fix(api): bound local branch scenario inputs

[JSONbored]

Motivation

• The new scenario-summary path built a scenario from local branch metadata that could violate the stricter scenario model limits (branch/ref length and linked issues), causing ZodError to be thrown and propagate as a server error for otherwise schema-accepted API/MCP inputs.

Description

• Export shared scenario input limits in src/scenarios/input-model.ts (SCENARIO_MAX_*) and use them for scenario schemas and validation bounds.
• Trim/slice and otherwise bound local-branch fields before building the scenario in scenarioInputFromLocalBranchMetadata to avoid throwing during buildScenarioInput/normalizeScenarioInput.
• Align REST and MCP local-branch input validation to the scenario bounds by reusing the exported constants in src/api/routes.ts and src/mcp/server.ts for repoFullName, branchName/baseRef/headRef, and linkedIssues limits.
• Add unit coverage that exercises oversized local branch metadata and asserts the metadata is bounded and summarization does not throw, and wire the new constants into the updated tests (test/unit/scenario-input-model.test.ts and test/unit/local-branch.test.ts).

Testing

• Ran npm test -- test/unit/scenario-input-model.test.ts test/unit/local-branch.test.ts and observed all unit tests pass (55 passed).
• Ran npm run typecheck (tsc --noEmit) and the typecheck completed successfully.
• Ran git diff --check to ensure no whitespace/errors in diffs before committing.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	32416d1	Commit Preview URL Branch Preview URL	Jun 13 2026, 05:37 AM

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#614 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 5 changed file(s) — two independent AI reviewers.

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR introduces centralized max‑length constants for scenario inputs, updates validation schemas and the scenario builder to enforce these limits, adds helper trimming functions, and expands unit tests to cover oversized inputs. The changes are coherent and improve input safety.

Suggestions

• Align the login field max length in src/api/routes.ts with the server shape (use SCENARIO_MAX_BRANCH_REF_CHARS for consistency).
• Consider adding tests for the new trimming helpers (trimScenarioText, optionalScenarioText) to ensure edge‑case handling.

Worth double-checking

• If MAX_LOCAL_BRANCH_REF_CHARS differs from the new scenario constant, inconsistent validation may reject legitimate requests.
• Increasing max lengths could allow larger payloads; monitor for any performance impact.

Reviewer B · mistral-small-3.1-24b-instruct — recommends ✅ merge
This PR adds input validation and bounds for local branch scenario inputs, ensuring that strings and arrays do not exceed specified limits. The changes are well-documented and include corresponding tests.

Suggestions

• Consider adding a comment explaining the purpose of the new constants in input-model.ts for better maintainability.
• Ensure that the new tests cover edge cases where inputs are exactly at the boundary values.

Worth double-checking

• Verify that the new bounds do not inadvertently truncate valid inputs in a way that affects functionality.
• Check that the changes do not introduce any performance regressions, especially in scenarios with large inputs.

[JSONbored]

@JSONbored the source looks fine from this pass, but the PR title needs to be fixed before merge.

A few notes:

• Non-Gittensory checks are green.
• The Gittensory Gate failure is advisory/testing-phase and is not the blocker here.
• The current title is Fix: bound local branch scenario inputs, which does not match the repo's required type(scope): summary format.

Required changes:

• Retitle the PR to fix(local-branch): bound scenario inputs or another compliant lowercase fix(<scope>): ... title.

Validation expected:

• No code validation rerun needed for a title-only fix unless the branch changes.