feat(mcp): add follow-up issue local-write action spec (#2177) by kiannidev · Pull Request #3836 · JSONbored/loopover

kiannidev · 2026-07-06T13:52:47Z

Summary

Closes #2177.

Adds buildFollowUpIssueSpec in src/mcp/local-write-tools.ts to compose a public-safe follow-up issue title/body from a deferred review finding, strip HTML comment markers, bound title/body length, and delegate to the existing buildFileIssueSpec / gh issue create shape with optional point-bearing labels. Structured inputs.finding is sanitized before return so harnesses cannot emit hidden comment text into public issues.

Scope

The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

If any required check was skipped, explain why:

Prior attempt feat(mcp): add follow-up issue local-write action spec (#2177) #3832 was auto-closed for missing Closes #2177 wording and unsanitized inputs.finding; both are fixed here.

Safety

No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
API/OpenAPI/MCP behavior is updated and tested where needed.
UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

N/A — backend-only MCP local-write helper; no visible UI change.

Notes

Conflict check: open PRs touch commands.ts, processors.ts, and focus-manifest.ts; this PR only changes local-write-tools.ts and its unit tests.

Made with Cursor

Compose a boundary-safe gh issue-create spec from deferred review findings so contributors can file follow-up work locally without a new MCP write path. Co-authored-by: Cursor <cursoragent@cursor.com>

Strip HTML comment markers from inputs.finding so harnesses that read structured fields cannot emit hidden comment text into public issues. Co-authored-by: Cursor <cursoragent@cursor.com>

superagent-security · 2026-07-06T13:54:14Z

Superagent didn't find any vulnerabilities or security issues in this PR.

codecov · 2026-07-06T14:00:26Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.41%. Comparing base (ca6a6d7) to head (9a25573).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3836   +/-   ##
=======================================
  Coverage   93.41%   93.41%           
=======================================
  Files         326      326           
  Lines       32855    32887   +32     
  Branches    12035    12044    +9     
=======================================
+ Hits        30691    30723   +32     
  Misses       1530     1530           
  Partials      634      634

Files with missing lines	Coverage Δ
src/mcp/local-write-tools.ts	`100.00% <100.00%> (ø)`

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

loopover-orb · 2026-07-06T14:48:27Z

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-07-06 14:49:42 UTC}

2 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

safe to merge

Review summary
This adds `buildFollowUpIssueSpec` to compose a sanitized title/body for a deferred-review-finding issue and delegates to the existing `buildFileIssueSpec`/`gh issue create` shape, consistent with the other local-write builders in this file. The HTML-comment-stripping and length-bounding logic is correct for the tested cases, sanitization of `inputs.finding` before return correctly prevents raw hidden-comment text from leaking into the structured output, and the diff is fully covered by five new unit tests exercising labels-present/absent, marker-stripping, title truncation, and body truncation branches. One real design flaw: `composeFollowUpIssueBody` reuses `boundFollowUpLine` (which collapses all whitespace, including newlines, to single spaces) for both `finding.detail` and `finding.action`, so any multi-line/multi-paragraph finding detail will be flattened into one line in the issue body — likely unintended given `detail` is meant to carry a fuller explanation, not a single line like a title.

Nits — 5 non-blocking

local-write-tools.ts:64 (`composeFollowUpIssueBody`) uses `boundFollowUpLine`, which strips all newlines via `\s+` collapsing, for `finding.detail`/`finding.action` — any multi-line finding detail loses its paragraph structure in the issue body; consider a `boundFollowUpBody`-style bound that preserves internal newlines for these fields.
local-write-tools.ts:87 hardcodes the `500` character cap for `finding.action` inline; consider a named constant (e.g. `FOLLOW_UP_ISSUE_ACTION_MAX`) alongside `FOLLOW_UP_ISSUE_TITLE_MAX`/`FOLLOW_UP_ISSUE_BODY_MAX` for consistency and easier tuning.
stripFollowUpMarkers's `//g` only strips well-formed, closed HTML comments — an unterminated `<!--` in attacker-influenced `finding.title`/`detail` would pass through unstripped and could still be rendered as a hidden/comment block by some Markdown renderers; worth a quick check that this matches the sanitization guarantee the PR description claims.
sanitizeFollowUpFinding re-derives `title`/`detail` via a second call to `stripFollowUpMarkers` even though `composeFollowUpIssueTitle`/`composeFollowUpIssueBody` already stripped markers earlier in the same function — harmless but slightly redundant; could thread the already-cleaned values through instead of recomputing.
Preserve newlines when bounding `finding.detail`/`finding.action` in the body (local-write-tools.ts:64-70) instead of routing them through the single-line-oriented `boundFollowUpLine`.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2177
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 1512 registered-repo PR(s), 796 merged, 47 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	kiannidev; Gittensor profile; 1512 PR(s), 47 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

Author: kiannidev
Role context: outside_contributor
Public audience mode: oss maintainer
Lane context: Repository is configured for direct PR review.
Public profile languages: TypeScript, MDX, C++, HTML, Rust
Official Gittensor activity: 1512 PR(s), 47 issue(s).
PR-specific overlap: none found.

Contributor next steps

Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

Related work = same linked issue, overlapping active PRs, or title/path similarity.
Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

Re-run Gittensory review

loopover-orb

Gittensory approves — the gate is satisfied and CI is green.

kiannidev and others added 2 commits July 6, 2026 15:51

feat(mcp): add follow-up issue local-write action spec (JSONbored#2177)

3f596fd

Compose a boundary-safe gh issue-create spec from deferred review findings so contributors can file follow-up work locally without a new MCP write path. Co-authored-by: Cursor <cursoragent@cursor.com>

fix(mcp): sanitize follow-up finding inputs before returning spec

9a25573

Strip HTML comment markers from inputs.finding so harnesses that read structured fields cannot emit hidden comment text into public issues. Co-authored-by: Cursor <cursoragent@cursor.com>

kiannidev requested a review from JSONbored as a code owner July 6, 2026 13:52

jimcody1995 mentioned this pull request Jul 6, 2026

feat(review): anchor-safety validation drops un-commentable suggested changes #3837

Closed

5 tasks

jimcody1995 mentioned this pull request Jul 6, 2026

feat(review): anchor-safety validation drops un-commentable suggested changes #3839

Closed

2 tasks

loopover-orb Bot added the gittensor:feature Gittensor-scored feature linked to a feature issue — scores a 0.25x multiplier. label Jul 6, 2026

loopover-orb Bot assigned kiannidev Jul 6, 2026

loopover-orb Bot approved these changes Jul 6, 2026

View reviewed changes

loopover-orb Bot merged commit 7f84fa7 into JSONbored:main Jul 6, 2026
8 checks passed

JSONbored mentioned this pull request Jul 6, 2026

feat(review): add fix-handoff block renderer + follow-up-issue MCP spec #3834

Merged

24 tasks

This was referenced Jul 9, 2026

MCP release due: 0.7.0 RealDiligent/gittensory#6

Open

MCP release due: 1.0.0 joaovictor91123/gittensory#2

Open

Navigation Menu

Uh oh!

feat(mcp): add follow-up issue local-write action spec (#2177) - #3836

feat(mcp): add follow-up issue local-write action spec (#2177)#3836
loopover-orb[bot] merged 2 commits into
JSONbored:mainfrom
kiannidev:feat/2177-follow-up-issue-spec

kiannidev commented Jul 6, 2026

Uh oh!

superagent-security Bot commented Jul 6, 2026

Uh oh!

codecov Bot commented Jul 6, 2026

Uh oh!

loopover-orb Bot commented Jul 6, 2026 •

edited

Loading

✅ Gittensory review result - approve/merge recommended

Uh oh!

loopover-orb Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

kiannidev commented Jul 6, 2026

Summary

Scope

Validation

Safety

UI Evidence

Notes

Uh oh!

superagent-security Bot commented Jul 6, 2026

Uh oh!

codecov Bot commented Jul 6, 2026

Codecov Report

Uh oh!

loopover-orb Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Gittensory review result - approve/merge recommended

Uh oh!

loopover-orb Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

loopover-orb Bot commented Jul 6, 2026 •

edited

Loading