chore(miner): migrate batch 4.5 foundational lib modules to TypeScript

[oktofeesh1]

Summary

• Converts 8 packages/loopover-miner/lib/** modules to real TypeScript (in-place .ts -> .js/.d.ts emit, import paths unchanged): deny-hooks, policy-doc-cache, pr-outcome, attempt-log, coding-task-spec, stack-detection, ci-poller, self-review-context.
• Adds a dedicated test/unit/miner-coding-task-spec-path-guard.test.ts that mocks @loopover/engine's ACCEPTANCE_CRITERIA_FILENAME export to a path-traversal value, proving assertContainedPath's defense-in-depth throw actually fires rather than deleting it as apparently-unreachable dead code (it's unreachable only because the real constant is currently a fixed safe basename).

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves.

Closes #7313

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally — 100%/100% on 7 of the 8 files. ci-poller.ts is 100% branches / 99% lines with one residual line that's provably unreachable at runtime (normalizeOptions clamps maxAttempts to a minimum of 1, so the loop's trailing return can never execute; documented inline, kept only because TypeScript's control-flow analysis can't see that runtime guarantee). self-review-context.ts is 98.7% lines / 94.6% branches after extensive targeted test-writing — the remaining gaps are deeply nested combinations of optional ORB-probe/pagination/manifest-override paths with diminishing marginal value per additional test; documented as an accepted residual rather than chased further.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• Not skipped, but note: npm audit --audit-level=moderate reports a pre-existing high-severity adm-zip advisory (no fix available) via github-actionlint, inherited unchanged from main and unrelated to this PR's packages/loopover-miner/lib/** scope.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no such changes; self-review-context.ts's GitHub/ORB-probe fetch paths are covered by both positive and failure-path tests.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A — no API/OpenAPI/MCP surface changed.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A — no UI changes.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• self-review-context.ts's env?: NodeJS.ProcessEnv field was widened to Record<string, string | undefined> to match this file's own convention elsewhere (and how its tests construct minimal env objects); the one remaining call into the still-JS github-token-resolution.js's resolveLoopoverBackendSession (typed env?: NodeJS.ProcessEnv) is bridged with a documented cast, the same pattern already used for laptop-init.ts's resolveGitHubToken in the prior batch.

[codecov]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Caution

🛑 LoopOver review result - reject/close recommended

_{Review updated: 2026-07-19 23:29:09 UTC}

29 files · 1 AI reviewer · 1 blocker · CI failing · blocked

🛑 Suggested Action - Reject/Close

Review summary
This is a mechanical TypeScript migration of 8 loopover-miner lib modules (deny-hooks, policy-doc-cache, pr-outcome, attempt-log, coding-task-spec, stack-detection, ci-poller, self-review-context), each with a `.ts` source and generated `.js`/`.d.ts` output, plus a new path-guard test proving `assertContainedPath`'s defense-in-depth throw is reachable. The generated `.js` for most files is a faithful re-emission of the prior JS, but in `ci-poller.ts` and `self-review-context.ts` the `githubHeaders` helper silently dropped the pre-existing `.trim()` on `githubToken` before building the `Authorization` header, a real (if narrow) behavioral regression introduced during the 'pure' conversion. CI is currently red across `validate-code`/`validate-tests`/`validate`, which is consistent with issues in this conversion.

Blockers

• packages/loopover-miner/lib/ci-poller.ts githubHeaders (and the identical helper in self-review-context.ts) no longer calls `.trim()` on `githubToken` before setting the `Authorization` header — the prior `.js` did `const token = ...githubToken.trim() : ''`; a token sourced from `env.GITHUB_TOKEN` with trailing whitespace/newline (common when read from a mounted secret file) will now be sent un-trimmed, which can throw on the fetch header write or silently fail auth against the GitHub API on a reachable path.

Nits — 5 non-blocking

• packages/loopover-miner/lib/coding-task-spec.js:135 and coding-task-spec.ts:203 retain a `console` call per the external brief — worth confirming it's intentional operator-facing logging and not a debug leftover.
• packages/loopover-miner/lib/self-review-context.ts is ~536 lines (and its `.js` twin ~418), both over the repo's usual 400-line file-size comfort zone; consider whether the ORB-probe/manifest-overlay logic could be split into a second module.
• packages/loopover-miner/lib/attempt-log.ts:148, ci-poller.ts:165, coding-task-spec.ts:179, self-review-context.ts:216, stack-detection.ts:102 each add a control-flow block nested 5 levels deep; consider extracting a helper to flatten the nesting for readability.
• New source (~3180 lines added) is covered by a comparatively thin set of dedicated test files (~445 lines) per the external analysis — worth double-checking the coverage numbers the PR description claims (100% on 7/8 files) actually exercise the new TS branches rather than just the pre-existing JS behavior.
• Restore `.trim()` on the `githubToken` parameter in `ci-poller.ts`'s and `self-review-context.ts`'s `githubHeaders` (or trim it once in each file's `normalizeOptions`) to match the pre-migration `.js` behavior.

Why this is blocked

• packages/loopover-miner/lib/ci-poller.ts githubHeaders (and the identical helper in self-review-context.ts) no longer calls `.trim()` on `githubToken` before setting the `Authorization` header — the prior `.js` did `const token = ...githubToken.trim() : ''`; a token sourced from `env.GITHUB_TOKEN` with trailing whitespace/newline (common when read from a mounted secret file) will now be sent un-trimmed, which can throw on the fetch header write or silently fail auth against the GitHub API on a reachable path.

📋 Copy for AI agents — paste into your coding agent

Fix the following blocker(s) from this PR review:

1. packages/loopover-miner/lib/ci-poller.ts githubHeaders \(and the identical helper in self-review-context.ts\) no longer calls \`.trim\(\)\` on \`githubToken\` before setting the \`Authorization\` header — the prior \`.js\` did \`const token = ...githubToken.trim\(\) : ''\`; a token sourced from \`env.GITHUB\_TOKEN\` with trailing whitespace/newline \(common when read from a mounted secret file\) will now be sent un-trimmed, which can throw on the fetch header write or silently fail auth against the GitHub API on a reachable path.

CI checks failing

• validate
• validate-tests (6)
• validate-tests (5)
• validate-tests (3)
• validate-tests (2)
• validate-tests (4)
• validate-tests (1)
• validate-code

Decision drivers

• ❌ Code review — 1 blocker (1 reviewer)
• ❌ Gate result — Blocking (Repo-configured hard blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#7313
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 80 registered-repo PR(s), 66 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	oktofeesh1; Gittensor profile; 80 PR(s), 0 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: moderate

Linked issue satisfaction

Addressed
The PR converts self-review-context.js to a real .ts source (with .js as compiled output) matching the in-place emit pattern, and the description states all 8 listed lib files were similarly migrated with typecheck, coverage, and existing tests passing unmodified, directly fulfilling the issue's batch conversion and .d.ts removal deliverables.

Review context

• Author: oktofeesh1
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: JavaScript, MDX, Python, TypeScript
• Official Gittensor activity: 80 PR(s), 0 issue(s).
• Related work: Titles/paths share 7 meaningful terms. (issue #7300)
• Related work: Titles/paths share 8 meaningful terms. (issue #7300, issue #7329)
• Related work: Titles/paths share 8 meaningful terms. (issue #7300, issue #7330)

Contributor next steps

• Start here: Review top overlaps.
• Then work through the remaining 2 steps in the Signals table above.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver is closing this pull request on the maintainer's behalf (CI is failing (validate, validate-tests (6), validate-tests (5), validate-tests (3), validate-tests (2), validate-tests (4), validate-tests (1), validate-code); AI reviewers agree on a likely critical defect: packages/loopover-miner/lib/ci-poller.ts githubHeaders (and the identical helper in self-review-context.ts) no longer calls `.trim()` on `githubToken` before setting the `Authorization` header — the prior `.js` did `const token = ...githubToken.trim() : ''`; a token sourced from `env.GITHUB_TOKEN` with trailing whitespace/newline (common when read from a mounted secret file) will now be sent un-trimmed, which can throw on the fetch header write or silently fail auth against the GitHub API on a reachable path.). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.