fix(miner): share repo-clone.js's path-safety validation across owner/repo CLI parsers

[nghetienhiep]

Summary

• repo-clone.js already had a real path-safety check (character-set + no ./.. segments) for owner/repo values, but attempt-cli.js, claim-ledger-cli.js, event-ledger-cli.js, and claim-ledger.js only checked "exactly one slash, both halves non-empty" — an unsafe value like owner/.. or owner baz/repo was accepted at those entry points and either produced a generic downstream error or (for the two ledger CLIs) was persisted unvalidated as a ledger key.
• Extracted repo-clone.js's pattern + traversal check into one exported isValidRepoSegment helper (alongside the existing REPO_SEGMENT_PATTERN/isPathTraversalSegment, now also exported) and pointed all five call sites — including cross-repo-evaluation.js's previously duplicated copy — at the same source of truth.
• Each call site keeps its own error-reporting shape (parseAttemptArgs's { error }, the ledger CLIs' reportCliFailure, claim-ledger.js's thrown invalid_repo_full_name) — only the validity check got stricter.

Closes #5831

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• None skipped. This is a backend-only (packages/loopover-miner/lib/**) change with no apps/loopover-ui, OpenAPI, or wrangler-binding surface, so the UI/OpenAPI checks above are unaffected passes rather than active validations of new behavior.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

Not applicable — no UI/frontend/docs-visible change.

Notes

• packages/loopover-miner/lib/purge-cli.js has its own parseRepoArg with the same "one slash" weakness but is out of scope: it isn't listed in fix(miner): several owner/repo CLI parsers skip repo-clone.js's path-safety validation #5831's deliverables, and this PR keeps the diff to the exact call sites the issue calls out.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.31%. Comparing base (b2df9a1) to head (e064ab8).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #6120       +/-   ##
===========================================
+ Coverage   48.76%   95.31%   +46.55%     
===========================================
  Files         595      595               
  Lines       47097    47096        -1     
  Branches    15030    15030               
===========================================
+ Hits        22965    44889    +21924     
+ Misses      21488     1476    -20012     
+ Partials     2644      731     -1913     

Flag	Coverage Δ
shard-1	43.58% <37.50%> (?)
shard-2	36.76% <75.00%> (?)
shard-3	31.95% <50.00%> (?)
shard-4	32.27% <37.50%> (-1.70%)	⬇️
shard-5	32.54% <50.00%> (+0.88%)	⬆️
shard-6	44.89% <50.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/loopover-miner/lib/attempt-cli.js	98.05% <100.00%> (+83.42%)	⬆️
packages/loopover-miner/lib/claim-ledger-cli.js	99.41% <100.00%> (+99.41%)	⬆️
packages/loopover-miner/lib/claim-ledger.js	100.00% <100.00%> (+95.78%)	⬆️
...ckages/loopover-miner/lib/cross-repo-evaluation.js	100.00% <100.00%> (+100.00%)	⬆️
packages/loopover-miner/lib/event-ledger-cli.js	98.27% <100.00%> (+0.86%)	⬆️
packages/loopover-miner/lib/repo-clone.js	100.00% <100.00%> (+2.08%)	⬆️

... and 389 files with indirect coverage changes

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-15 10:24:34 UTC}

12 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This PR extracts repo-clone.js's owner/repo path-safety check (character-set regex + `.`/`..` traversal rejection) into an exported `isValidRepoSegment` helper and wires it into the four call sites (attempt-cli.js, claim-ledger-cli.js, event-ledger-cli.js, claim-ledger.js) that previously only checked for a single non-empty slash split, plus deduplicates cross-repo-evaluation.js's own copy of the same logic. Each call site correctly adds the new check alongside its existing empty/extra-segment guard, keeps its own error-reporting shape, and the corresponding .d.ts is updated with matching exports. Tests are added for each touched parser covering both owner and repo segment positions with traversal and invalid-character cases, and the change is narrowly scoped with a linked issue (#5831) and closes it directly.

Nits — 3 non-blocking

• repo-clone.js:41 `isValidRepoSegment` doesn't reject non-string non-undefined values distinctly from `false`/`0`/etc. beyond the `typeof` check — fine given call sites always pass split() string segments, but worth a one-line note if it's ever called with unvalidated input.
• purge-cli.js's own `parseRepoArg` (shown in the reference context) still only checks 'one slash, both non-empty' and is not updated by this PR — since it's not in the diff it may be an intentional follow-up, but worth confirming it isn't an oversight given the PR's stated goal of covering every owner/repo parser.
• Consider filing/checking whether purge-cli.js's parseRepoArg should also adopt isValidRepoSegment in a follow-up, since it persists a repoFullName used for deletion across four ledgers and seems to fall under the same class of issue as fix(miner): several owner/repo CLI parsers skip repo-clone.js's path-safety validation #5831.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#5831
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 70 registered-repo PR(s), 36 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	nghetienhiep; Gittensor profile; 70 PR(s), 0 issue(s).
Gate result	✅ Passing	No configured blocker found.
Improvement	✅ Minor	risk: clean · value: minor · LLM: moderate

Linked issue satisfaction

Addressed
The PR extracts repo-clone.js's REPO_SEGMENT_PATTERN/isPathTraversalSegment into an exported isValidRepoSegment helper and applies it to attempt-cli.js, claim-ledger-cli.js, event-ledger-cli.js, claim-ledger.js's normalizeRepoFullName, and cross-repo-evaluation.js, while preserving each file's existing error-reporting convention. Regression tests covering invalid segments (traversal, spaces) are a

Review context

• Author: nghetienhiep
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Vue, C#, JavaScript, Python, C, C++, Go, Objective-C
• Official Gittensor activity: 70 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.