feat(miner): add repo stack auto-detection (#4785)

[andriypolanski]

Summary

• Adds the stack-detection module the loop needs before it can safely change an arbitrary repo: detectRepoStack (packages/gittensory-miner/lib/stack-detection.js) inspects an already-cloned target repo's manifest / lockfile / config files and returns a structured description — language, packageManager, buildCommand, testCommand, lintCommand, formatCommand, plus the evidence (manifest + lockfile) that drove it.
• Detects a documented set of common repo shapes: Node (npm / yarn / pnpm / bun, from the corepack field then the lockfile; TypeScript vs JavaScript from tsconfig.json or a typescript dep; commands from package.json scripts), Python (pip / poetry / pipenv / uv; ruff + pytest inferred only from real config), Rust (cargo), Go (go vet, or golangci-lint when configured), Maven, and Gradle (wrapper-aware).
• Fails clearly and safely — no guessing (acceptance criterion): a repo with no recognized manifest returns { detected: false, reason }, and any command that can't be inferred from real config stays null rather than being assumed. The module is pure and never throws — an unreadable/unparseable/binary file degrades to "no evidence".
• Follows the established miner DI convention (miner-goal-spec.js): injectable existsSync / readFileSync that always receive the full joined path, so it's unit-testable against fixtures with no real filesystem.
• Detection only. Wiring the description into the attempt prompt / validation step is the follow-up (Generalized plan → implement → test → submit loop #4786, the generalized plan → implement → test → submit loop) — kept out of this PR so no heavily-tested attempt-pipeline code changes here.

Closes #4785.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• Run the full gate with npm run test:ci (and npm run test:coverage unsharded) under Node 22 (.nvmrc) before pushing. The development sandbox runs Node 18 without the workspace node_modules, so the Vitest gate could not be executed here. Because this module depends only on node:fs / node:path (no engine, no node:sqlite), its logic was executed here against the real compiled module via a standalone Node script exercising every detector, package-manager, command-category, and fail-closed branch (all green), and node --check passes.
• Codecov surface: the only measured file is packages/gittensory-miner/lib/stack-detection.js; the .d.ts, package.json, README, and test/** are not. The module is pure and dependency-injected, and test/unit/miner-stack-detection.test.ts targets 100% of its lines and branches (each ecosystem, each package manager, each command variant, unparseable/unreadable/non-string reads, the exists/read throw guards, precedence, and both summary arms).

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed. The detector reads only manifest/config file shapes and emits shell command strings; it never reads env, credentials, or source blobs.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (None in this PR.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (No API/OpenAPI/MCP surface changed.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (No UI changes.)
• Visible UI changes include a UI Evidence section below. (Not applicable — no UI changes.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. (CHANGELOG.md untouched.)

UI Evidence

Not applicable — this change is a miner-package runtime module + tests + package docs (Markdown). No rendered frontend surface changed.

Notes

• Fail-closed is the core contract. The acceptance criteria explicitly require "no guessing" when a stack can't be confidently detected; the discriminated-union return ({ detected: false, reason } vs a structured stack with null command fields) enforces that at the type level. Commands are asserted only when they're canonical for the toolchain (cargo/go) or declared in real config/scripts.
• Precedence is documented and deterministic. For a polyglot repo the first matching manifest in RECOGNIZED_MANIFESTS order wins; evidence.manifest reports which one, so a caller can special-case if needed.
• Unblocked by De-hardcode discovery from gittensory's own conventions #4784. This is the next item in the Miner Wave 5 chain (Part of Epic: Miner Wave 5 — Rent-a-Loop #4778) and was blocked on the repo-agnostic discovery work in De-hardcode discovery from gittensory's own conventions #4784.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-07-12 22:37:24 UTC}

5 files · 2 AI reviewers · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This adds a pure, never-throwing stack-detection module that inspects an already-cloned repo for its manifest/lockfile/config and returns a structured language/package-manager/command description, or an explicit fail-closed result when nothing recognized is found. The logic is sound and the fail-closed contract (no guessed commands) is genuinely upheld throughout each detector. Test coverage is thorough, covering every detector, precedence order, and both arms of the null-coalescing summary renderer. This is detection-only with no wiring into the attempt pipeline, which the PR description explicitly defers to a follow-up (#4786).

Nits — 5 non-blocking

• packages/gittensory-miner/lib/stack-detection.js:53-67 — makeAccess's exists/read swallow all fs errors including unexpected ones (permissions, I/O errors) as silent 'absent'; that's the intended fail-safe design here but worth a one-line comment noting it's deliberate rather than an oversight (already partially documented above the function).
• packages/gittensory-miner/lib/stack-detection.js:124 (detectPython) is the most complex function in the diff (~12 branches) — could be split into smaller helpers (e.g. resolvePythonPackageManager) for readability, though it's still easy to follow.
• The PR doesn't explicitly link back to an open maintainer-authorized issue beyond Stack auto-detection #4785/Generalized plan → implement → test → submit loop #4786 referenced in the description — worth double-checking those issues exist and are the ones intended, since I can't verify issue state from the diff alone.
• stack-detection.d.ts duplicates the JSDoc type shape already enforced by the .js file; consider generating .d.ts via tsc/checkJs instead of hand-maintaining a parallel type file to avoid drift (matches existing repo convention question, not new to this PR).
• Consider factoring the Python detector's package-manager resolution (poetry/uv/pipenv/pip) into a small helper to reduce detectPython's branch count and mirror the Node detector's decomposition (nodeLockfile/nodePackageManager).

Signal	Result	Evidence
Code review	✅ No blockers	2 reviewers, synthesized
Linked issue	✅ Linked	#4785
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 155 registered-repo PR(s), 105 merged, 29 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	andriypolanski; Gittensor profile; 155 PR(s), 29 issue(s).
Gate result	✅ Passing	No configured blocker found.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence. LLM value judgment: moderate — The module is well-scoped, thoroughly tested, and fail-closed as designed, but on its own it wires into nothing yet — its value is realized only once the follow-up (#4786) consumes it in the attempt loop.

Review context

• Author: andriypolanski
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 155 PR(s), 29 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.73%. Comparing base (eca8387) to head (bb87581).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5477      +/-   ##
==========================================
+ Coverage   94.72%   94.73%   +0.01%     
==========================================
  Files         560      561       +1     
  Lines       44699    44786      +87     
  Branches    14667    14667              
==========================================
+ Hits        42343    42430      +87     
  Misses       1621     1621              
  Partials      735      735              

Flag	Coverage Δ
shard-1	43.79% <0.00%> (-0.59%)	⬇️
shard-2	35.38% <100.00%> (+0.15%)	⬆️
shard-3	31.68% <0.00%> (-0.35%)	⬇️
shard-4	31.65% <0.00%> (-0.40%)	⬇️
shard-5	33.09% <0.00%> (+0.40%)	⬆️
shard-6	43.87% <0.00%> (+0.18%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/gittensory-miner/lib/stack-detection.js	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.