feat(miner): add offline GitHub-token and coding-agent-credential presence checks to doctor (#5170)

[joaovictor91123]

Summary

• gittensory-miner doctor's checks make zero network calls (a documented invariant) but never verified GITHUB_TOKEN was set, nor that the credential required by whichever MINER_CODING_AGENT_PROVIDER is configured was present. An operator could pass doctor cleanly and then have their first real attempt fail mid-run purely on a missing credential.
• Adds two new offline checks to runDoctorChecks():
  • github-token-present -- string presence/length check only (no API call) on GITHUB_TOKEN.
  • coding-agent-credential-present -- keyed off resolveFirstConfiguredCodingAgentDriverName (the same resolution status.js's driver section, Surface the resolved coding-agent-driver provider and CLI presence in gittensory-miner status --json #5164, already uses):
    • claude-cli configured -- checks CLAUDE_CODE_OAUTH_TOKEN is set and non-empty (the same condition checkClaudeCliPresent already probes).
    • codex-cli configured -- checks the codex auth.json path (exported resolveCodexAuthPath from laptop-init.js, reused rather than re-derived) is readable.
    • noop/agent-sdk configured, or no provider configured -- ok: true advisory, since these are locally-authenticated with no separate credential this repo tracks (driver-factory.ts's own comment: "All are locally-authenticated (no API-key env requirement)"). I did not invent a fake API-key check for agent-sdk since the actual architecture has none today -- the issue's generic phrasing doesn't quite match this repo's current driver set, so this reports the honest state instead.
  • Both new checks are zero-network, and never print a credential's actual value -- only presence booleans, env-var names, and file paths.

Test plan

• npx vitest run test/unit/miner-status.test.ts -- 33/34 passing (one pre-existing, unrelated Windows-only path.join separator failure, confirmed via git stash to exist identically without this PR). New describe("doctor credential-presence checks (#5170)", ...) block covers: GITHUB_TOKEN present/absent (regression guard), unconfigured-provider advisory, noop/agent-sdk advisory with no secret in the message, claude-cli token present/missing, codex-cli auth.json present/missing, a zero-network-call assertion, and an invariant that doctor's --json output never contains an actual credential value.
• Updated the existing "doctor passes on a healthy setup" and "runDoctor supports --json output" tests to set GITHUB_TOKEN so they remain genuinely healthy with the two new checks added.
• npm run typecheck -- clean.
• npm run build:miner -- clean (node --check on every shipped miner lib file passes).
• npm run docs:drift-check -- clean.
• packages/gittensory-miner/** currently sits outside vitest's coverage.include glob (per the issue's own Codecov-visibility note), so codecov/patch cannot measure this change yet -- treating the tests above as the enforced house standard regardless, per the issue's instructions.
• Did not run the full unsharded npm run test:coverage locally (shared/resource-contended machine); relying on the targeted test run above plus npm run typecheck/build:miner.

Fixes #5170.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.41%. Comparing base (fb76770) to head (ab773ed).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5341      +/-   ##
==========================================
+ Coverage   85.99%   94.41%   +8.42%     
==========================================
  Files         550      550              
  Lines       44116    44130      +14     
  Branches    14631    14631              
==========================================
+ Hits        37936    41665    +3729     
+ Misses       4894     1790    -3104     
+ Partials     1286      675     -611     

Flag	Coverage Δ
shard-1	43.74% <0.00%> (-0.27%)	⬇️
shard-2	34.02% <0.00%> (?)
shard-3	32.15% <0.00%> (+0.60%)	⬆️
shard-4	31.28% <42.85%> (-0.14%)	⬇️
shard-5	33.07% <100.00%> (-0.09%)	⬇️
shard-6	43.61% <0.00%> (+0.26%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/gittensory-miner/lib/laptop-init.js	100.00% <ø> (+14.70%)	⬆️
packages/gittensory-miner/lib/status.js	93.91% <100.00%> (+0.84%)	⬆️

... and 96 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 Gittensory review result - reject/close recommended

_{Review updated: 2026-07-12 14:15:50 UTC}

4 files · 1 blocker · readiness 100/100 · CI green · unstable

🛑 Suggested Action - Reject/Close

• AI review already in progress for this PR head: Another Gittensory pass is already running the AI review for this exact PR head. This pass is skipping to avoid a duplicate LLM call.

Review summary
AI review is already running for this PR head in another Gittensory pass. Gittensory is holding this PR for manual review until that pass completes.

Nits — 1 non-blocking

• AI review already in progress for this PR head — The gate is held for a human reviewer rather than passed automatically; it re-evaluates once the in-flight review completes or on the next update.

Why this is blocked

• Possible leaked secret in the diff (generic_secret_assignment) — Remove the secret from the diff, rotate the exposed credential, then re-run the gate.

Signal	Result	Evidence
Code review	❌ 1 blocker	No AI review summary
Linked issue	✅ Linked	#5170
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 121 registered-repo PR(s), 71 merged, 11 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	joaovictor91123; Gittensor profile; 121 PR(s), 11 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence.

Review context

• Author: joaovictor91123
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 121 PR(s), 11 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[loopover-orb]

Gittensory is closing this pull request on the maintainer's behalf (Possible leaked secret in the diff (generic_secret_assignment)). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.