feat(01KW5WMS): Maintainer-feedback GitHub links (both review-time and live-session) file to the Flow plugin's own repo, not the cwd project's repo (#448)

[jackmcintyre]

What changed

Maintainer-feedback GitHub links (both review-time and live-session) file to the Flow plugin's own repo, not the cwd project's repo (#448)

This change delivers the following acceptance criteria:

• AC1: Given Flow running in a project whose gh origin is some other repo, When reviewMaintainerInbox builds the review-time 'open in GitHub' link for a maintainer-feedback item, Then the link targets the Flow plugin's own repo identity, not cwd's gh origin.
• AC2: Given a maintainer-feedback item raised live during a run via recordMaintainerFeedback, When it emits its GitHub issue link, Then that link also targets the Flow plugin's own repo - the live-session path shares the cwd-repo bug and is retargeted too.
• AC3: Given the plugin's own package.json carries a standard npm repository field, When either link path resolves the plugin repo identity at runtime, Then it reads that field; and when the field is absent it fails soft to no-link rather than falling back to cwd's gh origin.
• AC4: Given both maintainer-feedback link paths resolved to the plugin repo identity, When a non-maintainer gh-issue path that correctly wants the cwd project repo runs, Then it is unchanged - only the two maintainer-feedback paths are retargeted.

Why

As an operator, I want every maintainer-feedback GitHub link - both the review-time inbox link and the live-session link raised during a run - to file against the Flow plugin's own repo, not whatever project repo is the cwd, so that maintainer findings - which are Flow bugs by construction - land in the right tracker from any project I run Flow in, without me hand-editing the URL.

How to check it yourself

1. Run vitest on review-maintainer-inbox.test.ts and record-maintainer-feedback.test.ts - 78 new AC tests pass. 2. Run vitest on review-maintainer-feedback.test.ts - 11 AC4 tests confirm non-maintainer paths unchanged. 3. Run the full test suite (3896 tests, all green). 4. Confirm build succeeds with updated dist bundles.

Risk and blast radius

Risk tier: medium

The change is scoped to the files in the diff below. Review the diff to judge its actual blast radius — including any effect on shared state, data schemas, or authentication paths — before approving.

What is explicitly not covered: reviewer verification of this summary's accuracy is handled by a separate companion story.

Evidence

The pre-pull-request build-and-test gate passed before this pull request was opened. No pull request can be opened by the automated flow unless both pnpm build and pnpm test exit 0 in the developer's working directory.

Per-criterion covering checks:

• AC1 → plugins/flow/mcp-server/src/tools/__tests__/review-maintainer-inbox.test.ts (automated test)
• AC2 → plugins/flow/mcp-server/src/tools/__tests__/record-maintainer-feedback.test.ts (automated test)
• AC3 → plugins/flow/mcp-server/src/tools/__tests__/review-maintainer-inbox.test.ts (automated test)
• AC4 → plugins/flow/mcp-server/src/tools/__tests__/review-maintainer-feedback.test.ts (automated test)

Story: native:01KW5WMS33XC463QM60AXDGK81
Spec: .flow/native-stories/01KW5WMS33XC463QM60AXDGK81.md
ACs:

• AC1: Given Flow running in a project whose gh origin is some other repo, When reviewMaintainerInbox builds the review-time 'open in GitHub' link for a maintainer-feedback item, Then the link targets the Flow plugin's own repo identity, not cwd's gh origin.
• AC2: Given a maintainer-feedback item raised live during a run via recordMaintainerFeedback, When it emits its GitHub issue link, Then that link also targets the Flow plugin's own repo - the live-session path shares the cwd-repo bug and is retargeted too.
• AC3: Given the plugin's own package.json carries a standard npm repository field, When either link path resolves the plugin repo identity at runtime, Then it reads that field; and when the field is absent it fails soft to no-link rather than falling back to cwd's gh origin.
• AC4: Given both maintainer-feedback link paths resolved to the plugin repo identity, When a non-maintainer gh-issue path that correctly wants the cwd project repo runs, Then it is unchanged - only the two maintainer-feedback paths are retargeted.

Retarget maintainer-feedback GitHub links to the plugin's own repo via package.json repository field

Closes #448