refactor(mcp): depend on the published gittensory-engine, drop the hand-ports

[JSONbored]

Summary

Now that `@jsonbored/gittensory-engine` is published (0.1.0), `gittensory-mcp` adds it as a real dependency, and both `packages/gittensory-mcp/lib/local-branch.js` and `scripts/gittensor-score-preview.mjs` import `isTestFile`/`isCodeFile` from `@jsonbored/gittensory-engine/signals/test-evidence` instead of hand-porting the regex logic — the two remaining copies from the three-way drift that motivated the gittensory-engine consolidation (#4144).

• `package-lock.json`: hand-edited a single line rather than running `npm install --package-lock-only`, which was proven (twice, with and without `--workspace` scoping) to destructively prune ~150 unrelated packages from this monorepo's lockfile. Workspace-to-workspace dependencies only need the manifest-mirror entry updated — the shared `node_modules` symlink already resolves it (see the existing `gittensory-miner` → `gittensory-engine` entry for precedent).
• `ci.yml`: `gittensory-mcp`'s "Build MCP"/"MCP package check" steps and the `mcpCliHarness` test-skip filter only checked the `mcp` path filter, not `engine` — a PR touching only `packages/gittensory-engine/**` would have silently skipped rebuilding, pack-checking, and testing its now-real dependent.

Test plan

• `npm run typecheck` — clean
• `npm run build:mcp && npm run test:mcp-pack` — clean
• `npx vitest run test/unit/mcp-cli-basics.test.ts test/unit/mcp-cli-doctor.test.ts test/unit/mcp-cli-profiles.test.ts test/unit/local-branch-file-classifiers.test.ts test/unit/score-preview-script.test.ts test/unit/local-branch.test.ts` — 121 tests pass
• End-to-end outside the monorepo: packed the mcp tarball, installed it into an isolated scratch directory (no workspace context), confirmed `@jsonbored/gittensory-engine` resolved as a real registry copy (not a symlink) and the classifier functions work through the full published dependency chain
• `npm run actionlint` — clean

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	701d626	Commit Preview URL Branch Preview URL	Jul 08 2026, 08:30 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.73%. Comparing base (3a3f67c) to head (701d626).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4159   +/-   ##
=======================================
  Coverage   93.73%   93.73%           
=======================================
  Files         386      386           
  Lines       36304    36304           
  Branches    13298    13298           
=======================================
  Hits        34029    34029           
  Misses       1618     1618           
  Partials      657      657           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-08 08:41:30 UTC}

5 files · 1 AI reviewer · 2 blockers · readiness 93/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Review summary
This refactor drops the two remaining hand-ported copies of isTestFile/isCodeFile in gittensory-mcp (local-branch.js and gittensor-score-preview.mjs) in favor of importing from the newly-published @​jsonbored/gittensory-engine, adds the real dependency to package.json/package-lock.json, and updates ci.yml so PRs touching only packages/gittensory-engine/** still rebuild, pack-check, and test the mcp package that now depends on it. The diff coheres with the description, CI is fully green, and the PR explicitly documents an end-to-end verification (packed tarball installed outside the monorepo, resolving the engine package as a real registry copy) which is the right way to de-risk a hand-edited lockfile change. No reachable defect is visible in the diff.

Nits — 6 non-blocking

• package-lock.json:15899 is hand-edited rather than npm-generated; the rationale (avoiding a destructive ~150-package prune) is good but fragile long-term — consider capturing the exact failing npm invocation in a code comment or CONTRIBUTING note so the next contributor doesn't have to rediscover it.
• @​jsonbored/gittensory-engine@​0.1.0 has no SLSA/sigstore provenance attestation per the dependency scan; acceptable for a same-org monorepo-published package, but worth tracking before other external consumers pull it.
• local-branch.js re-exports isCodeFile/isTestFile after importing them from the engine package (packages/gittensory-mcp/lib/local-branch.js) — a one-line comment noting this re-export exists only for existing call-site compatibility would save the next reader from wondering why they're not imported directly at each use site.
• Confirm (if not already covered by the cited test run) that gittensor-score-preview.mjs's removed local isTestFile/isCodeFile are not referenced anywhere else in that file beyond the shown hunk, since the full file wasn't inlined for this review.
• Since ci.yml now gates 'Build MCP'/'MCP package check' on outputs.engine as well as outputs.mcp, double check the 'engine' path filter itself (not shown in this diff) actually covers packages/gittensory-engine/** so the new condition is meaningful.
• Code changes lack test evidence — Add focused regression tests or explain why existing coverage is sufficient.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 52 registered-repo PR(s), 43 merged, 486 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 52 PR(s), 486 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 52 PR(s), 486 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review