feat(agent): maintainer CLI controls — maintain status/approve/reject/pause/resume (advances #784)

[JSONbored]

One slice of #784 (this PR is incremental — #784 stays open).

What & why

Phase 3 (#784) — CLI control-surface slice. A gittensory-mcp maintain command for the agent auto-maintain layer, thin-proxying the existing maintainer APIs (the API enforces authorization; the CLI never decides locally):

Command	Proxies
maintain status --repo o/r	GET .../agent/pending-actions — list the approval queue (#779)
maintain approve <id> --repo o/r	POST .../{id}/accept — execute the staged action
maintain reject <id> --repo o/r	POST .../{id}/reject — cancel it
maintain pause|resume --repo o/r	PUT .../settings { agentPaused } — kill-switch (#130)

The CLI exposes approve/reject and maps to the route's accept/reject decision verb. --json for machine output. Wired into the command dispatch + completion registry + a maintain --help.

Scope

This is the CLI deliverable of the #784 control surface. The dashboard slice (audit feed) is in flight via the contributor PR #831; the MCP read tool is PR #851. #784 remains open until all three deliverables land. The MCP CHANGELOG regenerates at mcp-release time (not a per-PR gate).

Tests

status (plain + JSON), approve/reject, pause/resume, input validation (--repo required, id required for approve, unknown subcommand), and help. The CLI test fixture server gains the queue + settings endpoints. Full suite green (2123); CLI smoke + node --check ok.

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#852 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 3 changed file(s) — two independent AI reviewers.

Changed files: packages/gittensory-mcp/bin/gittensory-mcp.js, test/unit/mcp-cli-maintain.test.ts, test/unit/support/mcp-cli-harness.ts

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
This PR adds a new maintain subcommand to the MCP CLI for maintainer‑level controls (status, approve, reject, pause, resume) and includes comprehensive unit tests with fixture server support. The implementation follows existing patterns, validates inputs, and respects the public/private sanitizer.

Suggestions

• Add a unit test for the --json output of approve/reject/pause/resume to ensure machine‑readable paths are covered.
• Verify that the top‑level help (printHelp) includes the new maintain command for consistency with other subcommands.

Worth double-checking

• Make sure the backend API endpoints (/agent/pending-actions and /settings) enforce maintainer authentication; the CLI trusts the server for auth.
• Confirm that no forbidden public terms are introduced in future output formats.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
This PR adds maintainer CLI controls for the agent auto-maintain layer, implementing status/approve/reject/pause/resume subcommands under gittensory-mcp maintain. The changes are well-structured, reuse existing API patterns, include comprehensive unit tests with proper mocking, and maintain the public/private boundary (maintainer-only CLI, no forbidden terms in output). The code follows project conventions and is ready for merge.

Suggestions

• Consider adding a test for JSON output of pause/resume commands to ensure machine-readable output consistency.
• The help text could mention that these actions require maintainer access (already implied by 'requires maintainer access' but could be explicit in subcommand descriptions).

Worth double-checking

• Verify that the API endpoints called (/agent/pending-actions, /settings) are indeed protected by maintainer authorization on the backend (they are, per comments).
• Ensure the emit helper's JSON output doesn't accidentally leak internal fields (it forwards the API payload directly, which is safe).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.68%. Comparing base (134b0c3) to head (2e36530).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #852   +/-   ##
=======================================
  Coverage   96.68%   96.68%           
=======================================
  Files         108      108           
  Lines       14609    14609           
  Branches     5288     5288           
=======================================
  Hits        14125    14125           
  Misses        105      105           
  Partials      379      379           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.