feat(api): add POST /v1/repos/:owner/:repo/repo-docs/refresh + CLI mirror - #6971
feat(api): add POST /v1/repos/:owner/:repo/repo-docs/refresh + CLI mirror#6971galuis116 wants to merge 2 commits into
Conversation
…rror The MCP tool loopover_refresh_repo_docs (opens or finds the already-open AGENTS.md/CLAUDE.md generation PR) had no REST or CLI counterpart. Adds the write-access-gated REST route, a `maintain refresh-docs` CLI subcommand, and admits the new path through the session coarse-path allowlist so a browser maintainer session can actually reach it (the route's own requireRepoWriteAccess still enforces real per-repo write authority). Both mirrors trim the runner's internal claudeMode field the same way the MCP tool's own response already does, keeping all three surfaces' public shape identical.
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
Codecov Report✅ All modified and coverable lines are covered by tests.
Additional details and impacted files@@ Coverage Diff @@
## main #6971 +/- ##
==========================================
- Coverage 93.71% 87.03% -6.68%
==========================================
Files 686 686
Lines 68392 68403 +11
Branches 18730 18732 +2
==========================================
- Hits 64093 59537 -4556
- Misses 3302 7176 +3874
- Partials 997 1690 +693
Flags with carried forward coverage won't be shown. Click here to find out more.
|
|
Caution 🛑 LoopOver review result - fixes requiredReview updated: 2026-07-17 16:50:14 UTC
Review summary Nits — 5 non-blocking
CI checks failing
Decision drivers
Context & advisory signals — never blocks the verdict
Linked issue satisfactionAddressed Review context
Contributor next steps
Signal definitions
🧪 Chat with LoopOverAsk LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.
Full command reference: https://loopover.ai/docs/loopover-commands 🧪 Experimental — new and may change. Visual preview
Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy. 🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed 💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →. Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.
|
|
LoopOver is closing this pull request on the maintainer's behalf (CI is failing (validate, validate-tests (6))). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed. |
Summary
loopover_refresh_repo_docs(opens or finds the already-open AGENTS.md/CLAUDE.md generation PR viaperformRepoDocRefresh) had no REST or CLI counterpart.POST /v1/repos/:owner/:repo/repo-docs/refreshinsrc/api/routes.ts, gated the same way as the pending-actions decision route (requireRepoWriteAccess— real per-repo write access, not just maintainer-data visibility).canSessionAccessPath/isRepoDocRefreshPath) — without this, a browser maintainer session would 403 withinsufficient_roleat the global gate before ever reaching the route's own write-access check. Caught by testing a real session request end-to-end rather than only unit-testing the route handler in isolation.maintain refresh-docsCLI subcommand (packages/loopover-mcp/bin/loopover-mcp.js), proxying the new route.claudeModefield from the response, so all three surfaces (MCP/REST/CLI) expose the identical public shape.RepoDocRefreshResultSchemaand the route in the OpenAPI spec; regeneratedapps/loopover-ui/public/openapi.json.Scope
type(scope): short summaryConventional Commit format.CONTRIBUTING.mdand does not reintroduce GitHub Pages, VitePress,site/, orCNAME.Closes #6743
Validation
git diff --checknpm run actionlint— ran; passednpm run typecheck— the whole-repotsc --noEmitreliably OOMs on this shared, memory-constrained sandbox regardless of what changed (confirmed via a clean-checkout rerun); relied onnpm run build --workspace @loopover/engine(passed) plus the full targeted vitest run below (which exercises every changed file end-to-end and would fail on a real type error at the module-load boundary) as the local proxy, and CI's isolated runner for the authoritativetsc --noEmit.npm run test:coverage— full vitest run of every touched/related test file:test/unit/routes-repo-doc-refresh.test.ts(new, 3 tests),test/unit/mcp-refresh-repo-docs.test.ts(5, unmodified — pins the underlying runner's behavior is untouched),test/unit/mcp-cli-maintain.test.ts(19, incl. 3 newrefresh-docscases),test/unit/access-boundary.test.ts(9, the coarse-path-allowlist regression suite) — 73/73 passing.npm run test:workers(not applicable — no Cloudflare Worker binding/queue changes)npm run build:mcp/npm run test:mcp-pack(not applicable — no MCP server packaging changes)npm run ui:openapi— regenerated and committednpm run ui:openapi:settings-parity— passednpm run command-reference— ran; no driftnpm run ui:lint/npm run ui:typecheck— this PR only touchessrc/,packages/loopover-mcp/, andtest/, noapps/loopover-ui/**surface; rannpm run ui:lintanyway as a sanity check (0 errors, only pre-existing unrelated warnings)npm audit --audit-level=moderate(no dependency changes in this PR)If any required check was skipped, explain why:
npm run typecheckOOMs on this specific sandbox under current memory pressure (independently reproduced on a cleanmaincheckout with no diff at all), so it was not run standalone;npm run build --workspace @loopover/engineplus the full targeted test run above stand in as the local proxy, and CI's isolated runner performs the realtsc --noEmit.npm run test:workersand the MCP packaging checks have no surface to exercise for a change scoped to one REST route + one CLI subcommand.Safety
test/unit/routes-repo-doc-refresh.test.tscovers the write-access-denied (403) path, andtest/unit/access-boundary.test.tscontinues to pass unmodified.RepoDocRefreshResultSchemamatches the trimmed response shape both mirrors actually return.UI Evidencesection below with JPG/JPEG or PNG screenshots. (N/A — this is a backend REST route + CLI subcommand with no UI surface.)Notes
insufficient_rolefrom the global coarse-path allowlist, independent of the route's own per-repo write check), discovered only because the negative-path test exercised the realapp.request(...)flow end-to-end rather than mocking the gate. Fixed by addingisRepoDocRefreshPathtocanSessionAccessPath, mirroring the existingisRepoAgentAuditFeedPath/isRepoAgentPendingActionsPathprecedent.