feat(control-panel): maintainer settings editor (#130)

[JSONbored]

Closes #130.

Closes the biggest frontend gap the discovery sweep flagged (~10% → done): the backend exposed 30+ maintainer settings with no editor (only AI-review + BYOK existed). This adds the editor and the maintainer-facing save endpoint it needed.

Backend

• PUT /v1/repos/:owner/:repo/settings — maintainer-authed (requireRepoMaintainer), audited, PATCH-style. Since upsertRepositorySettings defaults any absent field, the handler loads current settings and merges the sent keys so unrelated groups are preserved. A maintainer-safe partial schema excludes the secret aiReview key (set via the dedicated /ai-review + /ai-key routes) and the operator-only scoring internals (backfillEnabled, privateTrustEnabled).

Frontend (maintainer-settings.tsx, in the maintainer panel)

• Merge gate: gate check, policy pack, merge-readiness master, linked-issue / duplicate / quality / manifest-policy modes + quality min score, first-time-contributor grace.
• Anti-slop: mode, min score, AI advisory.
• Labels: auto-label, label name, create-missing.
• Public output & checks: comment mode, public surface, signal level, audience, context check + detail, maintainer-author inclusion, require-linked-issue, badge.
• Command authorization: default-role editor + read-only per-command overrides.
• Focus manifest (config-as-code): JSON editor against the existing GET/PUT /focus-manifest.

Boundaries

Maintainer-authenticated + repo-scoped; every save is audited. No secret key or operator-only field is editable here. This is the surface the agent-layer autonomy dial (#784) will extend.

Verification

backend typecheck ✓ · UI lint ✓ · UI typecheck ✓ · UI build ✓ · backend suite 1995 passed / 1 skipped (pre-existing pngjs visual-agent skip) · UI suite 7 passed · PUT endpoint + schema fully covered (success / invalid / forbidden / malformed-body / session + non-session audit-actor).

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	db5c5e7	Commit Preview URL Branch Preview URL	Jun 17 2026, 07:50 PM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#837 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[ghost]

gittensory · advisory review

Reviewed 4 changed file(s) — two independent AI reviewers.

Changed files: apps/gittensory-ui/src/components/site/app-panels/maintainer-panel.tsx, apps/gittensory-ui/src/components/site/app-panels/maintainer-settings.tsx, src/api/routes.ts, test/integration/api.test.ts

Suggested action: 🛠️ Request changes. (reviewers split: merge / request changes) Address the suggestions below before merging.

Reviewer A · gpt-oss-120b — recommends ✅ merge
This PR adds a maintainer‑self‑serve settings editor: a new UI panel, a PUT /settings endpoint with a partial schema, and integration tests covering success, malformed input, validation, and permission checks. The implementation follows existing patterns, respects auth, and records audit events.

Suggestions

• Add a unit test for the UI component (e.g., rendering with a mock repo and verifying that the Save button triggers the correct API call) to keep UI coverage high.
• Consider adding explicit ARIA labels or aria-describedby for the input fields to improve accessibility for screen readers.
• Document in the API OpenAPI spec that the PUT /settings endpoint performs a merge‑style update (partial) rather than a full replace.

Worth double-checking

• Ensure that any public text entered via the Focus Manifest editor cannot bypass the public‑sanitizer; the manifest is later rendered publicly and must be filtered.
• Confirm that the audit event correctly captures the actor when the request is made with admin (non‑session) credentials.

Reviewer B · mistral-small-3.1-24b-instruct — recommends 🛠️ request changes
This PR adds a maintainer settings editor to the Gittensory UI, allowing maintainers to configure repository settings such as gate modes, anti-slop, labels, public output, and command authorization. The changes are well-structured and follow the project's conventions.

Suggestions

• Consider adding a test to verify that the settings are correctly applied and persisted.
• Ensure that the FocusManifestEditor component handles JSON parsing errors gracefully and provides clear feedback to the user.
• Add a validation step to ensure that the gittensorLabel field does not exceed the maximum length of 50 characters.
• Ensure that the commandAuthorization field is properly validated to prevent unauthorized command execution.
• Add a test to verify that the FocusManifestEditor component correctly handles large JSON payloads.

Worth double-checking

• Ensure that the settings editor does not expose any sensitive information or allow unauthorized changes.
• Verify that the FocusManifestEditor component correctly handles JSON parsing errors and provides clear feedback to the user.
• Ensure that the commandAuthorization field is properly validated to prevent unauthorized command execution.

Warning

Could not capture a preview of the changed route(s) — review the rendered page manually before merging.

Before = production · After = this PR's preview deploy.

Route	Viewport	Before	After
/	desktop
	mobile

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.56%. Comparing base (bc090a1) to head (db5c5e7).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #837   +/-   ##
=======================================
  Coverage   96.56%   96.56%           
=======================================
  Files          98       98           
  Lines       14175    14189   +14     
  Branches     5169     5172    +3     
=======================================
+ Hits        13688    13702   +14     
  Misses        105      105           
  Partials      382      382           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.