feat(mcp): gittensory_remediation_plan

[kiannidev]

Summary

• Adds buildRemediationPlan to consolidate branchQualityBlockers, accountStateBlockers, and scoreBlockers from local branch analysis into an ordered, deduplicated public-safe checklist.
• Each remediation item includes an impact level and rerun condition; account-state blockers are prioritized ahead of branch-quality and score blockers.
• Registers the MCP tool gittensory_remediation_plan in the HTTP MCP server and local MCP package, plus POST /v1/local/remediation-plan for the bin client.

Closes #548

Test plan

• npm run typecheck
• npm run build:mcp
• npm run test:coverage -- test/unit/remediation-plan.test.ts
• Full CI (npm run validate)

Made with Cursor

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#650 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 10 changed file(s) — two independent AI reviewers.

Changed files (10)

• packages/gittensory-mcp/bin/gittensory-mcp.js
• src/api/routes.ts
• src/mcp/server.ts
• src/services/remediation-plan.ts
• test/integration/api.test.ts
• test/integration/routes-errors.test.ts
• test/unit/mcp-output-schemas.test.ts
• test/unit/remediation-plan.test.ts
• test/unit/routes-remediation-plan.test.ts
• test/unit/score-breakdown.test.ts

Suggested action: 🛠️ Request changes. Address the suggestions below before merging.

Reviewer A · gpt-oss-120b — recommends 🛠️ request changes
This PR adds a new remediation‑plan service, a public API route, MCP tool registration, CLI support, and extensive tests. The core logic correctly deduplicates and sanitises blocker messages, but the sanitisation helper directly calls sanitizePublicComment which throws on forbidden terms, causing potential runtime errors when such terms appear in input.

Suggestions

• Wrap the call to sanitizePublicComment in publicSafeText (and any similar helper) with a try/catch that returns an empty string on error, preventing the whole request from crashing on forbidden content.
• Add a unit test that feeds a blocker containing a forbidden term (e.g., "private context") and verifies that the remediation plan is still generated without throwing.
• Consider exporting the remediationPlanOutputSchema (or at least documenting its shape) for consistency with other tool registrations.

Worth double-checking

• If a forbidden term slips through, the current implementation would throw and break the API route or MCP tool.
• Missing catch may also cause unhandled promise rejections in the CLI tool registration.

Reviewer B · mistral-small-3.1-24b-instruct — recommends 🛠️ request changes
This PR adds a new feature to generate a remediation plan for local branch analysis. It includes a new service, API route, and corresponding tests. The implementation ensures that public-facing text is sanitized to avoid forbidden terms and maintains the project's security and privacy model.

Suggestions

• Consider adding more detailed comments to explain the logic behind the FORBIDDEN_PATTERN and the sanitization functions.
• Ensure that the remediationPlanOutputSchema is comprehensive and covers all possible outputs of the buildRemediationPlan function.
• Review the remediationPlan tool registration in the MCP server to ensure it aligns with the existing tool registration patterns.

Worth double-checking

• Verify that the sanitizePublicComment function covers all possible evasion vectors, including encoded and entity-decoded input.
• Ensure that the new API route /v1/local/remediation-plan is properly secured and that all necessary authentication and authorization checks are in place.
• Check that the new tests cover all edge cases, especially those related to sanitization and public-facing text.

[kiannidev]

Hi, @JSONbored
I resolved conflicts.

[codecov]

Codecov Report

❌ Patch coverage is 97.29730% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.66%. Comparing base (c6d0cad) to head (0319b99).

Files with missing lines	Patch %	Lines
src/services/remediation-plan.ts	96.36%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #650      +/-   ##
==========================================
+ Coverage   96.59%   96.66%   +0.06%     
==========================================
  Files          91       92       +1     
  Lines       13646    13720      +74     
  Branches     4975     5001      +26     
==========================================
+ Hits        13182    13263      +81     
+ Misses         97       88       -9     
- Partials      367      369       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JSONbored]

PR #650 — feat(mcp): gittensory_remediation_plan
Verdict: MERGE
Resolves issue #548: FULLY
CI: All green (validate, test x2, lint, workers, mcp, ui, security, Superagent Security Scan = success, codecov). gittensory/Context neutral.

Highlights:

• Implements the tool: buildRemediationPlan consolidates accountStateBlockers/branchQualityBlockers/scoreBlockers + recommendedRerunCondition into an ordered, deduplicated checklist; each item carries impact level + tailored rerun condition; account-state prioritized first, then branch-quality, then score ("highest-impact first").
• Registered in both the HTTP MCP server (with outputSchema) and the local MCP bin, plus POST /v1/local/remediation-plan with requireContributorAccess self-only enforcement and 400/403 negative tests.
• Public-safe authoring: sanitizePublicComment + forbidden-term/filesystem-path regex; rerun conditions rewrite scoreability/multiplier language and strip local paths; extensive ordering/dedup/forbidden-term unit tests.

Concerns / required changes:

• Minor (prior scope-creep re-checked): the unrelated gittensory_explain_score_breakdown / /v1/scoring/explain-breakdown additions are now TEST-ONLY for a route that already exists on main — no new unrelated production endpoint. Tangential but harmless; could be trimmed.

Completeness vs issue: Given multiple blockers it returns a correctly ordered, deduped, public-safe remediation plan with rerun conditions, registered and tested per the AC. Fully resolves #548.