fix(settings): parse PROTECTED_AUTOCLOSE_AUTHORS_EXTRA via the shared login-list parser (#audit-3.13)

[real-venus]

Summary

protectedAutocloseAuthors in src/settings/agent-actions.ts parsed the PROTECTED_AUTOCLOSE_AUTHORS_EXTRA env var with a bare .split(","), while every other GitHub-login-list env var (e.g. ADMIN_GITHUB_LOGINS in src/queue/review-evasion.ts) goes through parseGitHubLoginList (src/auth/security.ts), which splits on whitespace or commas "so every caller agrees on the same parse (#audit-3.13)". A self-hoster who set PROTECTED_AUTOCLOSE_AUTHORS_EXTRA with newline- or space-separated logins (a reasonable assumption given the sibling env var's convention) got them silently concatenated into one unmatched string instead of split into individual logins. This env var was missed by the #audit-3.13 unification pass.

Changes

• protectedAutocloseAuthors now parses via the shared parseGitHubLoginList, matching every other login-list env var. parseGitHubLoginList itself is unchanged.
• Updated the accompanying comment to reflect the whitespace-or-comma convention.
• Regression test: a PROTECTED_AUTOCLOSE_AUTHORS_EXTRA with mixed comma / newline / multi-space separators now parses into the correct individual logins (would previously fold several into one unmatched string).

Scope

• Single-purpose parsing-consistency fix in src/settings/agent-actions.ts.
• Additive-only behavior preserved (unset/blank never shrinks the base set); no change for the already-correct comma-separated case.

Validation

• npm run typecheck
• npx vitest run test/unit/agent-actions.test.ts -- 284 passed (incl. the new mixed-separator regression test).
• Coverage: 100% on the changed lines (both branches of the additive guard exercised).
• scripts/check-engine-parity.ts -- ok (no engine twin).
• Rebased onto latest main; mergeable-clean.

Safety

• No secrets or private terms; pure parsing-convention alignment.

Closes #6193

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.32%. Comparing base (fd5de75) to head (a73ec04).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6214      +/-   ##
==========================================
- Coverage   95.32%   95.32%   -0.01%     
==========================================
  Files         596      596              
  Lines       47091    47090       -1     
  Branches    15010    15010              
==========================================
- Hits        44889    44888       -1     
  Misses       1477     1477              
  Partials      725      725              

Flag	Coverage Δ
shard-1	43.97% <50.00%> (-0.06%)	⬇️
shard-2	36.69% <100.00%> (+0.12%)	⬆️
shard-3	32.16% <50.00%> (+0.02%)	⬆️
shard-4	33.96% <50.00%> (-0.14%)	⬇️
shard-5	31.70% <50.00%> (-0.01%)	⬇️
shard-6	45.31% <50.00%> (+0.03%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/settings/agent-actions.ts	97.94% <100.00%> (-0.01%)	⬇️

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-15 22:18:48 UTC}

2 files · 1 AI reviewer · no blockers · readiness 80/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
The PR replaces a bare `.split(",")` with the shared `parseGitHubLoginList` for `PROTECTED_AUTOCLOSE_AUTHORS_EXTRA`, aligning it with the whitespace-or-comma convention already used by `ADMIN_GITHUB_LOGINS` and other login-list env vars. The change is correct and minimal: it swaps the parser, updates the comment to describe the new convention, and keeps the additive-only semantics (empty extra falls back to the base set). A targeted regression test exercises mixed comma/newline/space separators and confirms both the extra logins and base set still resolve correctly.

Nits — 4 non-blocking

• The comment in src/settings/agent-actions.ts is fairly long for a one-line change; could be trimmed to just the essential rationale.
• No test explicitly verifies the fallback branch (extra.size === 0 returning the exact same PROTECTED_AUTOCLOSE_AUTHORS reference) beyond the existing blank-value test.
• Consider a short unit test asserting `protectedAutocloseAuthors` returns the identical Set reference when extra is empty, to guard the object-identity optimization implied by the ternary.
• Link back to `#audit-3.13`'s other unified call sites in the comment for easier cross-referencing if this pattern is audited again.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#6193
Related work	⚠️ 2 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 139 registered-repo PR(s), 75 merged, 21 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	real-venus; Gittensor profile; 139 PR(s), 21 issue(s).
Gate result	✅ Passing	No configured blocker found.
Improvement	✅ Minor	risk: clean · value: minor · LLM: minor

Linked issue satisfaction

Addressed
The diff replaces the bare .split(",") with parseGitHubLoginList from src/auth/security.ts exactly as requested, leaving that function itself unchanged, and adds a regression test covering mixed comma/newline/space separators.

Review context

• Author: real-venus
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 139 PR(s), 21 issue(s).
• Related work: Items reference the same linked issue fix(settings): PROTECTED_AUTOCLOSE_AUTHORS_EXTRA uses a narrower list-parsing convention than the unified GitHub-login-list parser (#audit-3.13) #6193. (issue #6193)
• Related work: Open PR work references issue fix(settings): PROTECTED_AUTOCLOSE_AUTHORS_EXTRA uses a narrower list-parsing convention than the unified GitHub-login-list parser (#audit-3.13) #6193. (issue #6193)

Contributor next steps

• Start here: Review top overlaps.
• Then work through the remaining 2 steps in the Signals table above.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.