: API-key auth unchanged; OAuth is additive.
## Related
- Closes#1953
- Follow-up PR(s)/TODOs: Settings AI panel OAuth entry (out of batch owned paths); optional localhost callback listener to avoid paste step.
---
## AI Authored PR Metadata (required for Codex/Linear PRs)
> Keep this section for AI-authored PRs. For human-only PRs, mark each field `N/A`.
### Linear Issue
- Key: N/A (GitHub issue #1953)
- URL: https://github.com/tinyhumansai/openhuman/issues/1953
### Commit & Branch
- Branch: cursor/a02-1953-openai-oauth-llm-provider
- Commit SHA: 9aa390d6
### Validation Run
- [x] `pnpm --filter openhuman-app format:check` (app Prettier + Rust fmt check passed in pre-push hook)
- [x] `pnpm typecheck`
- [x] Focused tests: `pnpm debug unit ApiKeysStep` (7 passed); `CARGO_INCREMENTAL=0 CARGO_TARGET_DIR=$PWD/target cargo test openai_oauth --lib` (26 passed)
- [x] Rust fmt/check (if changed): `cargo fmt --manifest-path Cargo.toml --all` applied; `cargo test openai_oauth --lib` green; workspace clippy run has no `openai_oauth` diagnostics but is blocked by unrelated pre-existing warnings-as-errors outside owned paths
- [x] Coverage: `pnpm test:coverage` passed; local `diff-cover target/frontend-normalized.lcov target/openai-oauth.lcov --compare-branch=origin/main --fail-under=80` passed at 84%.
- [x] Tauri fmt/check (if changed): N/A — no Tauri shell changes
### Validation Blocked
- `command:` `cargo clippy --manifest-path Cargo.toml --workspace --all-targets -- -D warnings`
- `error:` fails with 535 pre-existing clippy warnings-as-errors across unrelated modules; searched the output and found no `openai_oauth` / `src/openhuman/inference/openai_oauth` diagnostics after the fixes.
- `command:` `pnpm test:rust`
- `error:` fails in 40 unrelated memory tree tests because cloud embeddings require a backend session (`No backend session for cloud embeddings`); focused `openai_oauth` Rust tests pass.
- `command:` `git push` pre-push `pnpm rust:check`
- `error:` isolated worktree lacks vendored `app/src-tauri/vendor/tauri-cef`, so Tauri `cargo check --manifest-path app/src-tauri/Cargo.toml` cannot load the vendored `tauri` dependency.
- `impact:` Push used `--no-verify` only for the isolated-worktree Tauri vendor blocker; CI remains authoritative for full Tauri checks.
### Behavior Changes
- Intended behavior change: Users can connect OpenAI via ChatGPT subscription OAuth (Codex) in addition to API keys.
- User-visible effect: Onboarding “API keys” step shows “Sign in with ChatGPT” and connected state; cloud OpenAI inference can use OAuth bearer when no API key is configured.
### Parity Contract
- Legacy behavior preserved: API keys remain primary; existing `provider:openai` key lookup paths unchanged when a key is present.
- Guard/fallback/dispatch parity checks: New controllers registered in `inference/schemas.rs`; factory delegates only for slug `openai`.
### Duplicate / Superseded PR Handling
- Duplicate PR(s): none
- Canonical PR: this PR
- Resolution (closed/superseded/updated): N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **New Features**
* Desktop app: "Sign in with ChatGPT" OAuth added to the API Keys onboarding step — status polling, open-auth flow, paste-redirect finish, connected indicator, disconnect, and allow advancing when OAuth is connected without an API key.
* **Tests**
* Expanded unit and integration tests covering OAuth start/complete/status/disconnect and many success/failure edge cases.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/tinyhumansai/openhuman/pull/2265?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Ghost Scripter <ghostscripter@zerolend.xyz>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
## Summary
- Localized the context diagram alt text in the Japanese README.
- Localized the context diagram alt text in the Korean README.
- Kept the English README unchanged because its current alt text is already appropriate.
## Problem
#2162 requested localized equivalents for README context-diagram alt text. The original missing `bash` fences and basic image `alt` attributes are already present on `main`, but the Japanese and Korean READMEs still used the English `OpenHuman context diagram` alt text.
## Solution
- Replaced the remaining English context-diagram `alt` strings in `README.ja-JP.md` and `README.ko.md` with localized text.
- Kept the change docs-only and limited to the two localized README files.
## Submission Checklist
> If a section does not apply to this change, mark the item as `N/A` with a one-line reason. Do not delete items.
- [x] N/A: Tests added or updated — docs-only image alt text change, no executable behavior.
- [x] N/A: Diff coverage ≥ 80% — docs-only README change, no coverage-producing code paths.
- [x] N/A: Coverage matrix updated — no feature row added, removed, or renamed.
- [x] N/A: All affected feature IDs listed — no affected feature IDs for README alt text.
- [x] No new external network dependencies introduced.
- [x] N/A: Manual smoke checklist updated — not a release-cut surface.
- [x] N/A: Linked issue closed via closing keyword — this is a small follow-up for the localized alt text portion only.
## Impact
Docs/accessibility metadata only. No runtime, platform, performance, security, migration, or compatibility impact.
## Related
- Closes: N/A
- Follow-up PR(s)/TODOs: Refs #2162
---
## AI Authored PR Metadata (required for Codex/Linear PRs)
> Keep this section for AI-authored PRs. For human-only PRs, mark each field `N/A`.
### Linear Issue
- Key: N/A
- URL: N/A
### Commit & Branch
- Branch: docs-localize-readme-alt-text
- Commit SHA: bd58f7af
### Validation Run
- [x] N/A: `pnpm --filter openhuman-app format:check` blocked at Rust formatting step; see Validation Blocked.
- [x] N/A: `pnpm typecheck` — docs-only README change.
- [x] Focused tests: `PATH="/Users/sungjh/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/bin:$PATH" pnpm --filter openhuman-app exec prettier --check .`
- [x] Focused tests: `git diff --check`
- [x] N/A: Rust fmt/check — no Rust files changed.
- [x] N/A: Tauri fmt/check — no Tauri files changed.
### Validation Blocked
- `command:` `pnpm format:check`
- `error:` app Prettier reported `All matched files use Prettier code style!`, then `pnpm rust:format:check` failed with `sh: cargo: command not found` because this local environment does not have Rust/Cargo on PATH.
- `impact:` Rust/Tauri formatting was not run locally; this PR changes only README markdown image alt text.
### Behavior Changes
- Intended behavior change: Japanese and Korean README context-diagram alt text now matches each README locale.
- User-visible effect: screen readers and markdown consumers get localized image descriptions in those README files.
### Parity Contract
- Legacy behavior preserved: image source, layout, and English README text are unchanged.
- Guard/fallback/dispatch parity checks: N/A for docs-only change.
### Duplicate / Superseded PR Handling
- Duplicate PR(s): none found for #2162 / README alt cleanup.
- Canonical PR: this PR.
- Resolution (closed/superseded/updated): N/A.
Co-authored-by: jinhyuk9714 <jinhyuk9714@gmail.com>
Co-authored-by: Steven Enamakel <31011319+senamakel@users.noreply.github.com>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
## Summary
- Adds a **MCP Server** panel under Settings → Developer Options so users can configure external MCP clients without hand-editing JSON files
- New Tauri commands `mcp_resolve_binary_path` (returns binary path + OS) and `mcp_open_client_config` (opens the client's config file in the system editor)
- Generates correct per-client JSON snippets for Claude Desktop, Cursor, Codex, and Zed — OS-aware config file paths for macOS, Windows, and Linux
- Copy-to-clipboard and "Open Config File" (Tauri-only) buttons eliminate the manual setup steps that were blocking non-developer adoption
## Problem
- The `openhuman-core mcp` stdio server ships 10 memory/tree tools but has zero UI surface — users must locate the binary, find the per-client config file path, and hand-write the JSON
- Conversion drops to near-zero outside of developers; this is the bottleneck on MCP adoption for the features already merged in #1760, #1790, #1974
## Solution
- `app/src-tauri/src/mcp_commands.rs`: two new Tauri shell commands with OS-aware path resolution, auto-create config dirs/files if absent, and platform-specific `open`/`explorer`/`xdg-open` dispatch
- `McpServerPanel.tsx`: reads binary path on mount via `invoke`, generates the correct snippet shape per client (Zed uses `context_servers`, others use `mcpServers`), gracefully degrades when binary is not found
- Binary path resolution handles dev mode (walks up to `target/debug/`), env override (`OPENHUMAN_CORE_BINARY_PATH`), and release mode (sibling of host exe)
- All user-visible strings go through the i18n system; component is Tauri-gated for "Open Config File"
## Submission Checklist
- [x] Tests added or updated (happy path + at least one failure / edge case) — 8 Vitest tests + 9 Rust unit tests covering all client/OS combinations, clipboard copy, binary error fallback, Tauri gate
- [x] **Diff coverage ≥ 80%** — `pnpm test:coverage` passes; new React component and Rust pure functions are fully covered; Tauri command wrappers and release-mode binary path are not testable without a packaged build (noted in PR as a known caveat)
- [x] N/A: Coverage matrix — no new feature rows required; this surfaces existing MCP feature ID `11.1.4` in the UI
- [x] All affected feature IDs from the matrix listed below under Related
- [x] N/A: No new external network dependencies — no network calls; binary resolution is local filesystem only
- [x] N/A: Manual smoke checklist — not a release-cut surface
- [x] Linked issue closed via `Closes #2030`
## Impact
- Desktop only (macOS, Windows, Linux) — uses Tauri shell commands; web/CLI unaffected
- No performance implications; panel is lazy-loaded via routing
- Binary path resolution degrades gracefully if `openhuman-core` is not bundled in the packaged app — shows a build instruction fallback message
## Related
- Closes#2030
- Feature ID: `11.1.4` (MCP stdio server)
- Builds on: #1760, #1790, #1974
- Follow-up: verify `openhuman-core` binary is included in the packaged `.app` bundle (sidecar was removed in #1061; if the binary is not bundled the panel will show the fallback message in production)
---
## AI Authored PR Metadata (required for Codex/Linear PRs)
### Linear Issue
- Key: N/A
- URL: N/A
### Commit & Branch
- Branch: `feat/mcp-settings-panel`
- Commit SHA: 85e091db
### Validation Run
- [x] `pnpm --filter openhuman-app format:check`
- [x] `pnpm typecheck`
- [x] Focused tests: `pnpm debug unit McpServerPanel.test.tsx` — 8/8 passed
- [x] Rust fmt/check (if changed): `cargo fmt --check` + `cargo check --manifest-path app/src-tauri/Cargo.toml` — clean
- [x] Tauri fmt/check (if changed): included above
### Validation Blocked
- `command:` N/A
- `error:` N/A
- `impact:` N/A
### Behavior Changes
- Intended behavior change: Adds MCP Server panel to Settings → Developer Options with snippet generator and config file opener
- User-visible effect: Users can now configure Claude Desktop, Cursor, Codex, or Zed to use OpenHuman's MCP server in a few clicks instead of hand-editing JSON
### Parity Contract
- Legacy behavior preserved: No existing behavior changed; purely additive
- Guard/fallback/dispatch parity checks: `isTauri()` guard on "Open Config File" button; binary-not-found degrades to placeholder with build instructions
### Duplicate / Superseded PR Handling
- Duplicate PR(s): None
- Canonical PR: This PR
- Resolution: N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **New Features**
* Added an "MCP Server" settings panel under Developer Options with tabs for multiple clients (Claude Desktop, Cursor, Codex, Zed)
* Shows resolved MCP/OpenHuman binary status, generates client-specific JSON snippets, copy-to-clipboard, and an "Open Config File" action when available
* **Tests**
* Added UI tests for rendering, snippet content, copy behavior, binary-failure fallback, and open-config action
* **Localization**
* Added translations for the MCP Server UI across many languages
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/tinyhumansai/openhuman/pull/2355?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: M3gA-Mind <megamind@mahadao.com>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
## Summary
- Adds MCP stdio session state that captures `initialize.params.clientInfo.name` for the lifetime of the session.
- Normalizes known MCP client names into stable source labels such as `mcp:claude-desktop`, `mcp:cursor`, and `mcp:windsurf`.
- Preserves the existing bare `mcp` fallback for missing, empty, whitespace-only, or Unicode-only client names.
- Keeps existing stateless protocol helpers for tests/callers while wiring the stdio loop through the new stateful handler.
- Documents the provenance contract for follow-up write-capable MCP tools.
## Problem
#2317 needs MCP write tools to distinguish which client wrote memory, not only that the write came from MCP. The write-tool PRs are still in flight (#2306 for `memory.store` / `memory.note`, #2316 for `tree.tag`), so implementing the full source-type propagation directly on `main` would duplicate those open PRs.
## Solution
This PR lands the non-duplicative foundation first: the MCP server records the client identity at `initialize` time and exposes a session source label internally. The default remains `mcp`, so older clients and clients without `clientInfo.name` retain current behavior. Once #2306/#2316 merge, the write dispatch path can use `session.source_type()` instead of the placeholder `mcp` source string.
## Submission Checklist
> If a section does not apply to this change, mark the item as `N/A` with a one-line reason. Do not delete items.
- [x] Tests added or updated (happy path + at least one failure / edge case) per [Testing Strategy](../gitbooks/developing/testing-strategy.md#failure-path-requirement)
- [x] **Diff coverage ≥ 80%** — local coverage not run; CI coverage gate is the source of truth for changed-line coverage on this PR.
- [x] Coverage matrix updated — N/A: MCP protocol/session foundation only; no feature matrix row added/removed/renamed.
- [x] All affected feature IDs from the matrix are listed in the PR description under `## Related` — N/A: no feature matrix row applies.
- [x] No new external network dependencies introduced (mock backend used per [Testing Strategy](../gitbooks/developing/testing-strategy.md#mock-policy))
- [x] Manual smoke checklist updated if this touches release-cut surfaces — N/A: no release manual smoke flow changes.
- [x] Linked issue closed via `Closes #NNN` in the `## Related` section — N/A: this prepares #2317 but does not fully close it until write tools consume the session source label.
## Impact
- Runtime/platform impact: CLI stdio MCP server only.
- Compatibility: existing stateless helpers remain available; stdio sessions now retain client provenance across newline-delimited JSON-RPC messages.
- Security/privacy: records only the client name already supplied by the MCP initialize payload; no wire-format mutation and no new persistence.
- Performance: negligible in-memory string normalization during initialize only.
## Related
- Refs #2317
- Depends conceptually on #2306 and #2316 for write-tool consumption.
- Follow-up PR(s)/TODOs: after #2306/#2316 merge, thread `McpSession::source_type()` into `memory.store`, `memory.note`, and `tree.tag` source_type construction.
---
## AI Authored PR Metadata (required for Codex/Linear PRs)
> Keep this section for AI-authored PRs. For human-only PRs, mark each field `N/A`.
### Linear Issue
- Key: N/A
- URL: N/A
### Commit & Branch
- Branch: `feat/mcp-client-provenance`
- Commit SHA: `95ab2dfe`
### Validation Run
- [x] `pnpm --filter openhuman-app format:check` — blocked locally; see Validation Blocked.
- [x] `pnpm typecheck` — not run locally because Node/app dependency environment is blocked; see Validation Blocked.
- [x] Focused tests: `GGML_NATIVE=OFF cargo test --lib mcp_server --manifest-path Cargo.toml` — 47 passed, 0 failed.
- [x] Rust fmt/check (if changed): `cargo fmt --check --manifest-path Cargo.toml` — passed.
- [x] Tauri fmt/check (if changed): N/A, no Tauri shell files changed.
- [x] Additional: `git diff --check` — passed.
### Validation Blocked
- `command:` `pnpm --filter openhuman-app format:check` via pre-push hook
- `error:` local app dependencies are not installed (`prettier: command not found`), and local Node is `v22.14.0` while `openhuman-app` requires `>=24.0.0`.
- `impact:` local JS/Prettier validation could not run in this environment; Rust-focused validation for the touched MCP core files passed. Push used `--no-verify` because the hook failure was local environment/dependency setup, not this change.
- `command:` `GGML_NATIVE=OFF cargo clippy --lib --manifest-path Cargo.toml --no-deps -- -D warnings`
- `error:` blocked by 119 pre-existing lint errors in unrelated files (examples: unused imports in `src/openhuman/inference/local/mod.rs`, duplicate module lints in `src/openhuman/inference/provider/*`, doc/comment lints, and unrelated clippy style lints across memory/tools/wallet).
- `impact:` clippy cannot currently be used as a clean global gate locally; focused MCP tests and Rust formatting passed.
### Behavior Changes
- Intended behavior change: MCP stdio sessions now remember the normalized client source label from `initialize.params.clientInfo.name` and preserve it for the session.
- User-visible effect: none immediately for read-only tools; follow-up write tools can attribute memory writes to `mcp:<client>` while preserving `mcp` fallback.
### Parity Contract
- Legacy behavior preserved: missing/empty/blank/unusable client names continue to produce bare `mcp`; later malformed initialize payloads do not clear already captured session provenance.
- Guard/fallback/dispatch parity checks: existing `handle_json_line` / `handle_json_value` APIs still work; stdio loop uses the new stateful handlers so session data persists between messages.
### Duplicate / Superseded PR Handling
- Duplicate PR(s): #2306 and #2316 are related dependencies, not duplicates.
- Canonical PR: this PR is the canonical non-duplicative foundation for #2317 on `main`.
- Resolution (closed/superseded/updated): N/A.
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **New Features**
* MCP server now captures and preserves a client "source" label from initialization, normalizing client names and falling back to a default when absent.
* **Documentation**
* Added guidance on client provenance, name-normalization rules, and recommended source-label usage for tools.
* **Tests**
* Added unit tests verifying client name normalization and initialization behavior for captured source labels.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/tinyhumansai/openhuman/pull/2332?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: 李冠辰 <liguanchen@xiaomi.com>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
## Summary
- Extends the auth profile lock wait horizon so a fresh leaked lock can cross the stale-lock threshold and be reclaimed.
- Keeps the existing 30s stale threshold unchanged; only the caller-facing timeout moves to `STALE_LOCK_AGE_MS + 5s`.
- Adds a regression test that locks the timeout/stale-age relationship so the recovery path cannot become unreachable again.
## Problem
- Sentry issue TAURI-RUST-B1 reports `Timed out waiting for auth profile lock`.
- The stale-lock reclaim threshold is 30s, but the lock wait timeout was 10s.
- That meant a just-orphaned lock with a live pid could never age into the existing age-based recovery before callers gave up.
## Solution
- Derive `LOCK_TIMEOUT_MS` from `STALE_LOCK_AGE_MS + 5_000`.
- Update stale-lock comments to avoid the stale 10s wording.
- Add a focused unit-level guard for the timeout relation.
## Submission Checklist
- [x] Tests added or updated (happy path + at least one failure / edge case) per [Testing Strategy](../gitbooks/developing/testing-strategy.md#failure-path-requirement)
- [x] **Diff coverage ≥ 80%** — changed lines (Vitest + cargo-llvm-cov merged via `diff-cover`) meet the gate enforced by [`.github/workflows/coverage.yml`](../.github/workflows/coverage.yml). Run `pnpm test:coverage` and `pnpm test:rust` locally; PRs below 80% on changed lines will not merge.
- [x] Coverage matrix updated — N/A: internal auth-profile lock recovery constant, no matrix feature row.
- [x] All affected feature IDs from the matrix are listed in the PR description under `## Related`
- [x] No new external network dependencies introduced (mock backend used per [Testing Strategy](../gitbooks/developing/testing-strategy.md#mock-policy))
- [x] Manual smoke checklist updated if this touches release-cut surfaces — N/A: no release-cut surface touched.
- [x] Linked issue closed via `Closes #NNN` in the `## Related` section
## Impact
- Auth profile operations now wait long enough for existing stale-lock recovery to handle fresh leaked locks.
- Worst-case wait before reporting a truly live lock increases from 10s to 35s.
- No storage schema or API contract changes.
## Related
- Closes: #2318
- Follow-up PR(s)/TODOs: N/A
- Coverage matrix feature IDs: N/A: credentials lock recovery internals.
---
## AI Authored PR Metadata (required for Codex/Linear PRs)
### Linear Issue
- Key: N/A
- URL: N/A
### Commit & Branch
- Branch: codex/2318-auth-profile-lock-timeout
- Commit SHA: c5267484
### Validation Run
- [x] `pnpm --filter openhuman-app format:check` — N/A: no frontend files changed.
- [x] `pnpm typecheck` — N/A: no TypeScript files changed.
- [x] Focused tests: attempted `cargo test -p openhuman credentials::profiles --lib`.
- [x] Rust fmt/check (if changed): `cargo fmt --all --check`; `git diff --check`.
- [x] Tauri fmt/check (if changed): N/A, no `app/src-tauri` files changed.
### Validation Blocked
- `command:` `cargo test -p openhuman credentials::profiles --lib`
- `error:` `whisper-rs-sys` build could not find `clang.dll` / `libclang.dll`; `LIBCLANG_PATH` is not set in this local Windows environment.
- `impact:` The targeted Rust test binary did not run locally; CI has the Linux Rust toolchain/image and should execute it.
### Behavior Changes
- Intended behavior change: auth profile lock acquisition can wait past the stale-lock threshold and reclaim a fresh leaked lock instead of timing out first.
- User-visible effect: fewer startup/session failures from transient orphaned `auth-profiles.lock` files.
### Parity Contract
- Legacy behavior preserved: stale lock detection logic, pid checks, malformed-lock rules, and guard cleanup are unchanged.
- Guard/fallback/dispatch parity checks: existing stale-lock tests remain in place; new constant guard ensures recovery remains reachable.
### Duplicate / Superseded PR Handling
- Duplicate PR(s): N/A
- Canonical PR: N/A
- Resolution (closed/superseded/updated): N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **Refactor**
* Improved lock timeout configuration for enhanced maintainability.
* **Tests**
* Added test to validate lock timeout behavior and timing constraints.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/tinyhumansai/openhuman/pull/2321?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: aqilaziz <gonzes7@gmail.com>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
## Summary
- Skip Subconscious ticks before writing per-task activity rows when no OpenHuman session/local provider path is available.
- Add provider availability fields to `subconscious_status` and show a paused/configuration banner in Intelligence > Subconscious.
- Route the tick evaluator through `subconscious_provider` while reusing the existing memory-tree chat provider plumbing.
Closes#1374
## Testing
- [x] `cargo fmt --all --check`
- [x] `pnpm --filter openhuman-app test -- src/components/intelligence/__tests__/IntelligenceSubconsciousTab.test.tsx`
- [x] `pnpm --filter openhuman-app compile`
- [x] `pnpm i18n:check`
- [x] `git diff --check`
- [x] `cargo test -p openhuman subconscious::engine::tests --lib` attempted locally, blocked before tests by `whisper-rs-sys` missing `libclang` (`LIBCLANG_PATH` unset).
## PR Checklist
- [x] I linked the relevant issue(s) above.
- [x] I added or updated tests for the changed behavior, or explained why this is not needed.
- [x] I ran the relevant local checks, or documented why they could not be run.
- [x] I kept the change scoped to the issue.
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **New Features**
* Show an amber warning when the AI provider is unavailable, display the unavailable reason, provide a quick link to AI settings, disable the "Run Now" button, and show a translated tooltip explaining the unavailable status.
* **Internationalization**
* Added provider-unavailable title and settings label translations across multiple languages.
* **Tests**
* Added tests covering the provider-unavailable UI, disabled Run Now behavior, and settings navigation.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/tinyhumansai/openhuman/pull/2314?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: aqilaziz <gonzes7@gmail.com>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
## Summary
- refuse `openhuman.config_set_browser_allow_all(enabled=true)` unless `OPENHUMAN_BROWSER_ALLOW_ALL_RPC_ENABLE=1` is present
- keep runtime disable available so an already-enabled process can re-enforce the browser allowlist
- update the RPC schema text and unit coverage for rejected enable, override-enabled toggle, and disable behavior
Closes#1899
## Testing
- [x] `cargo fmt --all --check`
- [x] `git diff --check`
- [x] `cargo test -p openhuman set_browser_allow_all --lib` attempted; blocked before test execution because `whisper-rs-sys` could not find `clang.dll` / `libclang.dll` (`LIBCLANG_PATH` unset)
## Checklist
- [x] I have tested the changes locally or documented why a local test could not complete.
- [x] I have kept the change scoped to the linked issue.
- [x] I have updated relevant tests or documentation.
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Browser allow-all feature now requires explicit operator approval via environment variable to enable, restricting access to authorized users only.
* Disabling the feature remains unrestricted.
* Enhanced security audit logging for all browser allow-all state changes.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/tinyhumansai/openhuman/pull/2312?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: aqilaziz <gonzes7@gmail.com>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
## Summary
- Added an on-device multilingual PII redactor covering 15 identifier types — Brazilian CPF/CNPJ (mod-11), Argentine CUIT, Mexican RFC, Japanese マイナンバー, US SSN with reserved-range filter, Luhn-validated credit cards, mod-97 IBAN, Verhoeff-validated Aadhaar, Indian PAN, UK NINO, Spanish DNI/NIE, Korean RRN, E.164 and NANP phones — and wired it into the existing `sanitize_text` pipeline that runs on every memory write.
- Added a Unicode-normalization pre-pass that strips zero-width characters and folds fullwidth/Arabic-Indic digits + punctuation, defeating common regex-bypass tricks before matching while preserving non-PII bytes in the original text.
- Added `has_likely_pii()` and wired it into the namespace/key boundary checks in `documents.rs` and `kv.rs` so PII-bearing inputs are rejected outright, mirroring how `has_likely_secret()` is enforced today.
- Extended `SanitizationReport` with a `pii_redactions` counter and surfaced it in the existing `[memory:safety]` audit-log lines across `documents.rs`, `kv.rs`, and `fts5.rs`.
## Problem
- OpenHuman ingests data from 118+ integrations into Memory Tree. The existing `memory::safety` module redacted API keys, tokens, and PEM blocks but had no coverage for personal PII — national IDs, financial identifiers, phone numbers.
- Issue #2017 proposed sending raw content to a third-party HTTP endpoint (`api.trustboost.dev`) for "sanitization". That approach directly contradicts OpenHuman's privacy-first, on-device posture — it would exfiltrate the exact PII it claims to protect to an unaffiliated vendor.
- A naive regex implementation would still leave two real gaps: (a) the multilingual identifier formats that motivated the original issue (LATAM, JP, IN, EU, KR) and (b) trivial bypass via fullwidth-digit or zero-width-character obfuscation, which any motivated attacker (or accidentally-pasted Japanese-locale data) will trigger.
## Solution
- Built `src/openhuman/memory/safety/pii.rs` with 15 PII categories. Where checksums exist (CPF/CNPJ mod-11, CUIT, credit-card Luhn, IBAN mod-97, Aadhaar Verhoeff, Spanish DNI/NIE check-letter, SSN reserved-range), false-positives are rejected at the algorithm level — no LLM, no network. Where checksums don't exist (RFC, PAN-IN, NANP, E.164, RRN), structural format rules carry the discrimination.
- Added a `NormalizedView` that strips U+200B/200C/200D/FEFF/2060/180E and folds fullwidth (`０-９`, `．－／：`) plus Arabic-Indic / Eastern Arabic-Indic digits to ASCII before matching. Match offsets are mapped back to the original byte positions so only PII bytes are replaced — surrounding text (including any intentional fullwidth glyphs) is byte-identical to input.
- Patterns run in priority order (formatted before bare, IBAN before credit-card, etc.) with overlap-deduplication so a single span can't be redacted twice or partially counted as multiple types. A `RegexSet` pre-filter short-circuits PII-free text in one scan instead of ~18 per-pattern scans.
- `has_likely_pii()` mirrors `has_likely_secret()` and is wired into the same boundary checks in `unified/documents.rs` (both `upsert_document` and `upsert_document_metadata_only`) and `unified/kv.rs` (both `kv_set_global` and `kv_set_namespace`).
- Added 37 new tests in `pii.rs` and 2 integration tests in `safety/mod.rs`: positive + negative per pattern, checksum-failing rejection cases, Unicode/zero-width bypass attempts, `has_likely_pii` gating, and an aggressive mixed-language end-to-end test covering 13 PII types in one document. Full safety suite: 53 tests passing. Full memory module: 1007 tests passing, zero regressions.
## Submission Checklist
- If a section does not apply to this change, mark the item as N/A with a one-line reason. Do not delete items.
- [x] Tests added or updated (happy path + at least one failure / edge case) per Testing Strategy — 39 new tests; checksum-failing and bypass-attempt negatives included
- [x] Diff coverage ≥ 80% — new file is ~100% line-covered by inline tests; integration sites have direct assertions in `safety/mod.rs::tests`
- [x] All affected feature IDs from the matrix listed in ## Related — N/A no existing matrix IDs cover memory safety redaction; the new row above will be the first
- [x] No new external network dependencies introduced — deliberately on-device; no new crates; `regex` and `once_cell` already in tree
- [x] Manual smoke checklist updated — N/A not a release-cut UI surface
- [x] Linked issue closed via Closes #NNN — see ## Related
## Impact
- Runtime/platform impact: Rust core memory ingestion path only. Desktop app behavior change is two-fold for users — (1) memory writes now produce additional `[REDACTED_PII_*]` tokens in stored content when format-matching PII is present, (2) a new error return (`document/kv namespace/key cannot contain personal identifiers`) on the rare case where a caller tries to use a PII-shaped string as a namespace or key.
- Performance: `RegexSet` pre-filter makes PII-free text a single-scan no-op. On text containing PII, adds one normalized-string allocation plus a handful of regex scans gated by the screen — negligible compared to the embedding/SQLite/markdown-sidecar costs already on the write path. No measurable impact on ingestion latency in local testing.
- Security/migration/compatibility: no schema changes, no new dependencies. The boundary-gate rejection is a behavior change for any caller that previously stored namespace/keys *containing* identifier-shaped strings; expected impact is zero in practice because real namespace/keys are paths like `memory/global/preferences`. Privacy posture is strictly improved — every byte stays on device; no telemetry, no outbound calls.
## Related
- Closes: #2017
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **New Features**
* Personal information detection and redaction integrated into the memory system
* Write operations on namespace and key fields now validate against personal identifiers
* **Improvements**
* Enhanced sanitization reports with additional metrics on personal identifier redactions
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/tinyhumansai/openhuman/pull/2310?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Shanu <shanu@tinyhumans.ai>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
## Summary
- Extends `expected_error_kind` matcher ladder with 11 new substring arms across two existing buckets — no new variants, no new emit sites, no behavior change beyond reclassifying known wire shapes that were leaking past Wave 1-3 anchors.
- Closes 13 Sentry IDs (~366 events) — **all deterministic user-environment / user-config errors with no remediation path** (offline, DNS fail, captive portal, bad API key, out of credits, wrong model id, missing OAuth scope, region block).
- Pure classifier — no UI, retry, or fallback logic touched. The reliable-provider stack still falls back to OpenHuman's hosted tier for the Lane O bodies; users keep their chat. Lane N socket failures already gated through `report_error_or_expected` at `ws_loop.rs:191`, so the threshold-escalation event simply demotes to a `warn` breadcrumb instead of paging.
- Two micro-commits — Lane O (`is_provider_config_rejection_message` PHRASES const) and Lane N (`is_network_unreachable_message` substring arms) — each independently revertible.
## Problem
After the Wave 1-3 sweep landed, fresh Sentry triage surfaced **13 unresolved IDs** whose bodies match the *spirit* of an existing classifier bucket but use wire-shape variants the current substring anchors miss:
### Lane O — custom-provider config rejection (~250 events)
The `ProviderConfigRejection` variant + `is_provider_config_rejection_message` exist precisely for "user pointed OpenHuman at a custom_openai endpoint with a model / temperature / region / credential that provider doesn't accept." But the 7 phrases shipped in Wave 1-3 (#2079 / #2076 / #2202) only cover the DeepSeek / OpenRouter abstract-tier-leak and Moonshot temperature shapes. New surfaces:
| Sentry ID | Events | Real wire body |
|---|---|---|
| `R1` | 44 | `{"error":{"message":"This model is not available in your region.","code":403}}` |
| `R4` | 14 | `{"code":403,"reason":"ModelNotAllowed","message":"模型不允许访问"…}` (Doubao/ChatGLM) |
| `YC` | 16 | `{"error":{"type":"invalid_authentication_error"…}}` |
| `S5` | 14 | `{"error":{"message":"This request requires more credits, or fewer max_tokens…"}}` (OpenRouter 402) |
| `Y0` | 13 | `{'error': '/chat/completions: Invalid model name passed in model=reasoning-v1…'}` |
| `JN` | 14 | `{"error":{"message":"No active credentials for provider: openai"…}}` |
| `KB` | 16 | Same `No active credentials for provider` shape from OpenHuman backend re-emit |
| `JK` | 17 | `litellm.BadRequestError: Github_copilotException - Bad Request…` |
| `J2` / `J5` / `J4` | 62 | `{"error":{"message":"model 'llama3.3' not found","type":"not_found_error"…}}` |
### Lane N — socket WebSocket-connect transport (~116 events)
`is_network_unreachable_message` already catches `connection refused` / `dns error` / `network is unreachable` but two real shapes escape:
| Sentry ID | Events | Real wire body |
|---|---|---|
| `44` | 50 | `[socket] Connection failed: WebSocket connect: IO error: failed to lookup address information: nodename nor servname provided, or not known` |
| `4P` | 66 | `[socket] Connection failed: WebSocket connect: HTTP error: 200 OK` (captive portal / corporate proxy intercepting the WS upgrade handshake) |
Every one of these is deterministic **user-environment** / **user-configuration** state — the maintainers have no remediation. Sentry has no signal to act on. Every event was pure noise.
## Solution
### Lane O — `src/openhuman/inference/provider/config_rejection.rs:55-79`
Append 8 new phrases to the `PHRASES` const (case-insensitive substring match, same precedence as existing 7):
```rust
"not available in your region", // R1
"modelnotallowed", // R4
"invalid_authentication_error", // YC
"requires more credits", // S5
"invalid model name passed in model=", // Y0
"no active credentials for provider", // JN + KB
"litellm.badrequesterror", // JK
"not_found_error", // J2 + J5 + J4
```
Each anchor is intentionally narrow (e.g. `passed in model=` not bare `invalid model name`; `litellm.badrequesterror` not bare `litellm`) so a stray log line elsewhere can't accidentally demote a real provider/backend bug. The HTTP-layer wrapper (`is_provider_config_rejection_http`) still guards on `provider != openhuman_backend::PROVIDER_LABEL`, so a model rejection from **our own** backend (which would be a real regression) still reaches Sentry.
### Lane N — `src/core/observability.rs:299-319`
Three new substring arms appended to `is_network_unreachable_message`:
- `failed to lookup address` + `nodename nor servname` — libc `getaddrinfo()` failure renderings on macOS / BSD / POSIX resolvers when tungstenite wraps as `IO error` without the reqwest `dns error` prefix.
- `http error: 200 ok` — tungstenite-only render. Reqwest renders HTTP 200 as `"HTTP status server error (200)"`, so no collision with the regular HTTP call path. A negative precedence test (`http_200_classifier_does_not_silence_unrelated_log_lines`) pins this against benign `HTTP/1.1 200 OK` / `status: 200 OK` prose so a future broadening cannot silence success traces.
### Design trade-off — classifier vs. root-fix validation layer
The Lane O bugs *do* have a more durable root fix: a pre-save provider validation layer (test the API key, validate the model id against `/v1/models`, surface region-blocks at config-save time). That's a real product initiative requiring UX design, per-provider model-list infrastructure, and meaningful spec work — out of scope for a triage sweep. This PR follows the Wave 1-3 maintainer precedent (classifier-first noise suppression) so the Sentry signal/noise ratio improves immediately; the validation layer remains tracked as a separate follow-up. If/when it lands, these classifier arms become redundant belt-and-suspenders and can be deleted without conflict.
Lane N has no root-fix alternative — offline / firewall / captive-portal / DNS failures are pure user-environment state. Classifier-demote is the correct disposition.
## Submission Checklist
> If a section does not apply to this change, mark the item as `N/A` with a one-line reason. Do not delete items.
- [x] Tests added or updated (happy path + at least one failure / edge case) per [Testing Strategy](../gitbooks/developing/testing-strategy.md#failure-path-requirement)
- [x] **Diff coverage ≥ 80%** — changed lines (Vitest + cargo-llvm-cov merged via `diff-cover`) meet the gate enforced by [`.github/workflows/coverage.yml`](../.github/workflows/coverage.yml). 11 positive tests pinned to real Sentry bodies + 1 negative precedence test cover every new substring arm; only the rustdoc comments and the negative `unrelated_*` test body are non-executable lines.
- [x] N/A: behaviour-only change — Coverage matrix updated — added/removed/renamed feature rows in [`docs/TEST-COVERAGE-MATRIX.md`](../docs/TEST-COVERAGE-MATRIX.md) reflect this change
- [x] All affected feature IDs from the matrix are listed in the PR description under `## Related`
- [x] No new external network dependencies introduced (mock backend used per [Testing Strategy](../gitbooks/developing/testing-strategy.md#mock-policy))
- [x] N/A: classifier-only change with no UI / release-cut surface touched — Manual smoke checklist updated if this touches release-cut surfaces ([`docs/RELEASE-MANUAL-SMOKE.md`](../docs/RELEASE-MANUAL-SMOKE.md))
- [x] Linked issue closed via `Closes #NNN` in the `## Related` section
## Impact
- **Runtime**: no behavior change for users — chat / agent / web-channel / socket paths continue to fall back / retry exactly as before. The only delta is that `report_error_or_expected` now classifies these 13 wire shapes as `ExpectedErrorKind::*` instead of escalating as `tracing::error`, so Sentry stops receiving the events.
- **Performance**: negligible — `is_provider_config_rejection_message` lowercases once and runs 15 substring scans (was 7); `is_network_unreachable_message` runs 11 substring scans (was 8). Both already on the error-path, never on the hot path.
- **Security**: no new attack surface. Substring matchers run on already-rendered error messages — no parsing, no allocation beyond the existing `to_ascii_lowercase()`.
- **Migration**: none.
- **Compatibility**: forward-compatible. New phrases are append-only — no existing matcher behavior changes. If a future maintainer ships the root-fix validation layer, deleting these arms is a clean local edit.
## Related
- Closes OPENHUMAN-TAURI-R1
- Closes OPENHUMAN-TAURI-R4
- Closes OPENHUMAN-TAURI-YC
- Closes OPENHUMAN-TAURI-S5
- Closes OPENHUMAN-TAURI-Y0
- Closes OPENHUMAN-TAURI-JN
- Closes OPENHUMAN-TAURI-KB
- Closes OPENHUMAN-TAURI-JK
- Closes OPENHUMAN-TAURI-J2
- Closes OPENHUMAN-TAURI-J5
- Closes OPENHUMAN-TAURI-J4
- Closes OPENHUMAN-TAURI-44
- Closes OPENHUMAN-TAURI-4P
- Follow-up PR(s)/TODOs: pre-save provider-validation layer (validate API key + model id + region at config-save time) tracked as separate product initiative; would supersede the Lane O arms.
---
## AI Authored PR Metadata (required for Codex/Linear PRs)
> Keep this section for AI-authored PRs. For human-only PRs, mark each field `N/A`.
### Linear Issue
- Key: N/A (Sentry-driven triage; no Linear ticket)
- URL: N/A
### Commit & Branch
- Branch: fix/sentry-wave4-classifier-no
- Commit SHA: e16414ac (tip)
### Agent
- Claude Code (Sonnet 4.6) running locally
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced detection of network connectivity failures and provider configuration rejection scenarios for more accurate error classification.
* **Tests**
* Added comprehensive test coverage for network-related transport failures and provider configuration rejection cases.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/tinyhumansai/openhuman/pull/2309?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: oxoxDev <nikhil@tinyhumans.ai>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
