feat(scripts): scan the AI review-pipeline source roots in selfhost-env-reference

[philluiz2323]

Summary

• scripts/gen-selfhost-env-reference.mjs's DEFAULT_SOURCE_ROOTS never scanned src/services/ai-review.ts, src/queue/ai-review-orchestration.ts, or src/queue/processors.ts, so four self-host-relevant env vars actually read there -- AI_SUMMARIES_ENABLED, AI_PUBLIC_COMMENTS_ENABLED, AI_MAX_OUTPUT_TOKENS, AI_BYOK_DAILY_REPO_LIMIT -- never reached the generated reference, even though all four are already declared in src/env.d.ts's self-host doc-comment block.
• Added the three files to DEFAULT_SOURCE_ROOTS, regenerated apps/loopover-ui/src/lib/selfhost-env-reference.ts (purely additive diff), and added a regression test that runs collectSelfHostEnvVars() against the real repo and asserts all four vars are found.

Also included: a fix for test/unit/miner-extension-live-fetch.test.ts, currently broken on main. This is unrelated to #6993 but is why my first attempt at this exact issue (PR #7065) and an unrelated one-line doc-comment PR (#7061) were both closed by CI, through no fault of their own diffs. Root cause: the file's node:vm sandbox for background.js never injected AbortSignal (needed since #7007's fetch-timeout guard added AbortSignal.timeout(...)) or TextEncoder (needed since #7006's byte-size guard added new TextEncoder()) -- vm.createContext's sandbox globalThis does not inherit the host's built-ins, so anything the sandboxed script references must be explicitly provided, the same way chrome/fetch already are. 7 of 15 tests in that file currently fail with AbortSignal is not defined on main regardless of what any given PR changes, since validate-tests' shards run the whole suite. I could not open a separate, properly-scoped issue+PR for that fix alone: creating an issue on this repo returns 404 for my (non-collaborator) token, and this repo's rules require a linked open issue for every PR with no exception. Since no PR can currently pass CI without this fix, I'm including it here rather than let it silently keep closing unrelated PRs.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR's primary change is focused on selfhost-env-reference generator misses AI review-pipeline env vars #6993; see the Summary above for why the CI-unblocking fix is also included, and why it could not be a separate PR.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves.

Closes #6993

Validation

• git diff --check
• npm run actionlint (no workflow changes in this PR)
• npm run typecheck
• npm run test:coverage (verified rather than assumed: scripts/** and apps/** are both in codecov.yml's ignore list, and test/** itself is also ignored, so none of the four changed files are in Codecov's patch-coverage scope)
• npm run test:workers (not applicable to this change)
• npm run build:mcp (not applicable to this change)
• npm run test:mcp-pack (not applicable to this change)
• npm run ui:openapi:check (not applicable to this change)
• npm run ui:lint (not applicable to this change)
• npm run ui:typecheck (not applicable to this change)
• npm run ui:build (not applicable to this change)
• npm audit --audit-level=moderate (no dependency changes in this PR)
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• No API/UI/dependency surface is touched. Locally: npm run typecheck, npm run docs:drift-check, and npm run selfhost:env-reference:check all pass; npx vitest run test/unit/selfhost-env-reference-script.test.ts test/unit/miner-extension-live-fetch.test.ts test/unit/miner-extension-content.test.ts passes all 44 tests (43 pre-existing + 1 new), confirming both the new source-root scan and the vm-sandbox fix.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A -- no auth/cookie/CORS/session changes in this PR.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A -- no API/OpenAPI/MCP changes in this PR.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A -- no UI changes; the touched apps/loopover-ui file is a generated data reference, not a rendered component.)
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots. (N/A -- this PR has no visual surface: a build-time generator + its output, and a test-infrastructure fix.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• See the Summary above for the full explanation of why an unrelated CI fix is bundled into this PR.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.75%. Comparing base (ead6fdd) to head (41e2372).
⚠️ Report is 9 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7088   +/-   ##
=======================================
  Coverage   93.75%   93.75%           
=======================================
  Files         692      692           
  Lines       68808    68808           
  Branches    18781    18781           
=======================================
  Hits        64511    64511           
  Misses       3302     3302           
  Partials      995      995           

Flag	Coverage Δ
shard-1	43.78% <ø> (+0.44%)	⬆️
shard-2	36.84% <ø> (-0.06%)	⬇️
shard-3	33.14% <ø> (-0.03%)	⬇️
shard-4	34.47% <ø> (+0.08%)	⬆️
shard-5	32.29% <ø> (+0.61%)	⬆️
shard-6	45.76% <ø> (-0.32%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

[loopover-orb]

Caution

🛑 LoopOver review result - reject/close recommended

_{Review updated: 2026-07-17 21:39:15 UTC}

5 files · 1 AI reviewer · 1 blocker · CI green · clean

🛑 Suggested Action - Reject/Close

Review summary
This PR adds three AI review-pipeline source roots to DEFAULT_SOURCE_ROOTS, regenerates the derived selfhost-env-reference.ts (purely additive, matches the new roots), and adds a real regression test that scans the actual repo rather than a fixture. It also bundles two unrelated fixes: a version bump in mcp-package.ts (0.9.0 → 3.1.1, with a matching test-comment update) and a claimed vm-sandbox fix for miner-extension-live-fetch.test.ts that is not shown in this diff at all despite being described as included. The core env-reference change is correct and well-tested; the bundling is the main concern.

Blockers

• The PR description claims to include a fix for test/unit/miner-extension-live-fetch.test.ts (injecting AbortSignal/TextEncoder into the vm sandbox), but no hunk touching that file appears in the diff, so either the description is inaccurate or a load-bearing file is missing from what's shown here — this needs to be reconciled before merge.

Nits — 5 non-blocking

• The MCP_PACKAGE_KNOWN_LATEST_VERSION bump from 0.9.0 to 3.1.1 (apps/loopover-ui/src/lib/mcp-package.ts:12) and its test comment update are unrelated to the stated selfhost-env-reference generator misses AI review-pipeline env vars #6993 fix and should probably be a separate PR or at least justified in the description.
• The regression test in test/unit/selfhost-env-reference-script.test.ts runs against the real repo state, so it will silently stop testing anything meaningful if AI_SUMMARIES_ENABLED/etc. are ever removed from src/services/ai-review.ts — consider noting this coupling in the test comment (partially already done).
• selfhost-env-reference.ts is a generated file now at ~612 lines; not actionable here since it's fully generated, but worth confirming CI's check-mode step catches any future drift.
• Split the mcp-package.ts version bump into its own PR or clearly justify why it rides along with the env-reference fix.
• Clarify in the PR description exactly which diff hunks correspond to the miner-extension-live-fetch fix, since none are visible in the provided diff.

Why this is blocked

• The PR description claims to include a fix for test/unit/miner-extension-live-fetch.test.ts (injecting AbortSignal/TextEncoder into the vm sandbox), but no hunk touching that file appears in the diff, so either the description is inaccurate or a load-bearing file is missing from what's shown here — this needs to be reconciled before merge.

📋 Copy for AI agents — paste into your coding agent

Fix the following blocker(s) from this PR review:

1. The PR description claims to include a fix for test/unit/miner-extension-live-fetch.test.ts \(injecting AbortSignal/TextEncoder into the vm sandbox\), but no hunk touching that file appears in the diff, so either the description is inaccurate or a load-bearing file is missing from what's shown here — this needs to be reconciled before merge.

Decision drivers

• ❌ Code review — 1 blocker (1 reviewer)
• ❌ Gate result — Blocking (Repo-configured hard blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#6993
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 1098 registered-repo PR(s), 663 merged, 135 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	philluiz2323; Gittensor profile; 1098 PR(s), 135 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: moderate

Linked issue satisfaction

Addressed
The PR adds the three specified files to DEFAULT_SOURCE_ROOTS, regenerates selfhost-env-reference.ts to include all four required env vars (AI_SUMMARIES_ENABLED, AI_PUBLIC_COMMENTS_ENABLED, AI_MAX_OUTPUT_TOKENS, AI_BYOK_DAILY_REPO_LIMIT), and adds a regression test asserting the generator finds them.

Review context

• Author: philluiz2323
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, JavaScript, MDX, TypeScript, CSS, Cuda, HTML, Kotlin
• Official Gittensor activity: 1098 PR(s), 135 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/changelog/test	desktop	before /changelog/test	after /changelog/test	—
/changelog/test	mobile	before /changelog/test (mobile)	after /changelog/test (mobile)	—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver is closing this pull request on the maintainer's behalf (AI reviewers agree on a likely critical defect: The PR description claims to include a fix for test/unit/miner-extension-live-fetch.test.ts (injecting AbortSignal/TextEncoder into the vm sandbox), but no hunk touching that file appears in the diff, so either the description is inaccurate or a load-bearing file is missing from what's shown here — this needs to be reconciled before merge.). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.