api: remove the orphaned browser-extension backend surface from src/#8604
Merged
Conversation
Closes #8597, first of the browser-extension removal epic's three sequenced sub-issues (#8596). Lands before the package itself is deleted (next sub-issue) so the "Download extension" button and its download page disappear before the zip they point at stops being generated -- never the other way around, which would leave a live broken download link on the public site. Removes the dedicated /extension route and its test, both nav links (site footer, command palette), the sitemap entry, and the README table row. Reworded roadmap.tsx's Phase 2 entry to drop the browser- extension framing while keeping its real remaining scope (maintainer trust checklist, install health, private/public rendering checks) -- swapped its "Open extension page" link for /app/maintainer, a route that already covers install health and maintainer controls, rather than just deleting the link outright. maintainer-install-trust.mdx needed more than the single section the original file-level grep found: removed the "## Browser extension states" section (heading through its code block and the screenshot- requirement sentence immediately after it), the "Extension sessions are scoped..." audit-expectations bullet, and the "Browser extension" cross-link in the closing paragraph -- also reworded the "Reject UI or extension PRs" bullet to just "Reject UI PRs" since that rule was never extension-specific. self-hosting-operations.mdx's "extension block" mention is a false positive (Docker Compose's `x-` extension fields, unrelated) -- left unchanged after verifying context, per the issue's own explicit instruction not to assume. routeTree.gen.ts regenerated via a real `npm --workspace @loopover/ui run build`, not hand-edited. Validated: typecheck clean, ui:lint 0 errors, ui:test 86 files/571 tests passing, docs:drift-check clean.
…CI/npm-script wiring Closes #8598. Second of three sequenced sub-issues under the browser- extension removal epic (#8596) -- lands after the UI download surface is gone (#8597) and before the backend API routes (#8599, next). Deletes apps/loopover-extension/ and apps/loopover-miner-extension/ wholesale, scripts/build-extension.ts, scripts/build-miner-extension.ts, and scripts/extension-zip-core.ts (verified only those two build scripts + the now-deleted test referenced it). Deletes 10 root-level tests that read the app directories' raw source directly -- 9 named in the issue's own audit, plus test/unit/miner-toolbar-badge.test.ts, which the original audit missed and would have ENOENT'd immediately. Trims (does not delete) codecov-policy.test.ts's shared coverage-gate test down to miner-ui only. Removes all shared build/CI wiring in one PR, as required (turbo.json's 5 task blocks + the ui#build dependsOn edge + //#typecheck's inputs; ci.yml's path filters, the 3 dedicated steps, and every stale comment mention; ui-deploy.yml's Validate-frontend chain; root package.json's 6 scripts + the ui:build/ui:test chains; .gitignore's dead zip entry). Beyond the issue's own file-level-grep audit, a full repo-wide sweep turned up more real references that would have silently broken or gone stale: two production smoke-test scripts (smoke-production.ts, smoke-ui-browser.ts) still probing the now-gone /extension route and zip download -- these would have started failing in production the moment #8597 merged; scripts/mcp-release-core.ts and scripts/orb-release-core.ts's UI/excluded-path arrays still listing the deleted directories; and several comments across packages/loopover-miner/lib/ and apps/loopover-miner-ui/ describing the extension as a consumer of the ranked-candidates API and discover snapshot -- reworded to describe their real remaining consumer (miner-ui's own dashboard) instead of leaving them referencing a deleted package. Left alone, correctly out of scope: src/openapi/ spec.ts and src/signals/extension-contributor-context.ts (src/**, #8599's territory), packages/loopover-mcp/CHANGELOG.md (immutable history), and every genuine "file extension"/"OAuth scope extension" false positive a broad grep surfaced. package-lock.json regenerated via real npm install/ci, not hand- edited, with one narrow exception: two "extraneous": true workspace stub entries that persisted across five different npm-tool-driven attempts (repeated install, prune, full clean reinstall) even after confirming via `npm ci` that they carry zero real dependency resolution and have zero effect on install correctness -- traced to gitignored build leftovers (dist/, coverage/, node_modules/, .turbo/) that `git rm` doesn't touch, which kept the directories technically present for npm's workspace glob after the tracked files were gone. Removed those leftover directories too, alongside the two dead JSON stubs npm's own tooling had already flagged as not real. Validated: npm ci clean, npx turbo run build --filter=@loopover/ui succeeds with exactly 2 tasks (engine + ui, no extension task in the graph), package-lock.json has zero remaining extension references, node_modules has zero @loopover/{extension,miner-extension} entries. Full npm run test:ci left to GitHub Actions rather than a local run.
…openapi.test.ts The prior commit on this branch simplified ui-deploy.yml's "Validate frontend" run command after deleting the extension packages, but left this test's hardcoded expected string pointing at the old extension/miner-extension lint/typecheck/build chain, failing validate-tests in CI.
Deletes the 5 route handlers under /v1/auth/extension/session, /v1/extension/pull-context, and /v1/extension/contributors/:login/* now that both client packages are gone, plus their supporting middleware scope checks, OpenAPI registrations, and the SESSION_AUTHENTICATED_AUTH_PATHS rate-limit carve-out. src/signals/extension-contributor-context.ts is not a clean delete: its buildExtensionPrStatus/ExtensionPrStatus band-builder is a live dependency of settings-preview.ts's buildSampleCheckRunReadiness (the Context-check details page, #2216), unrelated to the browser extension. That still-used half is extracted into src/signals/contributor-readiness-band.ts with extension-branded names dropped (buildContributorPrStatus, ContributorPrStatus, redactContributorText); the dead half (buildExtensionIssueFit/IssueBadges) is deleted along with it. Test coverage for the surviving band logic moves to test/unit/contributor-readiness-band.test.ts. Historical-data classifiers are intentionally left untouched: productUsageRouteClass, PRODUCT_USAGE_SURFACES/ProductUsageSurface, and productUsageBaseRolesForEvent all still need to correctly classify already-recorded audit/product-usage rows with a browser_extension surface or an extension_session_created/pull_context_viewed event name -- removing those would silently misclassify real historical data. Same reasoning for src/mcp/server.ts's extension-scope session guard: it stays as a defense-in- depth check against any pre-existing extension-scoped session token that hasn't yet expired. Also fixes test/integration/api.test.ts, test/unit/auth.test.ts, and test/unit/openapi.test.ts, which all still exercised or asserted the deleted routes, and regenerates apps/loopover-ui/public/openapi.json. Closes #8599
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
loopover-ui | 90f64db | Commit Preview URL Branch Preview URL |
Jul 25 2026, 04:59 AM |
![superagent-security[bot]](https://avatars.githubusercontent.com/in/3287076?s=60&v=4){kind=small}
superagent-security
Bot
added
the
pr:flagged
loopover-orb
Bot
added
the
gittensor:bug
Contributor
|
Caution 🛑 LoopOver review result - fixes requiredReview updated: 2026-07-25 05:05:30 UTC
Review summary Nits — 6 non-blocking
CI checks failing
Decision drivers
Context & advisory signals — never blocks the verdict
Linked issue satisfactionAddressed Review context
Contributor next steps
Signal definitions
🧪 Chat with LoopOverAsk LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.
Full command reference: https://loopover.ai/docs/loopover-commands 🧪 Experimental — new and may change. Visual preview
Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy. Scroll preview
A short scroll-through clip (desktop) — click either thumbnail to open the full animation. Evidence for scroll-linked behavior a single screenshot can't show. 🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed 💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →. Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.
|
… classifiers The extension was never actually used, so there's no real historical data to preserve fidelity for -- drop the browser_extension member from ProductUsageSurface entirely, along with productUsageRouteClass's /v1/extension/ branch, PRODUCT_USAGE_SURFACES, PRODUCT_USAGE_USEFUL_ACTION_EVENTS' pull_context_viewed entry, and productUsageBaseRolesForEvent's extension_session_created/pull_context_viewed special case. Also removes src/mcp/server.ts's extension-scope session guard in authenticateMcpRequest -- extension-scoped sessions can never be minted again, and a non-privileged actor still falls through to the ordinary role-summary check below it. Updates test/unit/product-usage.test.ts's route-class/activation fixtures to match, and fixes a trailing blank line at EOF in routes.ts that failed CI's whitespace check.
Owner
Author
|
Follow-up commit: the extension was never actually used in production, so there's no historical data whose classification needs preserving. Removed the remaining pieces I'd initially left in place for that reason:
Also fixed a trailing blank line at EOF in |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8604 +/- ##
==========================================
- Coverage 92.54% 92.54% -0.01%
==========================================
Files 796 796
Lines 79855 79671 -184
Branches 24136 24064 -72
==========================================
- Hits 73905 73730 -175
+ Misses 4804 4803 -1
+ Partials 1146 1138 -8
Flags with carried forward coverage won't be shown. Click here to find out more.
|
Bundle ReportChanges will decrease total bundle size by 29.96kB (-0.4%) ⬇️. This is within the configured threshold ✅ Detailed changes
Affected Assets, Files, and Routes:view changes for bundle: loopover-uiAssets Changed:
|
superagent-security
Bot
removed
the
pr:flagged
This was referenced Jul 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Third and final sub-issue of epic #8596 (browser-extension package cleanup), blocked on #8598's PR (#8603) landing first.
POST /v1/auth/extension/session,GET /v1/extension/pull-context,GET /v1/extension/contributors/:login/{issue-fit,issue-badges,pr-status}) and their supporting middleware scope checks,SESSION_AUTHENTICATED_AUTH_PATHSrate-limit carve-out, and OpenAPI registrations, now that no client references them.src/signals/extension-contributor-context.tswas not a clean delete: its audit was stale.buildExtensionPrStatus/ExtensionPrStatusis a live dependency ofsettings-preview.ts'sbuildSampleCheckRunReadiness(the Context-check details page, feat(ui): check-run details-page readiness table (visual) #2216) — unrelated to the browser extension. That still-used half is extracted intosrc/signals/contributor-readiness-band.tswith the extension branding dropped (buildContributorPrStatus,ContributorPrStatus,redactContributorText); the genuinely dead half (buildExtensionIssueFit/buildExtensionIssueBadges) is deleted with it. Test coverage for the surviving band logic moves totest/unit/contributor-readiness-band.test.ts.productUsageRouteClass,PRODUCT_USAGE_SURFACES/ProductUsageSurface, andproductUsageBaseRolesForEventall still need to correctly classify already-recorded audit/product-usage rows carrying abrowser_extensionsurface or anextension_session_created/pull_context_viewedevent name — removing those would silently misclassify real historical data on every future rollup. Same reasoning forsrc/mcp/server.ts's extension-scope session guard, kept as defense-in-depth against any pre-existing (not-yet-expired) extension-scoped session token.test/integration/api.test.ts,test/unit/auth.test.ts, andtest/unit/openapi.test.tsall still exercised or asserted the deleted routes (also missed by the issue's original audit) — updated/trimmed accordingly.apps/loopover-ui/public/openapi.json.Closes #8599
Test plan
npm run typecheck— cleancontributor-readiness-band,openapi,auth,agent-orchestrator,ci-ui-build-openapi,product-usage,codecov-policy,settings-preview,maintainer-settings-preview-ui,routes-cors,routes-boundary-tests,access-boundary,auth-github-token,auth-security-helpers— all passingtest/integration/api.test.ts(49 tests) — passingnpm run ui:openapi:check— no driftnpm run ui:openapi:settings-parity— passing