feat(miner-hands): add shared subprocess redaction/env-allowlist helper to gittensory-engine (#4284)

[nickmopen]

Closes #4284. Re-submit after two gate closes, both now fixed and confirmed locally:

1. codecov/patch (engine file needed an app-vitest test) — lcov: subprocess-env.ts LF:14/LH:14.
2. Secret-scan: the redaction tests contain secret-shaped strings; a literal tripped the gate's diff secret-scanner. Fixtures are now built from parts (.join(...)) so the source has no literal token while the runtime string still matches — verified with the gate's own scanner: scanDiffForSecretsWithLocations = 0 hits, secretLeakFinding = clean.

Promotes the review-CLI subprocess safety pattern — a strict allowlisted child env + secret redaction — out of src/selfhost/ai.ts into @jsonbored/gittensory-engine, so the coming gittensory-miner coding-agent drivers depend on one source of truth.

What's here

• packages/gittensory-engine/src/subprocess-env.ts — SUBPROCESS_CLI_ENV_ALLOWLIST + parameterized buildAllowlistedEnv(parent, allowlist, extra) + SECRET_PATTERNS (ported verbatim) + redactSecrets. Barrel-exported.
• src/selfhost/ai.ts — migration documented (parallel copy + cross-ref, no behavior change).
• Tests — engine node:test and an app-vitest test importing the engine src (for codecov/patch).

Validation (all confirmed locally before pushing)

• Full suite green; engine 324/324; app-test 3/3; typecheck clean.
• codecov/patch: lcov 14/14 on the changed file.
• Gate secret-scan: 0 hits.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.95%. Comparing base (564a27c) to head (9385b68).
⚠️ Report is 28 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4460   +/-   ##
=======================================
  Coverage   93.95%   93.95%           
=======================================
  Files         412      413    +1     
  Lines       37212    37228   +16     
  Branches    13591    13595    +4     
=======================================
+ Hits        34963    34979   +16     
  Misses       1594     1594           
  Partials      655      655           

Files with missing lines	Coverage Δ
packages/gittensory-engine/src/subprocess-env.ts	100.00% <100.00%> (ø)
src/selfhost/ai.ts	98.65% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-09 20:17:25 UTC}

5 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): src/selfhost/ai.ts (matched src/selfhost/**).

Review summary
This PR extracts a subprocess env-allowlist builder and secret-redaction helper into `packages/gittensory-engine/src/subprocess-env.ts`, exports it from the engine barrel, and adds a documentation-only comment to `src/selfhost/ai.ts` (no behavior change there — it keeps its own parallel copy). The implementation is straightforward and correct: `buildAllowlistedEnv` copies only allowlisted keys then overlays `extra` with `undefined` values dropped from both sources, and `redactSecrets` strips length-guarded known secrets before applying the five `SECRET_PATTERNS` regexes. Both the engine `node:test` suite and the app-vitest test (added specifically for `codecov/patch`, since coverage is measured from the vitest run) exercise real behavior against the actual exported functions, and the secret-shaped fixtures are legitimately built from `.join(...)` parts to avoid tripping the diff secret-scanner while still matching the regexes at runtime — not a fabricated/can't-occur test.

Nits — 6 non-blocking

• This new engine module has zero current callers — `src/selfhost/ai.ts` keeps its own parallel `SUBSCRIPTION_CLI_ENV_ALLOWLIST`/`redactSecrets` copy per the added comment at src/selfhost/ai.ts:353-361, so the extraction is speculative until the referenced gittensory-miner drivers actually land; confirm feat(miner-hands): shared subprocess redaction/env-allowlist helper in gittensory-engine #4284 explicitly calls for landing the shared module ahead of any real consumer.
• `packages/gittensory-engine/src/subprocess-env.ts:57-63` claims `SECRET_PATTERNS` is 'ported verbatim' from `src/selfhost/ai.ts`, but nothing enforces the two stay in sync beyond a comment — a follow-up test asserting deep-equality between the two arrays (or converting ai.ts to import the engine copy, as the comment itself suggests as a future option) would catch silent drift instead of relying on convention.
• The two new test files (`test/unit/engine-subprocess-env.test.ts` and `packages/gittensory-engine/test/subprocess-env.test.ts`) assert nearly identical behavior twice; understandable given the codecov/patch constraint, but worth noting as duplicated maintenance surface.
• `SECRET_PATTERNS carries the full ported regex family` only checks `.length === 5` in both test files — a weak guard that wouldn't catch a pattern being silently swapped for a different (equally-length) regex; consider asserting each pattern's `.source` instead.
• Add a cross-check test (in either test file) that imports `SUBSCRIPTION_CLI_ENV_ALLOWLIST`/`SECRET_PATTERNS` equivalents from `src/selfhost/ai.ts` alongside the engine exports and asserts they're identical, so drift between the two copies fails CI instead of depending on the comment at src/selfhost/ai.ts:358.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#4284
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 158 registered-repo PR(s), 100 merged, 11 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	nickmopen; Gittensor profile; 158 PR(s), 11 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Linked issue satisfaction

Addressed
The PR adds packages/gittensory-engine/src/subprocess-env.ts with a parameterized buildAllowlistedEnv, ported SECRET_PATTERNS, and redactSecrets, exports them from the engine barrel, documents a deliberate parallel-copy migration choice in src/selfhost/ai.ts with a cross-reference comment, and includes tests covering both a caller-supplied allowlist and the full ported secret-pattern family (OpenA

Review context

• Author: nickmopen
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 158 PR(s), 11 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review