feat(miner-extension): add workspace package and CI wiring

[jsdevninja]

Summary

• Add @jsonbored/gittensory-miner-extension\ as a real npm workspace package with \lint, \ ypecheck, and \�uild\ scripts.
• Mirror the maintainer overlay sibling with @jsonbored/gittensory-extension\ package metadata and shared CI steps.
• Add \scripts/build-miner-extension.mjs\ and wire both extensions into \�alidate-code\ (lint, typecheck, build) plus the UI path filter.

Closes #4866

Test plan

• \pm run extension:lint && npm run miner-extension:lint\
• \pm run extension:typecheck && npm run miner-extension:typecheck\
• \pm run extension:build && npm run miner-extension:build\
• \pm run typecheck\
• \px vitest run test/unit/ci-extension-packages.test.ts test/unit/ci-ui-build-openapi.test.ts test/unit/miner-extension-content.test.ts\

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.98%. Comparing base (407411f) to head (ac21fc8).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5567   +/-   ##
=======================================
  Coverage   94.98%   94.98%           
=======================================
  Files         573      573           
  Lines       45469    45469           
  Branches    14680    14680           
=======================================
  Hits        43187    43187           
  Misses       1531     1531           
  Partials      751      751           

Flag	Coverage Δ
shard-1	44.04% <ø> (ø)
shard-2	35.67% <ø> (ø)
shard-3	32.11% <ø> (ø)
shard-4	32.88% <ø> (ø)
shard-5	31.87% <ø> (+<0.01%)	⬆️
shard-6	44.17% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-13 06:38:56 UTC}

12 files · 2 AI reviewers · no blockers · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): .github/workflows/ci.yml (matched .github/workflows/**), .github/workflows/ui-deploy.yml (matched .github/workflows/**), scripts/build-miner-extension.mjs (matched scripts/**), scripts/mcp-release-core.mjs (matched scripts/**).

Review summary
This PR gives the miner extension a real npm workspace package (package.json with lint/typecheck/build scripts), adds a matching package.json for the previously-unpackaged maintainer overlay extension, and wires both into ci.yml, ui-deploy.yml, package.json, and mcp-release-core.mjs's UI-only path list. The new scripts/build-miner-extension.mjs hand-rolls a stored (uncompressed) ZIP writer; I traced every local/central-directory/end-of-central-directory field offset against the ZIP spec and they line up correctly, so the packaging step itself looks structurally sound. The most notable detail is that this reimplements ZIP encoding by hand in raw byte offsets rather than using an existing dependency, which is a correctness-sensitive area that's easy to silently corrupt on future edits.

Nits — 6 non-blocking

• scripts/build-miner-extension.mjs: the local/central header field offsets (30/46-byte buffers) are all magic numbers with no named constants or spec references — a future edit to add a field is easy to get subtly wrong without breaking any test that doesn't unzip the output.
• scripts/build-miner-extension.mjs:57,72: the hardcoded DOS date value `33` is unexplained — a one-line comment noting it's an arbitrary/fixed mod-date (since determinism matters more than accuracy here) would save the next reader from re-deriving it.
• createStoredZip is a single 61-line function handling local headers, central headers, and the EOCD record together — consider splitting header construction into a small helper to reduce the nesting/size flagged by review tooling.
• apps/gittensory-extension/package.json and apps/gittensory-miner-extension/package.json duplicate the `node --check ...` lint pattern per-file; if a new file is added to one extension and the PACKAGE_FILES list in build-miner-extension.mjs isn't updated in lockstep, the build silently omits it — consider a test asserting PACKAGE_FILES stays in sync with the lint script's file list.
• test/unit/ci-extension-packages.test.ts only asserts substrings are present in the workflow/package.json text rather than actually invoking the scripts end-to-end — fine for wiring verification but worth noting it doesn't prove the zip output is a valid archive.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	2 reviewers, synthesized
Linked issue	✅ Linked	#4866
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 238 registered-repo PR(s), 146 merged, 40 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	jsdevninja; Gittensor profile; 238 PR(s), 40 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence. LLM value judgment: moderate — The change closes the linked issue by giving the miner extension real package-manager and CI parity with the existing maintainer extension, which is a well-scoped, narrow improvement rather than new feature surface area.

Linked issue satisfaction

Addressed
The PR adds a real package.json for apps/gittensory-miner-extension, registers it as a workspace member in package-lock.json, and wires lint/typecheck/build steps into ci.yml and ui-deploy.yml matching the sibling gittensory-extension, plus adds tests asserting this parity.

Review context

• Author: jsdevninja
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 238 PR(s), 40 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/	desktop			—
/	mobile			—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[JSONbored]

Closing:

package-lock.json (diff) removes top-level entries for @​cloudflare/workers-types and @​anthropic-ai/sdk and re-marks several previously non-dev packages (e.g. @​emnapi/core, postcss, rolldown, nanoid) as dev:true — this is unrelated lockfile drift for a PR that should only be adding two new workspace packages, and is a plausible root cause for validate-code and validate-tests failing across every shard on this commit; regenerate the lockfile from a clean `npm install` against main rather than committing whatever state the local tree produced.