feat(mcp-cli): add stdio tool gittensory_get_label_audit

[e11734937-beep]

The hosted MCP server exposes gittensory_get_label_audit (src/mcp/server.ts) but the published stdio package (packages/gittensory-mcp/bin/gittensory-mcp.js) never registered it, so a locally-run gittensory-mcp cannot reach the label-policy audit (configured-vs-live labels, missing/suspicious labels, trusted-label-pipeline readiness).

What this does

• Registers gittensory_get_label_audit in the stdio bin, proxying the existing public GET /v1/repos/:owner/:repo/intelligence route via apiGet and surfacing its labelAudit slice.
• Matches the ownerRepo input handling of the existing gittensory_get_repo_context tool (same ${prefix}/intelligence source).
• Adds a subprocess stdio test asserting the tool is listed and returns the proxied label-audit payload, backed by a fixture intelligence route in the shared harness.

Scope

Touches only the stdio bin and test/** (no src/** changes).

Closes #2229

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.76%. Comparing base (f53d4e5) to head (8150261).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4219   +/-   ##
=======================================
  Coverage   93.76%   93.76%           
=======================================
  Files         390      390           
  Lines       36553    36553           
  Branches    13389    13389           
=======================================
  Hits        34274    34274           
  Misses       1623     1623           
  Partials      656      656           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-07-08 18:11:36 UTC}

3 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This PR adds a stdio-side registration for `gittensory_get_label_audit` in `packages/gittensory-mcp/bin/gittensory-mcp.js`, mirroring the existing `gittensory_get_repo_context` tool's use of `ownerRepoShape`, `apiGet`, and `toolResult`, and proxying the same `/v1/repos/:owner/:repo/intelligence` endpoint to surface the `labelAudit` slice. The added test spins up a real stdio subprocess via the MCP SDK client and a fixture HTTP server, asserting the tool is listed and that it actually issues a GET to the real intelligence path and returns `labelAudit`/`trustedLabelPipelineReady` — this exercises the real code path rather than fabricating an unreachable scenario. The change is narrow (bin + test only, no `src/**` touched), closes the linked issue #2229 by closing the stdio/hosted parity gap, and CI is green across build/typecheck/security/tests.

Nits — 4 non-blocking

• packages/gittensory-mcp/bin/gittensory-mcp.js: the new tool duplicates the exact `${prefix}/intelligence` fetch already done by `gittensory_get_repo_context` — consider factoring a shared `fetchIntelligence(owner, repo)` helper if a third consumer shows up, though two call sites is fine to leave as-is for now.
• test/unit/support/mcp-cli-harness.ts: the fixture route is hardcoded to the literal path `/v1/repos/owner/repo/intelligence`, which only works because the test always calls with `owner: "owner", repo: "repo"` — fine today, but worth a comment noting the coupling so a future test using different owner/repo values doesn't silently 404.
• packages/gittensory-mcp/bin/gittensory-mcp.js: `intelligence?.repoFullName ?? \`${owner}/${repo}\`` is a reasonable fallback, but confirm this matches the hosted `gittensory_get_label_audit` tool's fallback behavior in `src/mcp/server.ts` so stdio and hosted responses stay shaped identically.
• Consider asserting in the test that `missingConfiguredLabels` and `suspiciousLabels` arrays from the fixture round-trip correctly in the tool response, not just that `labelAudit`/`trustedLabelPipelineReady` substrings are present — this would catch a shape mismatch (e.g., a renamed field) that a substring match on the JSON blob wouldn't.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2229
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 77 registered-repo PR(s), 40 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	e11734937-beep; Gittensor profile; 77 PR(s), 0 issue(s).
Gate result	✅ Passing	No configured blocker found.

Linked issue satisfaction

Addressed
The PR registers gittensory_get_label_audit in the stdio bin using the same ownerRepoShape/prefix pattern as the existing repo-context tool, proxies the intelligence endpoint via apiGet, and adds a subprocess stdio test verifying both tool listing and the proxied labelAudit payload, matching all three stated deliverables.

Review context

• Author: e11734937-beep
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 77 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review