Background
The extension should help users act from GitHub, especially by copying public-safe PR packets and inspecting private blockers without posting anything.
Goal
Let users copy public-safe PR packets and open private blocker details from the extension.
Current Behavior
PR packet generation is primarily MCP/API-oriented.
Desired Behavior
Users can copy a sanitized packet or inspect authenticated private blocker details from a GitHub overlay.
Implementation Requirements
- Reuse the same public-safe packet generator as MCP/API.
- Gate private blockers by auth and role.
- Run copied output through public sanitizer.
- Avoid local source reads in the extension.
- Record redacted product usage events.
Public/Private Output Boundaries
Public GitHub output must never include wallets, hotkeys, payout/reward estimates, raw trust scores, public score estimates, private reviewability, private scoreability context, or farming language. Private API/MCP/control-panel surfaces may show authenticated scoreability, blockers, projections, and evidence, but must not claim guaranteed payout outcomes.
Acceptance Criteria
- Packet text is sanitized.
- Private blocker details require auth.
- No score/reward/wallet/hotkey leakage.
- Tests cover copied output.
Testing Requirements
npm run test:ci must pass.
- Global coverage must remain at or above 97% for lines, statements, functions, and branches.
- Aim for 98%+ branch coverage locally.
- Add tests for every new branch, fallback path, sanitizer rule, and regression.
- Add invariant/property-style tests when behavior depends on sorting, gating, scoring, source-upload safety, public/private boundaries, or telemetry privacy.
- MCP/local tooling must prove source contents are not uploaded when local metadata is involved.
- Public GitHub output must be tested against forbidden language: wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, and public score estimate.
Background
The extension should help users act from GitHub, especially by copying public-safe PR packets and inspecting private blockers without posting anything.
Goal
Let users copy public-safe PR packets and open private blocker details from the extension.
Current Behavior
PR packet generation is primarily MCP/API-oriented.
Desired Behavior
Users can copy a sanitized packet or inspect authenticated private blocker details from a GitHub overlay.
Implementation Requirements
Public/Private Output Boundaries
Public GitHub output must never include wallets, hotkeys, payout/reward estimates, raw trust scores, public score estimates, private reviewability, private scoreability context, or farming language. Private API/MCP/control-panel surfaces may show authenticated scoreability, blockers, projections, and evidence, but must not claim guaranteed payout outcomes.
Acceptance Criteria
Testing Requirements
npm run test:cimust pass.