fix(selfhost): build gittensory-engine before bundling in deploy-selfhost-prebuilt.sh

[JSONbored]

Summary

• run_node_build() ran npm ci --ignore-scripts straight into build-selfhost.mjs --all with no step to build packages/gittensory-engine first
• packages/gittensory-engine/dist/ is gitignored (built via tsc), and the self-host bundle's dependency graph reaches it transitively (src/mcp/find-opportunities.ts → packages/gittensory-miner/lib/opportunity-fanout.js/opportunity-ranker.js → @jsonbored/gittensory-engine by package name) — this was latent until that miner-side import landed, and will reproduce on any self-host instance's next update until fixed
• Mirrors the existing build:miner root script's ordering (engine build before miner build)

Verification

• Reproduced and fixed live on edge-nl-01 while bringing it current with main (worked around out-of-band there first, no repo changes, then verified this exact fix resolves it cleanly on a second run)
• Added a regression test asserting the engine build step precedes the bundle step in the script content
• bash -n syntax check passes; new test passes; unrelated pre-existing typecheck errors in test/unit/miner-opportunity-ranker.test.ts are untouched by this change

Test plan

• npx vitest run test/unit/docs-selfhost-update-rollback.test.ts
• bash -n scripts/deploy-selfhost-prebuilt.sh
• Verified live against a real self-host instance

Fixes #4530

[superagent-security]

Superagent did not find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.04%. Comparing base (b069dde) to head (ccb15c4).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4533   +/-   ##
=======================================
  Coverage   94.04%   94.04%           
=======================================
  Files         422      422           
  Lines       37574    37574           
  Branches    13724    13724           
=======================================
  Hits        35335    35335           
  Misses       1583     1583           
  Partials      656      656           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-09 23:21:00 UTC}

2 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): scripts/deploy-selfhost-prebuilt.sh (matched scripts/**).

Review summary
This adds the missing `npm --workspace @​jsonbored/gittensory-engine run build` step to `run_node_build()` in scripts/deploy-selfhost-prebuilt.sh, ahead of the `build-selfhost.mjs --all` bundle step, so the gitignored `packages/gittensory-engine/dist/` output exists before anything (transitively the miner's opportunity-fanout/ranker modules) resolves `@​jsonbored/gittensory-engine` by package name. This is a root-cause fix at the source layer (the missing build step itself), not a downstream workaround, and mirrors the existing `build:miner` root script's engine-then-miner build ordering per the description. The added test in test/unit/docs-selfhost-update-rollback.test.ts asserts the engine-build substring appears before the bundle substring in the script's own text, consistent with this file's existing convention (other tests in the same describe block assert directly on script content), so it isn't fabricating an unreachable runtime scenario — it's checking the actual source-of-truth ordering that caused the bug.

Nits — 5 non-blocking

• scripts/deploy-selfhost-prebuilt.sh:35 — `npm --workspace @​jsonbored/gittensory-engine run build` uses space-separated flag syntax; consider `--workspace=@​jsonbored/gittensory-engine` to match npm's more common documented form and avoid ambiguity with positional args.
• test/unit/docs-selfhost-update-rollback.test.ts's new test only checks substring order via indexOf rather than a stricter regex/exact-command match, so a coincidental reordering of unrelated text containing the same substrings could still pass — low risk given the specificity of the strings, but worth noting for future edits to this script.
• Consider asserting the exact shell snippet (e.g. via a regex matching `npm ci --ignore-scripts && npm --workspace @​jsonbored/gittensory-engine run build && node scripts/build-selfhost.mjs --all`) in the new test for tighter drift protection, matching the precision of the surrounding sibling tests in the same file.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#4530
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 49 registered-repo PR(s), 41 merged, 377 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 49 PR(s), 377 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Linked issue satisfaction

Addressed
The diff inserts `npm --workspace @​jsonbored/gittensory-engine run build` into run_node_build() before the `build-selfhost.mjs --all` bundling step, exactly matching the issue's requested fix and ordering, and adds a regression test asserting the engine build precedes the bundle step.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 49 PR(s), 377 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review