feat(miner-ui): add discover and attempt HTTP action routes

[boskodev790]

Summary

Adds the first HTTP surface for the AMS miner's own action-taking commands (#6522): POST /api/discover
and POST /api/attempt in apps/loopover-miner-ui, each a thin, non-bypassing bridge to the real,
unmodified runDiscover / runAttempt CLI entry points. Both live under /api/*, so they inherit
vite-auth.ts's existing same-origin cookie gate for free; /api/attempt additionally inherits the
Governor chokepoint that runAttempt already routes every write through — no new or parallel execution
path is introduced.

The route handler's only job is marshaling a POST body into the CLI-style args array each command's
parseDiscoverArgs / parseAttemptArgs already accepts, and marshaling the structured result back out.
To make discover's result visible to a non-CLI caller, runDiscover gains a structured onResult hook
that mirrors runAttempt's existing convention exactly — it fires only at the two real success points
(dry-run and full-run), never at a reportCliFailure branch, and is purely additive to the unchanged
exit-code return. When a command exits non-zero without ever emitting a structured result (the
parse-error / paused / unexpected-error branches that intentionally don't call onResult), the route
returns a structured error rather than assuming a result is present.

Credentials are never accepted from the request body — a githubToken / token / apiKey-shaped field
is dropped, not threaded through; the miner resolves its own local credentials server-side exactly as the
CLI does. /api/attempt can run for minutes (a full worktree + coding-agent iteration), so the route
imposes no timeout of its own.

The final chat dispatch-layer registration is intentionally out of scope — the issue states the routes,
the onResult hook, and the client fetchers ship on their own, with only that last wiring step blocked on
the separate scaffolding issue.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves — Closes Chat action-dispatch: discover/attempt (new HTTP routes mirroring vite-governor-api.ts) #6522.

Validation

Ran the full local gate (npm run test:ci) plus npm audit, all green:

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage — packages/loopover-miner/lib/discover-cli.js (the only Codecov-gated change)
  at 100% lines / 99% branch; both sides of the new options.onResult?.(...) optional-chaining at both
  call sites are covered. apps/loopover-miner-ui is Codecov-excluded; its own vitest floor
  (85/85/75/85) stays green at 88.8/88.5/82.8/90.6.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New behavior has unit tests for new branches, fallback paths, and boundaries — route matchers
  (correct method+path and null for every sibling combination), well-formed dispatch, malformed/
  missing-required-field bodies (400, never reaching the CLI fake), the exit-code-only-without-result
  branch, the slow-resolving no-route-timeout case, credential-field dropping, the 500 catch, the
  client fetchers' success / non-2xx / bad-shape / rejection paths, and the runDiscover onResult
  hook firing at both success points and never on the parse-error branch.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private
  rankings, or private maintainer evidence are exposed. The routes explicitly never read a credential
  field from the body (tested), and resolve credentials server-side exactly as the CLI does.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees.
• Auth/CORS: no auth code is changed — both routes inherit vite-auth.ts's existing same-origin
  /api/* cookie gate unchanged (registered before them in vite.config.ts). Their own negative-path
  cases (malformed body → 400 without invoking the CLI; non-discover/attempt method+path → fall
  through) are covered.
• API behavior is tested where needed. These are local Vite dev/preview /api/* routes, not part of
  the worker's OpenAPI spec, so no OpenAPI/MCP surface changed (ui:openapi:check is clean).
• UI changes use live API data or real states — N/A: no visible UI is added, only HTTP routes and
  typed client fetchers.
• Public docs/changelogs updated where needed — N/A; no changelog edit.

UI Evidence

N/A — this PR adds HTTP routes (vite-discover-api.ts, vite-attempt-api.ts), their client fetchers, and
a CLI onResult hook. There is no visible UI, frontend page, or component change to screenshot.

Notes

• discover has no Governor chokepoint today (it only fans out + ranks + enqueues, none of the gated write
  actions), so — matching the CLI exactly — this route adds none either. Only /api/attempt inherits the
  chokepoint, via the unmodified runAttempt.
• The onResult addition is backward-compatible: runDiscover still returns the same plain exit code
  bin/loopover-miner.js's process.exit(exitCode) relies on; a regression test pins that the parse-error
  branch keeps its non-zero exit and never fires the hook.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.62%. Comparing base (1cb09e4) to head (7cd842b).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6574   +/-   ##
=======================================
  Coverage   93.62%   93.62%           
=======================================
  Files         678      678           
  Lines       67889    67891    +2     
  Branches    18657    18657           
=======================================
+ Hits        63558    63560    +2     
  Misses       3360     3360           
  Partials      971      971           

Flag	Coverage Δ
shard-1	43.81% <0.00%> (-0.08%)	⬇️
shard-2	36.96% <0.00%> (+0.07%)	⬆️
shard-3	32.39% <100.00%> (-0.03%)	⬇️
shard-4	34.20% <0.00%> (-0.48%)	⬇️
shard-5	31.42% <0.00%> (+0.39%)	⬆️
shard-6	45.77% <0.00%> (+0.06%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/loopover-miner/lib/discover-cli.js	100.00% <100.00%> (ø)

[loopover-orb]

Tip

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-16 14:55:19 UTC}

10 files · 1 AI reviewer · no blockers · readiness 82/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This PR adds POST /api/discover and POST /api/attempt as thin marshaling bridges over the existing runDiscover/runAttempt CLI entry points, plus a new onResult hook on runDiscover that mirrors runAttempt's existing convention. The wiring is sound: credential-shaped fields are correctly stripped from the request body, the routes inherit auth via registration order in vite.config.ts, and the onResult hook fires only at the two real success points in discover-cli.js (verified against the full file), never on reportCliFailure branches — the accompanying regression test for the parse-error branch actually exercises this. Test coverage is thorough, including a payload-shape guard and a no-route-level-timeout test for the long-running attempt call.

Nits — 5 non-blocking

• apps/loopover-miner-ui/vite-attempt-api.ts and vite-discover-api.ts use bare status-code literals (400/502/200/500) throughout respondTo*Route — a small named-constants map would make the branches self-documenting.
• apps/loopover-miner-ui/vite-discover-api.ts:75-79 and vite-attempt-api.ts's parseAttemptBody return null on a JSON.parse failure without distinguishing malformed-JSON from missing-required-field, which is fine functionally but loses diagnostic detail in the 400 response (`invalid_request_body` is generic either way).
• The PR description states the final chat dispatch-layer registration is intentionally out of scope, so confirm the linked issue Chat action-dispatch: discover/attempt (new HTTP routes mirroring vite-governor-api.ts) #6522 explicitly sanctions shipping these routes unregistered from chat dispatch as a standalone increment.
• Consider a shared `respondWithJson(status, body)` helper between vite-discover-api.ts and vite-attempt-api.ts to cut the near-duplicate status/header/body plumbing (both files are structurally identical apart from the CLI they wrap).
• In discover-cli.d.ts, the onResult JSDoc citing '(Chat action-dispatch: discover/attempt (new HTTP routes mirroring vite-governor-api.ts) #6522)' is good practice — consider the same issue reference in the attempt-cli.js/d.ts if not already present, for grep-ability.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#6522
Related work	⚠️ 2 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 37 registered-repo PR(s), 10 merged, 6 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	boskodev790; Gittensor profile; 37 PR(s), 6 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: moderate

Linked issue satisfaction

Addressed
The PR adds exactly the two required files (vite-discover-api.ts, vite-attempt-api.ts) with the mandated four-piece shape, restricted to POST-only routes, thin bridges calling the real unmodified runDiscover/runAttempt, registered after authPlugin() in vite.config.ts, and correctly resolves the onResult asymmetry by adding an additive onResult hook to runDiscover mirroring runAttempt's existing co

Review context

• Author: boskodev790
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Java, Python, TypeScript
• Official Gittensor activity: 37 PR(s), 6 issue(s).
• Related work: Titles/paths share 8 meaningful terms. (issue #6522, issue #6521)
• Related work: Titles/paths share 7 meaningful terms. (issue #6520, issue #6522)

Contributor next steps

• Start here: Review top overlaps.
• Then work through the remaining 2 steps in the Signals table above.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/	desktop	before /	after /	—
/	mobile	before / (mobile)	after / (mobile)	—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.