fix(engine): auto-maintain sibling-package engine dependency ranges

[JSONbored]

Summary

• `gittensory-mcp` and `gittensory-miner` both pinned `"@jsonbored/gittensory-engine": ">=0.1.0 <1.0.0"`.
  Engine's upcoming 1.0.0 release (chore(release): cut engine v1.0.0 #4686) falls outside that upper bound, breaking `npm ci` with
  `Missing: @jsonbored/gittensory-engine@0.2.0 from lock file` -- the exact recurrence the `<1.0.0` cap
  guaranteed, since it was itself a manual fix (fix(release): sync package-lock.json via script, not release-please extra-files #4179) for the same bug at the 0.1.0 -> 0.2.0 bump.
• `gittensory-mcp` (a live, published package): widened to `"^0.2.0"`. Also enables release-please's
  `node-workspace` plugin (`merge: false`, matching this repo's existing `separate-pull-requests: true`),
  which automatically rewrites a workspace-local caret dependency's target version every time the package it
  points at gets bumped -- so this exact fix should never need to be repeated by hand again for mcp, on any
  future engine bump, major or otherwise.
• `gittensory-miner`: widened to `""`. Unlike mcp, `@jsonbored/gittensory-miner` has never actually been
  published (`npm view` 404s), so it has no real external consumer today and no version-range supply-chain
  exposure -- `""` is the standard idiom for a same-monorepo-only workspace dependency. Deliberately not
  onboarding miner into release-please management here since that's a separate release-process decision;
  flagging it as a follow-up worth a deliberate call, not bundling it into this fix.

Test plan

• `rm -rf node_modules && npm ci` resolves cleanly (was failing before this change)
• `npx tsc --noEmit -p .` clean
• `npm run test --workspace @jsonbored/gittensory-engine`: 349/349 pass
• Full unsharded `npm run test:coverage`: 704 files / 13935 tests passed, 0 failed
• `npm run build:mcp`, `npm run build:miner`, `npm run test:mcp-pack`, `npm run test:miner-pack` all pass
• `npm run docs:drift-check`, `manifest:drift-check`, `engine-parity:drift-check` all pass
• `npm audit --audit-level=moderate`: 0 vulnerabilities

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	e589308	Commit Preview URL Branch Preview URL	Jul 11 2026, 06:20 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.27%. Comparing base (c8bb830) to head (e589308).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4974   +/-   ##
=======================================
  Coverage   94.27%   94.27%           
=======================================
  Files         451      451           
  Lines       38900    38900           
  Branches    14172    14172           
=======================================
  Hits        36674    36674           
  Misses       1574     1574           
  Partials      652      652           

Flag	Coverage Δ
shard-1	46.83% <ø> (ø)
shard-2	33.31% <ø> (ø)
shard-3	31.41% <ø> (ø)
shard-4	33.15% <ø> (ø)
shard-5	33.54% <ø> (ø)
shard-6	45.24% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-11 06:33:44 UTC}

4 files · 1 AI reviewer · 2 blockers · readiness 93/100 · CI green · dirty

⏸️ Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Review summary
This PR widens gittensory-mcp's engine dependency from ">=0.1.0 <1.0.0" to "^0.2.0" and gittensory-miner's to "*", and adds release-please's node-workspace plugin (merge: false) so mcp's caret range is automatically rewritten on future engine releases. The immediate fix is correct: engine currently resolves to 0.2.0, which satisfies both new ranges, so npm ci is unblocked for the pending 1.0.0 engine release described in #4686. The long-term durability of the mcp fix hinges on release-please's node-workspace plugin actually rewriting the caret target across a 0.x->1.0.0 major-version transition, which isn't verifiable from this diff alone but is a reasonable, narrowly-scoped mechanism rather than another manual pin.

Nits — 5 non-blocking

• The PR description doesn't reference or close an eligible open issue (only prior PRs chore(release): cut engine v1.0.0 #4686/fix(release): sync package-lock.json via script, not release-please extra-files #4179 are cited) — per repo convention this should be linked before merge-ready status.
• packages/gittensory-miner/package.json:38 widens to "*", which per the external dependency scan accepts any future published version of the engine package; low risk today since the miner package itself is unpublished, but worth a one-line note in the PR description acknowledging this tradeoff explicitly (partially already covered) versus using workspace protocol if this repo's npm/workspaces setup supports it.
• release-please-config.json:18-23 — confirm via a release-please dry-run that the node-workspace plugin correctly bumps the mcp caret range across the 0.x -> 1.0.0 major boundary specifically, since caret semantics for 0.x versions are stricter than for 1.x and this is the exact scenario the PR is trying to future-proof against.
• Add a short doc/comment pointer (e.g. in CONTRIBUTING or release docs) explaining that mcp's engine dependency range is now release-please-managed via node-workspace, so future contributors don't hand-edit it and reintroduce the same bug class as fix(release): sync package-lock.json via script, not release-please extra-files #4179.
• Consider a follow-up issue tracking whether gittensory-miner should be onboarded into release-please management once it's actually published, as the description already flags.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 48 registered-repo PR(s), 40 merged, 423 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 48 PR(s), 423 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.
Improvement	⚠️ ℹ️ Insufficient signal	risk: clean · value: insufficient-signal — Nothing measurable for the structural-improvement analyzers on this PR (e.g. no code files changed).

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 48 PR(s), 423 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review