chore(mcp): convert bin/loopover-mcp.js to TypeScript (Phase 3 of #7291)

packages/loopover-mcp/package.json

@@ -33,12 +33,14 @@
     "lib",
     "scripts",
     "CHANGELOG.md",
+    "!bin/**/*.ts",
     "!lib/**/*.ts",
-    "!scripts/check-syntax.mjs"
+    "!scripts/check-syntax.mjs",
+    "!scripts/strip-bin-sourcemap.mjs"
   ],
   "scripts": {
     "build": "npm run build:tsc && npm run build:verify",
-    "build:tsc": "tsc -p tsconfig.json",
+    "build:tsc": "tsc -p tsconfig.json && node scripts/strip-bin-sourcemap.mjs",
     "build:verify": "node scripts/check-syntax.mjs"
   },
   "dependencies": {

packages/loopover-mcp/scripts/check-syntax.mjs

@@ -5,10 +5,13 @@
 // added, removed, or migrated to TypeScript (#7290's mcp counterpart, #7291). Glob-driven instead: covers
 // every file automatically, migrated or not, with no list to fall out of date.
 import { readdirSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";
 
-const ROOT = new URL("..", import.meta.url).pathname;
+// fileURLToPath (not URL.pathname): on Windows, pathname is "/D:/..." and join() can produce a doubled
+// drive prefix (D:\D:\...), which breaks readdirSync. Same pattern as packages/loopover-miner/bin.
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
 
 function listFiles(dir, extension) {
   return readdirSync(join(ROOT, dir), { withFileTypes: true })

packages/loopover-mcp/scripts/strip-bin-sourcemap.mjs

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+// Strip the trailing inline sourceMappingURL from compiled bin/*.js after tsc.
+//
+// The package tsconfig uses inlineSourceMap so small lib modules stay coverage-remapable without
+// publishing a new *.map file type. For bin/loopover-mcp.js (~6.5k lines) the inline map roughly
+// doubles the shipped file past LoopOver's patch-less secrets-scan fetch cap (512KB), which made
+// the prior Phase 3 attempt (#7431) fail closed. Bin is subprocess-only tested (mcp-cli harness),
+// so v8 never remaps through this file anyway — stripping the map keeps the published/committed
+// artifact under the scan cap without changing runtime behavior.
+import { readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+const BIN = join(ROOT, "bin");
+const MARKER = "\n//# sourceMappingURL=";
+
+let stripped = 0;
+for (const entry of readdirSync(BIN, { withFileTypes: true })) {
+  if (!entry.isFile() || !entry.name.endsWith(".js")) continue;
+  const path = join(BIN, entry.name);
+  const before = readFileSync(path, "utf8");
+  const idx = before.lastIndexOf(MARKER);
+  if (idx === -1) continue;
+  writeFileSync(path, before.slice(0, idx) + "\n");
+  stripped += 1;
+}
+
+console.log(`stripped inline sourcemaps from ${stripped} bin/*.js file(s)`);

scripts/branding-drift-baseline.json

@@ -5,6 +5,7 @@
   "apps/loopover-ui/src/routes/app.workbench.tsx": 1,
   "packages/loopover-engine/src/signals/engine.ts": 2,
   "packages/loopover-mcp/bin/loopover-mcp.js": 2,
+  "packages/loopover-mcp/bin/loopover-mcp.ts": 2,
   "src/api/routes.ts": 2,
   "src/db/repositories.ts": 1,
   "src/github/app.ts": 11,