feat(mcp): compute loopover_check_slop_risk in-process from the shared engine - #6329
Conversation
…d engine
Make the local MCP server's loopover_check_slop_risk tool compute its result in-process from
@loopover/engine, matching the remote server's existing in-process behavior, so slop-risk
self-checks work fully offline instead of proxying over HTTP (apiPost("/v1/lint/slop-risk", …)).
buildSlopAssessment's canonical logic already lives in packages/loopover-engine/src/signals/slop.ts,
and both the remote MCP server (src/mcp/server.ts checkSlopRisk) and the API route
(/v1/lint/slop-risk) call it directly. The only blocker for the local CLI was that
@loopover/engine's exports map did not expose ./signals/slop.
- Add a ./signals/slop entry to packages/loopover-engine/package.json's exports map, pointing at
the same built module the barrel and the src/ re-export shim already consume.
- Update loopover_check_slop_risk's handler to call buildSlopAssessment(input) directly and wrap
it as { ...assessment, rubric: SLOP_RUBRIC_MARKDOWN } — byte-for-byte the shape the
/v1/lint/slop-risk route returned, so the tool's documented output (slopRisk, band, findings,
rubric) is unchanged, only computed locally. Refresh its description accordingly.
- Leave the remote server, the API route, the slop-risk CLI subcommand, and the review-pr
composition untouched, mirroring JSONbored#6308's identical change for loopover_lint_pr_text.
Closes JSONbored#6267
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
|
Tip ✅ LoopOver review result - approve/merge recommendedReview updated: 2026-07-16 02:14:35 UTC
Review summary Nits — 3 non-blocking
Decision drivers
Context & advisory signals — never blocks the verdict
Linked issue satisfactionAddressed Review context
Contributor next steps
Signal definitions
🧪 Chat with LoopOverAsk LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.
Full command reference: https://gittensory.aethereal.dev/docs/loopover-commands 🧪 Experimental — new and may change. 🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed 💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →. Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #6329 +/- ##
=======================================
Coverage 95.60% 95.60%
=======================================
Files 596 596
Lines 47121 47121
Branches 14999 14999
=======================================
Hits 45049 45049
Misses 1290 1290
Partials 782 782
Flags with carried forward coverage won't be shown. Click here to find out more. |
Summary
Make the local MCP server's
loopover_check_slop_risktool compute its result in-process from@loopover/engine, matching the remote server's existing in-process behavior, so slop-riskself-checks work fully offline instead of proxying over HTTP (
apiPost("/v1/lint/slop-risk", …)).buildSlopAssessment's canonical logic already lives inpackages/loopover-engine/src/signals/slop.ts, and both the remote MCP server(
src/mcp/server.tscheckSlopRisk) and the API route (src/api/routes.ts/v1/lint/slop-risk)already call it directly. The only blocker for the local CLI was that
@loopover/engine'sexportsmap did not expose./signals/slop, so the local package could not import the functionand fell back to an HTTP proxy — even though it already depends on
@loopover/engine../signals/slopentry topackages/loopover-engine/package.json'sexportsmap,pointing at the same built module (
dist/signals/slop.{js,d.ts}) the barrel and thesrc/re-export shim already consume.
packages/loopover-mcp/bin/loopover-mcp.js'sloopover_check_slop_riskhandler to callbuildSlopAssessment(input)directly and wrap it as{ ...assessment, rubric: SLOP_RUBRIC_MARKDOWN }— byte-for-byte the shape the
/v1/lint/slop-riskroute returned, so the tool's documented output(slopRisk, band, findings, rubric) is unchanged, only computed locally. Refreshed its description
("Computed in-process; no repo data and no API round-trip").
src/mcp/server.ts), the API route, theslop-riskCLI subcommand, andthe
review-prcomposition untouched — this mirrors feat(mcp): compute loopover_lint_pr_text in-process from the shared engine #6308's identical change forloopover_lint_pr_text, which converted only the stdio tool handler.Scope
type(scope): short summaryConventional Commit format.CONTRIBUTING.mdand does not reintroduce GitHub Pages, VitePress,site/, orCNAME.Closes #6267).Validation
git diff --checknpm run actionlintnpm run typechecknpm run test:coveragelocally — full suite green except 3 files that shell out to thesqlite3CLI (absent in my sandbox, present in CI); none import any file this PR changes. Thediff touches no
src/**line, socodecov/patchhas no changed lines to measure.npm run build:mcpnpm run test:mcp-packnpm run engine-parity:drift-checknpm run manifest:drift-checknpm run docs:drift-checknpm run command-reference:checknpm audit --audit-level=moderateLOOPOVER_API_URL+tight timeout, proving the tool runs fully offline (
test/unit/mcp-local-check-slop-risk.test.ts).If any required check was skipped, explain why:
test:workers/ui:*were not run: this change touches no Cloudflare-worker code and noapps/loopover-ui/**file, so those jobs cover nothing in this diff.Safety
rankings, or private maintainer evidence are exposed.
leak private financial terminology.
UI Evidencesection — n/a (no visible UI change).Notes
loopover_lint_pr_texttool.Closes #6267