[M3gA-Mind]

Summary

This PR adds tests only: two guards that already behave correctly are now pinned.

• Credential over plain http. AllowlistHttpClient refuses to send a resolved credential over http://, but no test covered that. The new a_credential_is_never_sent_over_plain_http uses an allowlisted public IP literal (so no DNS is involved). It asserts that the request is refused before anything is sent, and that the error text never contains the secret.
• env unreachable from jq. env_builtin_is_not_reachable only asserted =env, =env.PATH and =$ENV.PATH. Those forms stop at the plain path resolver and never reach jq, so the test passed even with jq's env builtin compiled in. Two assertions now go through jq: =env | .PATH and =(env|type).

Evidence the tests bite. I broke each guard on purpose and restored both files by copy afterwards.

Run	Result
Unmodified main	2 passed
Plain-http refusal disabled, and jaq-std built with its default features using funs() (which compiles env in)	0 passed, 2 failed

In the broken run:

• env_builtin_is_not_reachable failed on the new =env | .PATH assertion. It returned the host's PATH. The three original assertions still passed, which confirms they never exercised jq.
• a_credential_is_never_sent_over_plain_http failed because the request was no longer refused.

API Or Behavior Changes

None. This PR changes tests only.

Tests

• cargo fmt --check
• cargo clippy --all-targets -- -D warnings: left to CI
• cargo clippy --all-targets --all-features -- -D warnings: left to CI
• cargo build --all-targets: left to CI
• cargo build --all-targets --all-features: left to CI
• cargo test -p tinyflows --features host-caps --lib -- a_credential_is_never_sent_over_plain_http env_builtin_is_not_reachable: 2 passed on main, 2 failed with the guards broken
• cargo test --all-features: left to CI

Documentation

Not needed (tests only).

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 2 billable files and costs up to $0.50.}

Or wait 51 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ebb52b3f-52f2-4bbb-9655-7db35784db80

📥 Commits

Reviewing files that changed from the base of the PR and between 2fa539b and 2a4f9d6.

📒 Files selected for processing: 2

• crates/tinyflows/src/caps/host/http_tests.rs
• crates/tinyflows/src/expr_tests/expr_tests_part_01_tests.rs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

Reviewed head: 2a4f9d601fb2d2a5a5c701fe5f264b191fa58b4b

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 2 of 2 files.
No actionable findings were reported in the available review results.

Diagnostics and supporting details

Full summary

Pull request purpose (title): test: pin the plain-http credential refusal and the unreachable env builtin. Tests-only change that pins two already-correct guards: the plain-HTTP credential refusal in the allowlist HTTP client, and the unreachability of jq's `env` builtin. No production code changed. The code index is behind this pull request, so retrieved context may be out of date.

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	2	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: Test coverage is assessed from changed tests and lane evidence; execution is not claimed without trusted check data.

What changed

Adds an async test in the HTTP host-cap tests that resolves a credential and confirms a request over `http://` to an allowlisted public IP literal is refused with error text containing "plain http" and never containing the secret. Extends the existing `env` reachability test with two assertions that route through jq itself (`=env | .PATH` and `=(env|type)`), each expected to evaluate to `Value::Null`.

Features

• Added — Plain-HTTP credential refusal test: Pins that a resolved credential is refused before transmission when the scheme is plain http, including that the secret does not appear in the error text. (crates/tinyflows/src/caps/host/http_tests.rs fn an_ipv4_mapped_ipv6_loopback_is_recognised_as_private() {)
• Modified — jq-reachable `env` assertions: Extends the env reachability test so jq's `env` builtin is exercised directly, rather than only through forms that stop at the plain path resolver. (crates/tinyflows/src/expr_tests/expr_tests_part_01_tests.rs fn env_builtin_is_not_reachable() {)

Tests

• unit — Adds `=env | .PATH` and `=(env|type)` assertions expected to yield `Value::Null`, alongside the existing `=env`, `=env.PATH`, and `=$ENV.PATH` assertions and a working pure jq builtin check.: The tests lane (answered) states the new assertions go through jq and would fail if reachability regressed; the description lane (answered) confirms they match how `evaluate` routes these expressions. No test execution is claimed by this review. (crates/tinyflows/src/expr_tests/expr_tests_part_01_tests.rs fn env_builtin_is_not_reachable() {)

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Critique lane answered with 0 findings across both changed files.
• Lane summary: Reviewed 2 files; 0 findings. _The code index is behind this pull request (indexed at `7cd439cda606`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Security lane answered with 0 findings; the new HTTP test additionally asserts the secret is absent from the refusal error.
• Lane summary: Reviewed 2 files; 0 findings. _The code index is behind this pull request (indexed at `7cd439cda606`), so retrieved context may be out of date._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Tests lane answered with no findings, noting both assertions target concrete outcomes and that the tests-only diff does not implicate the 500-line or `_tests.rs` naming rules.
• Lane summary: The diff is tests only: an async test pinning that a resolved HTTP credential over plain http is refused before anything is sent, and two jq-level `env` assertions that extend an existing reachability test. Both assert on concrete outcomes (error text containing "plain http", absence of the secret, `Value::Null`) and would fail if the guarded behaviour regressed. No production code changed, so the repository's 500-line and `_tests.rs` naming rules are not implicated by this diff. No findings. _The code index is behind this pull request (indexed at `7cd439cda606`), so retrieved context may be out of date._

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Commits lane answered reporting no sensitive content in committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `7cd439cda606`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Description lane answered with no defects, confirming the summary covers both additions and that the test files stay under the 500-line limit.
• Lane summary: Tests-only change that adds a plain-HTTP credential refusal test and two jq-reaching `env` assertions; both match the behaviour of the code they pin (`http.rs` refuses at the scheme check, and `evaluate` routes `env | .PATH` and `(env|type)` to jq rather than the dotted-path resolver). The description accurately covers both additions and the test files stay well under the 500-line limit. No defects found. _The code index is behind this pull request (indexed at `7cd439cda606`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.001896
• Tokens: 172210 input · 3465 output · 22528 cached · 140 embedding
• Updated: 2026-10-22T23:52:11Z

Head	State	Pass summary
2a4f9d601fb2	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-22T23:52:11Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0019