fix(mcp): redact private preflight workspace signals

[JSONbored]

Motivation

• Prevent leaking private scoreability/account-state signals (accountState blockers and private rerun guidance) from local-branch analysis into the public-facing preflight MCP/CLI surfaces.

Description

• Add publicSafeWorkspaceIntelligence to sanitize workspaceIntelligence by clearing blockers.accountState and replacing rerunWhen with public-safe text.
• Use the sanitizer when returning the gittensory_preflight_current_branch tool response and when producing gittensory-mcp preflight --json payloads.
• Use the sanitized intelligence for human-readable gittensory-mcp preflight output while preserving full private intelligence for non-preflight analysis surfaces.
• Add a regression test and fixture: extend the fixture server with /v1/local/branch-analysis sample data containing account-state blockers and add a unit test that asserts both JSON and human-readable preflight outputs redact private fields.

Testing

• Ran the new unit test: npm test -- --run test/unit/mcp-cli-basics.test.ts and all tests in that file passed.
• Built the MCP package: npm --workspace @jsonbored/gittensory-mcp run build and the build/type checks passed.
• Ran git diff --check to verify no whitespace/formatting errors were introduced.

---

Codex Task

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#885 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 3 changed file(s) — two independent AI reviewers.

Changed files: packages/gittensory-mcp/bin/gittensory-mcp.js, test/unit/mcp-cli-basics.test.ts, test/unit/support/mcp-cli-harness.ts

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR adds sanitisation for workspace intelligence in the MCP CLI, removing private account‑state blockers and providing a public‑safe rerunWhen message. It includes supporting test fixtures and a new test verifying the redaction.

Suggestions

• Consider adding a comment in the code explaining why only the preflight command is sanitized, to aid future maintainers.
• Add a test case for the non‑preflight path to ensure private data is retained when appropriate.

Worth double-checking

• If other private fields are added to workspaceIntelligence later, they may not be redacted by the current function.
• Human‑output formatting must continue to omit the "Account/queue blockers:" header when the list is empty.

Reviewer B · mistral-small-3.1-24b-instruct — recommends ✅ merge
This PR adds a sanitization step to redact private workspace intelligence signals from the preflight output of the MCP CLI. The changes are focused and well-implemented.

Suggestions

• Consider adding a test to cover the scenario where workspaceIntelligence is undefined to ensure the function handles this edge case gracefully.
• Ensure that the publicSafeWorkspaceIntelligence function is thoroughly documented, explaining its purpose and the specific fields it sanitizes.

Worth double-checking

• Verify that the sanitization logic in publicSafeWorkspaceIntelligence and publicSafeRerunWhen covers all potential private signals that should be redacted.
• Ensure that the new test in mcp-cli-basics.test.ts covers all possible edge cases, including scenarios where the workspaceIntelligence object is partially populated.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.71%. Comparing base (5d9d73a) to head (dd88858).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #885   +/-   ##
=======================================
  Coverage   96.71%   96.71%           
=======================================
  Files         108      108           
  Lines       14641    14641           
  Branches     5298     5298           
=======================================
  Hits        14160    14160           
  Misses        102      102           
  Partials      379      379           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.