Attribute TinyHumans Jev requests to host product

[senamakel]

Summary

Add sanitized product attribution for Jev requests sent to the TinyHumans OpenRouter proxy. ClientConfig::with_sdk_name filters the value to lowercase ASCII letters, digits, ., _, and -, capped at 64 bytes. The x-sdk-name header is attached only when the final request URL is the exact TinyHumans HTTPS System One endpoint; direct OpenRouter, TypeSafe, alternate ports, and endpoint overrides do not receive it.

Public API

ClientConfig::with_sdk_name(&str) -> Self is additive.

Validation

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo build --all-targets --all-features
• cargo test --all-features
• .github/scripts/check-file-coverage.sh 90 target/coverage.json

All passed locally. The new test checks header sanitization and outbound routing without making a network request.

Summary by CodeRabbit

• New Features
  • Added an option to attach a sanitized product name to requests sent to the Tiny Humans HTTPS endpoint. The attribution header is not sent to other endpoints or endpoint overrides.
• Documentation
  • Added guidance on configuring product attribution and the endpoint restrictions.

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: none
Reviewed head: ed192e2a644f
Updated: 1790274879 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	2	Active findings	0
Tests	1	Noted findings	0
Documentation	2	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

How this fits together

flowchart LR
  n0["...ans_proxy_uses_the_direct_system_one_path<br/>changed"]:::changed
  n1["ClientConfig<br/>changed"]:::changed
  n2["evaluate"]:::impacted
  n3["request"]:::impacted
  n4["config"]:::impacted
  n5["server"]:::impacted
  n6["...ride_is_not_extended_with_a_provider_path"]:::impacted
  n7["...sponse_validation_report_failure_metadata"]:::impacted
  n0 -->|calls| n2
  n0 -->|tests| n2
  n0 -->|calls| n3
  n0 -->|tests| n3
  n0 -->|calls| n5
  n0 -->|tests| n5
  n4 -->|uses| n1
  n6 -->|calls| n2
  n6 -->|tests| n2
  n6 -->|calls| n3
  n6 -->|tests| n3
  n6 -->|calls| n5
  n6 -->|tests| n5
  n7 -->|calls| n2
  n7 -->|tests| n2
  n7 -->|calls| n3
  n7 -->|tests| n3
  n7 -->|calls| n4
  n7 -->|tests| n4
  n7 -->|calls| n5
  n7 -->|tests| n5
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Loading

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 5 files; 0 findings. _The code index is behind this pull request (indexed at `250cf4c79a8e`), so retrieved context may be out of date._ _Memory was unavailable (model: cortex: v1/recall: timed out after 10s), so this review ran without it._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change adds sanitized SDK attribution only for the exact TinyHumans proxy endpoint and includes tests covering injection and endpoint-confusion cases. It looks safe to merge. 2 files were not security-reviewed: README.md (prose or tabular data), crates/tinyjevclient/src/client/README.md (prose or tabular data). _The code index is behind this pull request (indexed at `250cf4c79a8e`), so retrieved context may be out of date._ _Memory was unavailable (model: cortex: v1/recall: timed out after 10s), so this review ran without it._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Adds `with_sdk_name` to `ClientConfig` for sanitized product attribution header sent only to the exact TinyHumans proxy endpoint. The implementation is correct, the tests exercise the sanitization and endpoint-gating logic, and no regression paths are introduced. _The code index is behind this pull request (indexed at `250cf4c79a8e`), so retrieved context may be out of date._ _Memory was unavailable (model: cortex: v1/recall: timed out after 10s), so this review ran without it._

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Adds sanitized product attribution via `x-sdk-name` header, sent only to the exact TinyHumans OpenRouter proxy endpoint. The implementation is correct, the tests cover the stated behaviour, and the code follows the repository's rules. Safe to merge. _The code index is behind this pull request (indexed at `250cf4c79a8e`), so retrieved context may be out of date._ _Memory was unavailable (model: cortex: v1/recall: timed out after 10s), so this review ran without it._

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No end-to-end harness in this repository: no e2e test files and no e2e workflow.

Evidence and run details

• Models: ladder/vectors, gpt-5.6-luna, deepseek-v4-flash
• Spend: $0.003953
• Tokens: 149632 input · 12196 output · 10611 cached · 496 embedding

Head	State	Pass summary
ed192e2a644f	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 1790274879)

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: f849d3b7-c57e-4938-97c7-42f68564bf8d

📥 Commits

Reviewing files that changed from the base of the PR and between 50c3e4f and ed192e2.

📒 Files selected for processing (5)

• README.md
• crates/tinyjevclient/src/client/README.md
• crates/tinyjevclient/src/client/mod.rs
• crates/tinyjevclient/src/client/test.rs
• crates/tinyjevclient/src/client/types.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The client adds an optional, sanitized SDK name to requests sent to the exact Tiny Humans HTTPS proxy endpoint. Other endpoint configurations do not receive the x-sdk-name header.

Changes

SDK Name Attribution

Layer / File(s)	Summary
SDK name configuration crates/tinyjevclient/src/client/types.rs	ClientConfig gains an optional SDK name. The new builder sanitizes input, limits it to 64 ASCII bytes, and stores it only when the result is non-empty. Constructors initialize the field to None.
Proxy request attribution crates/tinyjevclient/src/client/mod.rs, crates/tinyjevclient/src/client/test.rs, README.md, crates/tinyjevclient/src/client/README.md	Request construction adds x-sdk-name only when the resolved URL matches the exact Tiny Humans proxy endpoint. Tests cover sanitization and endpoint variants. Both README files document the behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to ed192

SDK attribution appears limited to configured requests for the Tiny Humans proxy. The change is ready for normal merge checks.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 3 files. (2 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: attributing TinyHumans Jev requests to the host product.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 3 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

---

_{A rabbit trims a name with care,
Then sends it only to the proxy there.
No stray host gets the header’s trail,
Nor query strings pass the check’s detail.
The tests hop through each endpoint case,
And leave neat docs in their place.}

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0040 · 149,632 in / 12,196 out · 10,611 cached (7%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 496 embedded
critique:    $0.0022 · 87,192 in  / 2,001 out  · 6,173 cached (7%)  · gpt-5.6-luna
security:    $0.0010 · 39,362 in  / 721 out    · 1,878 cached (5%)  · gpt-5.6-luna
tests:       $0.0003 · 13,644 in  / 3,160 out  · 1,536 cached (11%) · deepseek-v4-flash
description: $0.0002 · 5,357 in   / 4,177 out  · 1,024 cached (19%) · deepseek-v4-flash