@ddtcorex/dsh-maestro-config 0.1.0 → 0.1.2

package/lib/client.js

@@ -2117,7 +2117,8 @@ var require_browser = __commonJS({
 // src/client/index.tsx
 var index_exports = {};
 __export(index_exports, {
-  apply: () => apply
+  apply: () => apply,
+  inject: () => inject
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -2221,6 +2222,29 @@ var codeStyle = {
   color: "var(--dsw-alias-label-primary)",
   wordBreak: "break-all"
 };
+var textareaStyle = {
+  ...inputStyle,
+  height: 120,
+  padding: "8px 12px",
+  resize: "vertical"
+};
+var tabBarStyle = {
+  display: "flex",
+  gap: 8,
+  borderBottom: "1px solid var(--dsw-alias-border-l2)",
+  marginBottom: 16
+};
+var tabButtonStyle = (active) => ({
+  padding: "8px 14px",
+  border: "none",
+  borderBottom: active ? "2px solid var(--dsw-alias-button-primary-fill)" : "2px solid transparent",
+  background: "transparent",
+  color: active ? "var(--dsw-alias-label-primary)" : "var(--dsw-alias-label-secondary)",
+  font: "inherit",
+  fontSize: 13,
+  fontWeight: active ? 600 : 400,
+  cursor: "pointer"
+});
 function QrImage({ url, size = 104 }) {
   const [dataUrl, setDataUrl] = (0, import_react.useState)(null);
   (0, import_react.useEffect)(() => {
@@ -2299,6 +2323,29 @@ function ReviewModelSelector({ value, catalog, fallbackValue, fallbackLabel, onC
       document.removeEventListener("keydown", onKey);
     };
   }, [open]);
+  const getModelId = (m) => typeof m === "string" ? m : m.id;
+  const getModelName = (m) => typeof m === "string" ? m : m.name ?? m.id;
+  const selectedModelInfo = (() => {
+    if (!selectedProvider || !value?.model) return null;
+    const raw = (providerGroup?.models ?? []).find((mm) => getModelId(mm) === value.model);
+    if (raw === void 0) return null;
+    if (typeof raw === "string") return { id: raw, supportsReasoning: false, reasoningEfforts: [] };
+    return raw;
+  })();
+  const supportsReasoning = (() => {
+    if (!selectedModelInfo) return false;
+    if (typeof selectedModelInfo.supportsReasoning === "boolean") return selectedModelInfo.supportsReasoning;
+    const efforts = selectedModelInfo.reasoningEfforts ?? selectedModelInfo.reasoning?.efforts?.map((e) => e.id) ?? [];
+    return efforts.filter((e) => e !== "off").length > 0;
+  })();
+  const availableEfforts = (() => {
+    if (!supportsReasoning) return [];
+    const efforts = selectedModelInfo?.reasoningEfforts ?? selectedModelInfo?.reasoning?.efforts?.map((e) => e.id) ?? [];
+    const filtered = efforts.filter((e) => e !== "off" && e !== "");
+    if (filtered.length > 0) return filtered;
+    return ["low", "medium", "high"];
+  })();
+  const warning = selectedEffort !== "" && !supportsReasoning && selectedModelInfo !== null ? `\u26A0\uFE0F This model does not support reasoning effort "${selectedEffort}" \u2014 reviews will fail. Clear effort or choose a reasoning-capable model.` : null;
   const update = (field, newVal) => {
     if (newVal === "" && field === "provider") {
       onChange(null);
@@ -2309,8 +2356,9 @@ function ReviewModelSelector({ value, catalog, fallbackValue, fallbackLabel, onC
     const next = { provider: value?.provider ?? "", model: value?.model ?? "", ...value?.reasoningEffort ? { reasoningEffort: value.reasoningEffort } : {} };
     if (field === "provider") {
       const g = groups.find((x) => x.provider === newVal);
+      const first = g?.models[0];
       next.provider = newVal;
-      next.model = g?.models[0] ?? "";
+      next.model = first !== void 0 ? getModelId(first) : "";
     } else if (field === "model") {
       next.model = newVal;
     } else if (field === "reasoningEffort") {
@@ -2418,7 +2466,8 @@ function ReviewModelSelector({ value, catalog, fallbackValue, fallbackLabel, onC
           (0, import_react.createElement)("span", { style: { display: "flex", alignItems: "center", gap: 8, color: "var(--dsw-alias-label-secondary)" } }, effortLabel, chevronRight)
         ),
         value && (0, import_react.createElement)("p", { style: { ...captionStyle, margin: "8px 4px 2px" } }, `Selected: ${value.provider} / ${value.model}${value.reasoningEffort ? ` (${value.reasoningEffort})` : ""}`),
-        !value && effectiveFallback && (0, import_react.createElement)("p", { style: { ...captionStyle, margin: "8px 4px 2px" } }, `${effectiveFallbackLabel === "Use Global" ? "Using Global" : "Using DSH default"}: ${effectiveFallback.provider} / ${effectiveFallback.model}${effectiveFallback.reasoningEffort ? ` (${effectiveFallback.reasoningEffort})` : ""}`)
+        !value && effectiveFallback && (0, import_react.createElement)("p", { style: { ...captionStyle, margin: "8px 4px 2px" } }, `${effectiveFallbackLabel === "Use Global" ? "Using Global" : "Using DSH default"}: ${effectiveFallback.provider} / ${effectiveFallback.model}${effectiveFallback.reasoningEffort ? ` (${effectiveFallback.reasoningEffort})` : ""}`),
+        warning && (0, import_react.createElement)("p", { style: { ...captionStyle, margin: "4px 4px 2px", color: "var(--dsw-alias-state-error-primary)" } }, warning)
       ),
       pane === "model" && (0, import_react.createElement)(
         "div",
@@ -2437,15 +2486,20 @@ function ReviewModelSelector({ value, catalog, fallbackValue, fallbackLabel, onC
               ms.length === 0 ? (0, import_react.createElement)("p", { style: { ...captionStyle, padding: "2px 10px 2px 28px" } }, "No models") : (0, import_react.createElement)(
                 "div",
                 { style: { marginLeft: 12, borderLeft: "1px solid var(--dsw-alias-border-l2)", paddingLeft: 6, display: "flex", flexDirection: "column", gap: 2 } },
-                ms.map((m) => (0, import_react.createElement)("button", { key: m, type: "button", style: { ...rowStyle, paddingLeft: 10, background: value?.provider === p && value?.model === m ? "var(--dsw-alias-bg-layer-2)" : "transparent" }, onClick: () => {
-                  update("model", m);
-                  if (value?.provider !== p) update("provider", p);
-                  else {
-                    const next = { provider: p, model: m, ...selectedEffort ? { reasoningEffort: selectedEffort } : {} };
-                    onChange(next);
-                    setPane("root");
-                  }
-                } }, (0, import_react.createElement)("span", { style: { overflow: "hidden", textOverflow: "ellipsis" } }, m), check(value?.provider === p && value?.model === m)))
+                ms.map((m) => {
+                  const mid = getModelId(m);
+                  const mname = getModelName(m);
+                  const active = value?.provider === p && value?.model === mid;
+                  return (0, import_react.createElement)("button", { key: mid, type: "button", style: { ...rowStyle, paddingLeft: 10, background: active ? "var(--dsw-alias-bg-layer-2)" : "transparent" }, onClick: () => {
+                    update("model", mid);
+                    if (value?.provider !== p) update("provider", p);
+                    else {
+                      const next = { provider: p, model: mid, ...selectedEffort ? { reasoningEffort: selectedEffort } : {} };
+                      onChange(next);
+                      setPane("root");
+                    }
+                  } }, (0, import_react.createElement)("span", { style: { overflow: "hidden", textOverflow: "ellipsis" } }, mname), check(active));
+                })
               )
             );
           })
@@ -2455,18 +2509,31 @@ function ReviewModelSelector({ value, catalog, fallbackValue, fallbackLabel, onC
         "div",
         null,
         (0, import_react.createElement)("button", { type: "button", style: { ...rowStyle, color: "var(--dsw-alias-label-secondary)" }, onClick: () => setPane("root") }, (0, import_react.createElement)("span", null, "\u2190 Back"), (0, import_react.createElement)("span", { style: { fontSize: 12 } }, "Effort")),
-        (0, import_react.createElement)(
+        selectedModelInfo === null ? (0, import_react.createElement)("p", { style: { ...captionStyle, margin: "8px 4px 2px" } }, "Select a model first to configure effort.") : !supportsReasoning ? (0, import_react.createElement)(
+          "div",
+          null,
+          (0, import_react.createElement)("p", { style: { ...captionStyle, margin: "8px 4px 6px" } }, "This model does not support reasoning effort \u2014 using provider default"),
+          (0, import_react.createElement)(
+            "div",
+            { style: { marginTop: 4 } },
+            [{ id: "", label: "Default effort" }].map((e) => (0, import_react.createElement)("button", { key: e.id || "default", type: "button", style: { ...rowStyle, background: selectedEffort === e.id ? "var(--dsw-alias-bg-layer-2)" : "transparent" }, onClick: () => {
+              update("reasoningEffort", e.id);
+              setPane("root");
+            } }, (0, import_react.createElement)("span", null, e.label), check(selectedEffort === e.id)))
+          ),
+          warning && (0, import_react.createElement)("p", { style: { ...captionStyle, margin: "8px 4px 2px", color: "var(--dsw-alias-state-error-primary)" } }, warning)
+        ) : (0, import_react.createElement)(
           "div",
-          { style: { marginTop: 4 } },
-          [
-            { id: "", label: "Default effort" },
-            { id: "low", label: "low" },
-            { id: "medium", label: "medium" },
-            { id: "high", label: "high" }
-          ].map((e) => (0, import_react.createElement)("button", { key: e.id || "default", type: "button", style: { ...rowStyle, background: selectedEffort === e.id ? "var(--dsw-alias-bg-layer-2)" : "transparent" }, onClick: () => {
-            update("reasoningEffort", e.id);
-            setPane("root");
-          } }, (0, import_react.createElement)("span", null, e.label), check(selectedEffort === e.id)))
+          null,
+          (0, import_react.createElement)(
+            "div",
+            { style: { marginTop: 4 } },
+            [{ id: "", label: "Default effort" }, ...availableEfforts.map((id) => ({ id, label: id }))].map((e) => (0, import_react.createElement)("button", { key: e.id || "default", type: "button", style: { ...rowStyle, background: selectedEffort === e.id ? "var(--dsw-alias-bg-layer-2)" : "transparent" }, onClick: () => {
+              update("reasoningEffort", e.id);
+              setPane("root");
+            } }, (0, import_react.createElement)("span", null, e.label), check(selectedEffort === e.id)))
+          ),
+          warning && (0, import_react.createElement)("p", { style: { ...captionStyle, margin: "8px 4px 2px", color: "var(--dsw-alias-state-error-primary)" } }, warning)
         )
       )
     )
@@ -2553,31 +2620,6 @@ function ToggleField({ label, caption, checked, onChange }) {
     )
   );
 }
-function ReviewHistoryPanel({ rpcCall }) {
-  const [entries, setEntries] = (0, import_react.useState)(null);
-  (0, import_react.useEffect)(() => {
-    rpcCall(MAESTRO_ENDPOINTS.reviewsList, {}).then((res) => {
-      if (res?.ok) setEntries(res.value ?? []);
-    }).catch(() => setEntries([]));
-  }, []);
-  if (entries === null) return (0, import_react.createElement)("p", { style: captionStyle }, "Loading review history\u2026");
-  if (entries.length === 0) return (0, import_react.createElement)("p", { style: captionStyle }, "No reviews recorded yet.");
-  const icon = (entry) => entry.status === "completed" ? "\u2705" : entry.status === "failed" ? "\u26A0\uFE0F" : "\u{1F440}";
-  return (0, import_react.createElement)(
-    "ul",
-    { style: { listStyle: "none", margin: 0, padding: 0 } },
-    entries.map((entry) => (0, import_react.createElement)(
-      "li",
-      { key: entry.id, style: { padding: "6px 0", borderBottom: "1px solid var(--dsw-alias-separator-default, #333)", fontSize: 13 } },
-      (0, import_react.createElement)("span", null, `${icon(entry)} ${entry.projectPath} !${entry.mrIid} \xB7 ${entry.mode}${entry.trigger !== "mention" ? ` \xB7 ${entry.trigger}` : ""}`),
-      (0, import_react.createElement)(
-        "div",
-        { style: captionStyle },
-        `${new Date(entry.startedAt).toLocaleString()}${entry.summary ? ` \u2014 ${entry.summary}` : ""}${entry.error ? ` \u2014 ${entry.error}` : ""}`
-      )
-    ))
-  );
-}
 function LanAccess({ proxyStatus, lanPin }) {
   const urls = proxyStatus?.lanUrls ?? [];
   const [selected, setSelected] = (0, import_react.useState)(0);
@@ -2674,7 +2716,7 @@ function PublicAccess({ status, pin, showPin, onRevealPin, onHidePin, onRotatePi
     (0, import_react.createElement)("p", { style: captionStyle }, "Stays the same across tunnel and DSH restarts; use Rotate when you need a new PIN.")
   );
 }
-function MaestroSettingsTab({ rpcCall }) {
+function MaestroSettingsTab({ rpcCall, configRpcCall }) {
   const [status, setStatus] = (0, import_react.useState)(null);
   const [proxyStatus, setProxyStatus] = (0, import_react.useState)(null);
   const [config, setConfig] = (0, import_react.useState)({ tunnelMode: "quick", projectMappings: [] });
@@ -2686,11 +2728,95 @@ function MaestroSettingsTab({ rpcCall }) {
   const [lanPinEnabled, setLanPinEnabled] = (0, import_react.useState)(false);
   const [lanPin, setLanPin] = (0, import_react.useState)(null);
   const [showLanPin, setShowLanPin] = (0, import_react.useState)(false);
+  const [activeTab, setActiveTab] = (0, import_react.useState)("guard");
+  const [guard, setGuard] = (0, import_react.useState)({});
+  const [patternsText, setPatternsText] = (0, import_react.useState)("");
+  const [placeholdersText, setPlaceholdersText] = (0, import_react.useState)("");
+  const [supervisorCfg, setSupervisorCfg] = (0, import_react.useState)({});
+  const [notifierCfg, setNotifierCfg] = (0, import_react.useState)({});
   const call = async (endpoint, payload) => {
     const res = await rpcCall(endpoint, payload);
     if (!res?.ok) throw new Error(res?.error?.message ?? "RPC failed");
     return res.value;
   };
+  const unwrap = (res) => {
+    if (res && typeof res === "object" && "ok" in res) {
+      if (res.ok) return res.value;
+      throw new Error(res.error?.message ?? "RPC failed");
+    }
+    return res;
+  };
+  const cfgGet = async (domain) => {
+    if (!configRpcCall) throw new Error("config RPC not available");
+    const res = await configRpcCall("get", { domain });
+    return unwrap(res);
+  };
+  const cfgSet = async (domain, patch) => {
+    if (!configRpcCall) throw new Error("config RPC not available");
+    const res = await configRpcCall("set", { domain, patch });
+    return unwrap(res);
+  };
+  const saveGuard = async (patch) => {
+    setError(null);
+    const next = { ...guard, ...patch };
+    if (patch.gitProtection && guard.gitProtection) next.gitProtection = { ...guard.gitProtection, ...patch.gitProtection };
+    setGuard(next);
+    try {
+      await cfgSet("guard", patch);
+    } catch (e) {
+      setError(e.message ?? String(e));
+    }
+  };
+  const commitBlacklistPatterns = async (text) => {
+    const patterns = text.split("\n").map((s) => s.trim()).filter(Boolean);
+    setError(null);
+    try {
+      await cfgSet("guardBlacklist", { patterns });
+    } catch (e) {
+      setError(e.message ?? String(e));
+    }
+  };
+  const commitPlaceholders = async () => {
+    setError(null);
+    let obj = {};
+    try {
+      obj = placeholdersText.trim() ? JSON.parse(placeholdersText) : {};
+      if (typeof obj !== "object" || obj === null || Array.isArray(obj)) throw new Error("placeholders must be JSON object");
+    } catch (e) {
+      setError(`placeholders JSON invalid: ${e.message ?? String(e)}`);
+      return;
+    }
+    try {
+      await cfgSet("guardBlacklist", { placeholders: obj });
+    } catch (e) {
+      setError(e.message ?? String(e));
+    }
+  };
+  const saveSupervisorCfg = async (patch) => {
+    setError(null);
+    setSupervisorCfg((prev) => ({ ...prev, ...patch }));
+    try {
+      await cfgSet("supervisor", patch);
+    } catch (e) {
+      setError(e.message ?? String(e));
+    }
+  };
+  const saveNotifierCfg = async (patch) => {
+    setError(null);
+    setNotifierCfg((prev) => {
+      const next = { ...prev };
+      for (const [k, v] of Object.entries(patch)) {
+        if (k === "telegram" && typeof v === "object" && v !== null) next.telegram = { ...prev.telegram ?? {}, ...v };
+        else next[k] = v;
+      }
+      return next;
+    });
+    try {
+      await cfgSet("notifier", patch);
+    } catch (e) {
+      setError(e.message ?? String(e));
+    }
+  };
   const refresh = async () => {
     try {
       setStatus(await call(MAESTRO_ENDPOINTS.status, {}));
@@ -2704,6 +2830,29 @@ function MaestroSettingsTab({ rpcCall }) {
   (0, import_react.useEffect)(() => {
     call(MAESTRO_ENDPOINTS.getConfig, {}).then((saved) => setConfig((prev) => ({ ...prev, ...saved }))).catch(() => {
     });
+    if (configRpcCall) {
+      configRpcCall("get", { domain: "supervisor" }).then((res) => {
+        if (res?.ok && res.value?.model) {
+          setConfig((prev) => ({ ...prev, supervisorModel: res.value.model }));
+        }
+      }).catch(() => {
+      });
+      Promise.all([
+        cfgGet("guard").catch(() => ({})),
+        cfgGet("guardBlacklist").catch(() => ({ patterns: [], placeholders: {} })),
+        cfgGet("supervisor").catch(() => ({})),
+        cfgGet("notifier").catch(() => ({}))
+      ]).then(([g, bl, sup, not]) => {
+        setGuard(g ?? {});
+        const pats = Array.isArray(bl?.patterns) ? bl.patterns : [];
+        const ph = bl?.placeholders && typeof bl.placeholders === "object" ? bl.placeholders : {};
+        setPatternsText(pats.join("\n"));
+        setPlaceholdersText(JSON.stringify(ph, null, 2));
+        setSupervisorCfg(sup ?? {});
+        setNotifierCfg(not ?? {});
+      }).catch(() => {
+      });
+    }
     call(MAESTRO_ENDPOINTS.lanPinStatus, {}).then((value) => {
       setLanPinEnabled(value.enabled);
       if (value.enabled) setLanPin(value.pin ?? null);
@@ -2801,6 +2950,13 @@ function MaestroSettingsTab({ rpcCall }) {
   const saveField = async (field, value) => {
     setError(null);
     setConfig((prev) => ({ ...prev, [field]: value }));
+    if (field === "supervisorModel" && configRpcCall) {
+      try {
+        const res = await configRpcCall("set", { domain: "supervisor", patch: { model: value } });
+        if (res?.ok) return;
+      } catch (e) {
+      }
+    }
     try {
       await call(MAESTRO_ENDPOINTS.saveConfig, { [field]: value });
     } catch (err) {
@@ -2913,8 +3069,7 @@ function MaestroSettingsTab({ rpcCall }) {
         caption: "After a completed review, further pushes to the same MR trigger an automatic quick re-review.",
         checked: config.autoRereviewOnPush,
         onChange: (checked) => saveField("autoRereviewOnPush", checked)
-      }),
-      (0, import_react.createElement)(ReviewHistoryPanel, { rpcCall })
+      })
     ),
     (0, import_react.createElement)(
       "div",
@@ -2930,12 +3085,169 @@ function MaestroSettingsTab({ rpcCall }) {
         label: "Global review model"
       })
     ),
+    (0, import_react.createElement)(
+      "div",
+      { style: sectionStyle },
+      (0, import_react.createElement)("h4", { style: headingStyle }, "Supervisor LLM"),
+      (0, import_react.createElement)("p", { style: captionStyle }, "Model used by the supervisor debug-agent to auto-fix DSH Web crashes. Empty = DSH default (or Review model if set). Uses the same provider catalog as Review."),
+      (0, import_react.createElement)(ReviewModelSelector, {
+        value: config.supervisorModel ?? null,
+        catalog,
+        fallbackValue: catalog?.current ?? null,
+        fallbackLabel: "Use DSH default",
+        onChange: (v) => saveField("supervisorModel", v),
+        label: "Supervisor model"
+      })
+    ),
     (0, import_react.createElement)(
       "div",
       { style: sectionStyle },
       (0, import_react.createElement)("h4", { style: headingStyle }, "Projects"),
       (0, import_react.createElement)(ProjectMappingsEditor, { mappings: config.projectMappings ?? [], onChange: (mappings) => saveField("projectMappings", mappings), catalog, globalReviewModel: config.reviewModel ?? null })
     ),
+    // Task 3: Guard/Blacklist/Supervisor/Notifier tabs — data-driven over guard domains
+    (0, import_react.createElement)(
+      "div",
+      { style: sectionStyle },
+      (0, import_react.createElement)("h4", { style: headingStyle }, "Guard / Blacklist / Supervisor / Notifier"),
+      (0, import_react.createElement)(
+        "div",
+        { style: tabBarStyle },
+        (0, import_react.createElement)("button", { type: "button", style: tabButtonStyle(activeTab === "guard"), onClick: () => setActiveTab("guard") }, "Guard"),
+        (0, import_react.createElement)("button", { type: "button", style: tabButtonStyle(activeTab === "blacklist"), onClick: () => setActiveTab("blacklist") }, "Blacklist"),
+        (0, import_react.createElement)("button", { type: "button", style: tabButtonStyle(activeTab === "supervisor"), onClick: () => setActiveTab("supervisor") }, "Supervisor"),
+        (0, import_react.createElement)("button", { type: "button", style: tabButtonStyle(activeTab === "notifier"), onClick: () => setActiveTab("notifier") }, "Notifier")
+      ),
+      activeTab === "guard" && (0, import_react.createElement)(
+        "div",
+        { "data-tab": "guard" },
+        (0, import_react.createElement)("p", { style: captionStyle }, "Enforce publish block, git protection and cwd containment."),
+        (0, import_react.createElement)(ToggleField, {
+          label: "publishBlocked",
+          caption: "Block publish-related commands when enabled.",
+          checked: guard.publishBlocked === true,
+          onChange: (v) => saveGuard({ publishBlocked: v })
+        }),
+        (0, import_react.createElement)(ToggleField, {
+          label: "gitProtection.enabled",
+          caption: "Protect pushes to protected branches.",
+          checked: guard.gitProtection?.enabled === true,
+          onChange: (v) => saveGuard({ gitProtection: { enabled: v, branches: guard.gitProtection?.branches ?? ["master", "main"] } })
+        }),
+        (0, import_react.createElement)("label", { style: fieldLabelStyle }, "gitProtection.branches (comma separated)"),
+        (0, import_react.createElement)("input", {
+          style: inputStyle,
+          value: (guard.gitProtection?.branches ?? ["master", "main"]).join(", "),
+          placeholder: "master, main",
+          onChange: (e) => {
+            const branches = e.target.value.split(",").map((s) => s.trim()).filter(Boolean);
+            saveGuard({ gitProtection: { enabled: guard.gitProtection?.enabled ?? true, branches } });
+          }
+        }),
+        (0, import_react.createElement)(ToggleField, {
+          label: "cwdContainment",
+          caption: "Contain file operations to the session cwd.",
+          checked: guard.cwdContainment === true,
+          onChange: (v) => saveGuard({ cwdContainment: v })
+        }),
+        (0, import_react.createElement)("label", { style: fieldLabelStyle }, "credentialPaths (comma separated)"),
+        (0, import_react.createElement)("input", {
+          style: inputStyle,
+          value: (guard.credentialPaths ?? []).join(", "),
+          placeholder: "~/.config/credentials.yaml, ~/.config/cloudflared",
+          onChange: (e) => {
+            const credentialPaths = e.target.value.split(",").map((s) => s.trim()).filter(Boolean);
+            saveGuard({ credentialPaths });
+          }
+        })
+      ),
+      activeTab === "blacklist" && (0, import_react.createElement)(
+        "div",
+        { "data-tab": "blacklist" },
+        (0, import_react.createElement)("p", { style: captionStyle }, "One pattern per line. These are blocked from being committed or published."),
+        (0, import_react.createElement)("label", { style: fieldLabelStyle }, "patterns (one per line)"),
+        (0, import_react.createElement)("textarea", {
+          style: textareaStyle,
+          value: patternsText,
+          placeholder: "example-project\nacme-shop",
+          onChange: (e) => setPatternsText(e.target.value),
+          onBlur: (e) => commitBlacklistPatterns(e.target.value)
+        }),
+        (0, import_react.createElement)("label", { style: fieldLabelStyle }, "placeholders JSON"),
+        (0, import_react.createElement)("textarea", {
+          style: { ...textareaStyle, height: 90 },
+          value: placeholdersText,
+          placeholder: '{"example-project":"my-project"}',
+          onChange: (e) => setPlaceholdersText(e.target.value),
+          onBlur: () => commitPlaceholders()
+        }),
+        (0, import_react.createElement)("p", { style: captionStyle }, "Map blocked patterns to their placeholder suggestions."),
+        (0, import_react.createElement)("button", { type: "button", style: { ...secondaryButtonStyle, marginTop: 8 }, onClick: () => {
+          commitBlacklistPatterns(patternsText);
+          commitPlaceholders();
+        } }, "Save Blacklist")
+      ),
+      activeTab === "supervisor" && (0, import_react.createElement)(
+        "div",
+        { "data-tab": "supervisor" },
+        (0, import_react.createElement)("p", { style: captionStyle }, "Background daemon that auto-resumes crashed sessions."),
+        (0, import_react.createElement)("label", { style: fieldLabelStyle }, "intervalMs"),
+        (0, import_react.createElement)("input", {
+          type: "number",
+          style: inputStyle,
+          value: supervisorCfg.intervalMs ?? "",
+          placeholder: "5000",
+          onChange: (e) => {
+            const v = e.target.value === "" ? void 0 : Number(e.target.value);
+            saveSupervisorCfg({ intervalMs: v });
+          }
+        }),
+        (0, import_react.createElement)("label", { style: fieldLabelStyle }, "downThreshold"),
+        (0, import_react.createElement)("input", {
+          type: "number",
+          style: inputStyle,
+          value: supervisorCfg.downThreshold ?? "",
+          placeholder: "3",
+          onChange: (e) => {
+            const v = e.target.value === "" ? void 0 : Number(e.target.value);
+            saveSupervisorCfg({ downThreshold: v });
+          }
+        }),
+        (0, import_react.createElement)(ToggleField, {
+          label: "autoResumeEnabled",
+          caption: "Automatically resume down sessions.",
+          checked: supervisorCfg.autoResumeEnabled === true,
+          onChange: (v) => saveSupervisorCfg({ autoResumeEnabled: v })
+        })
+      ),
+      activeTab === "notifier" && (0, import_react.createElement)(
+        "div",
+        { "data-tab": "notifier" },
+        (0, import_react.createElement)("p", { style: captionStyle }, "Telegram notifications for Maestro events."),
+        (0, import_react.createElement)("label", { style: fieldLabelStyle }, "telegram.botToken"),
+        (0, import_react.createElement)("input", {
+          type: "password",
+          autoComplete: "off",
+          style: inputStyle,
+          value: notifierCfg.telegram?.botToken ?? "",
+          placeholder: "123456:ABC-DEF...",
+          onChange: (e) => saveNotifierCfg({ telegram: { botToken: e.target.value } })
+        }),
+        (0, import_react.createElement)("label", { style: fieldLabelStyle }, "telegram.chatId"),
+        (0, import_react.createElement)("input", {
+          style: inputStyle,
+          value: notifierCfg.telegram?.chatId ?? "",
+          placeholder: "-1001234567890",
+          onChange: (e) => saveNotifierCfg({ telegram: { chatId: e.target.value } })
+        }),
+        (0, import_react.createElement)(ToggleField, {
+          label: "telegram.reviewNotifications",
+          caption: "Also notify about finished reviews.",
+          checked: notifierCfg.telegram?.reviewNotifications === true || notifierCfg.policy?.reviewNotifications === true,
+          onChange: (v) => saveNotifierCfg({ telegram: { reviewNotifications: v } })
+        })
+      )
+    ),
     error && (0, import_react.createElement)("p", { style: errorStyle }, error)
   );
 }
@@ -2979,7 +3291,7 @@ function registerSettingsNavIcon(label, root) {
 // src/client/index.tsx
 var SETTINGS_NAV_CSS2 = `
 
-/* maestro: replace the settings-nav fallback gear with the maestro glyph */
+/* maestro: replace the settings-nav fallback gear with the Maestro M-logo glyph */
 [${SETTINGS_NAV_MARKER}] > svg:first-child {
   display: none;
 }
@@ -2990,10 +3302,11 @@ var SETTINGS_NAV_CSS2 = `
   width: 16px;
   height: 16px;
   background: currentColor;
-  -webkit-mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='black' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 10v3'/%3E%3Cpath d='M6 4v16'/%3E%3Cpath d='M10 8v8'/%3E%3Cpath d='M14 4v16'/%3E%3Cpath d='M18 6v12'/%3E%3Cpath d='M22 10v3'/%3E%3C/svg%3E") center / contain no-repeat;
-  mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='black' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 10v3'/%3E%3Cpath d='M6 4v16'/%3E%3Cpath d='M10 8v8'/%3E%3Cpath d='M14 4v16'/%3E%3Cpath d='M18 6v12'/%3E%3Cpath d='M22 10v3'/%3E%3C/svg%3E") center / contain no-repeat;
+  -webkit-mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 16 16' fill='none' stroke='black' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 11 L5 4 L8 9 L11 4 L14 11'/%3E%3C/svg%3E") center / contain no-repeat;
+  mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 16 16' fill='none' stroke='black' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 11 L5 4 L8 9 L11 4 L14 11'/%3E%3C/svg%3E") center / contain no-repeat;
 }
 `;
+var inject = ["slots", "connection"];
 function installNavIconStyle() {
   const tag = document.createElement("style");
   tag.dataset.plugin = "@ddtcorex/dsh-maestro-config";
@@ -3012,12 +3325,17 @@ function apply(ctx) {
     if (!connection?.rpc?.call) return Promise.reject(new Error("RPC not available"));
     return connection.rpc.call(MAESTRO_RPC_CHANNEL, endpoint, payload, signal);
   };
+  const configRpcCall = (endpoint, payload, signal) => {
+    const connection = ctx.get?.("connection");
+    if (!connection?.rpc?.call) return Promise.reject(new Error("RPC not available"));
+    return connection.rpc.call("/dsh-maestro-config", endpoint, payload, signal);
+  };
   ctx.effect(() => registerSettingsNavIcon(() => "Maestro"), "maestro: settings nav icon");
   ctx.effect(installNavIconStyle, "maestro: settings nav css");
   slots.inject(
     "settings.section",
     () => slots.register(
-      { name: "settings.section", id: "maestro", order: 25, label: () => "Maestro", inject: () => ({ rpcCall }) },
+      { name: "settings.section", id: "maestro", order: 25, label: () => "Maestro", inject: () => ({ rpcCall, configRpcCall }) },
       MaestroSettingsTab
     )
   );

package/lib/index.d.ts

@@ -1,12 +1,35 @@
 import type { Context } from '@deepseek-ai/cordis';
+type RpcResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+        details: object;
+    };
+};
 import { type MaestroConfigService } from './service.ts';
 export declare const name = "maestro-config";
 export declare const inject: string[];
 declare module '@deepseek-ai/cordis' {
     interface Context {
         maestroConfig: MaestroConfigService;
+        connection: {
+            rpc: {
+                handle: (channel: string, handler: (endpoint: string, payload: unknown) => Promise<RpcResult<unknown>>, opts?: unknown) => () => void;
+            };
+        };
     }
 }
-/** Publish maestroConfig over the shared store + loopback RPC for clients. */
+/**
+ * Publish maestroConfig over the shared store + loopback RPC for clients.
+ * Exposes guard/guardBlacklist/supervisor/notifier domains (Task 1 validators)
+ * via generic get/set — validation is delegated to the lib's domain validators.
+ * Host also handles '/dsh-maestro-config/get' and '/dsh-maestro-config/set'
+ * style calls through the single channel with endpoint dispatch.
+ */
 export declare function apply(ctx: Context): void;
+export {};
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/host/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,EAA8B,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAEpF,eAAO,MAAM,IAAI,mBAAmB,CAAA;AACpC,eAAO,MAAM,MAAM,UAAiB,CAAA;AAIpC,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,aAAa,EAAE,oBAAoB,CAAA;KACpC;CACF;AAmBD,8EAA8E;AAC9E,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAuBxC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/host/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,KAAK,SAAS,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAA;AAErH,OAAO,EAA8B,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAEpF,eAAO,MAAM,IAAI,mBAAmB,CAAA;AACpC,eAAO,MAAM,MAAM,UAAiB,CAAA;AAIpC,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,aAAa,EAAE,oBAAoB,CAAA;QACnC,UAAU,EAAE;YAAE,GAAG,EAAE;gBAAE,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,MAAM,IAAI,CAAA;aAAE,CAAA;SAAE,CAAA;KAC/J;CACF;AAmBD;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAwBxC"}

package/lib/index.js

@@ -17,7 +17,13 @@ function fail(message) {
         },
     };
 }
-/** Publish maestroConfig over the shared store + loopback RPC for clients. */
+/**
+ * Publish maestroConfig over the shared store + loopback RPC for clients.
+ * Exposes guard/guardBlacklist/supervisor/notifier domains (Task 1 validators)
+ * via generic get/set — validation is delegated to the lib's domain validators.
+ * Host also handles '/dsh-maestro-config/get' and '/dsh-maestro-config/set'
+ * style calls through the single channel with endpoint dispatch.
+ */
 export function apply(ctx) {
     const svc = createMaestroConfigService();
     ctx.provide('maestroConfig', svc);
@@ -29,6 +35,7 @@ export function apply(ctx) {
         if (endpoint === 'get') {
             if (typeof body.domain !== 'string')
                 return fail('domain (string) is required');
+            // guard / guardBlacklist / supervisor / notifier are all valid domains here
             return ok(await svc.get(body.domain));
         }
         if (endpoint === 'set') {

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/host/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0BAA0B,EAA6B,MAAM,cAAc,CAAA;AAEpF,MAAM,CAAC,MAAM,IAAI,GAAG,gBAAgB,CAAA;AACpC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,YAAY,CAAC,CAAA;AAEpC,MAAM,WAAW,GAAG,qBAAqB,CAAA;AAQzC,SAAS,EAAE,CAAI,KAAQ;IACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AAC5B,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACL,IAAI,EAAE,aAAa;YACnB,OAAO;YACP,sEAAsE;YACtE,qEAAqE;YACrE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAuC;SACxE;KACF,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,KAAK,CAAC,GAAY;IAChC,MAAM,GAAG,GAAG,0BAA0B,EAAE,CAAA;IACxC,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;IACjC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CACd,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,QAAgB,EAAE,OAAgB,EAA+B,EAAE;QAC/G,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAwC,CAAA;QACnE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACjD,CAAC;QACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAA;YAC/E,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;QACvC,CAAC;QACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC7F,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAA;YAChE,CAAC;YACD,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;YACtC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,qBAAqB,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtD,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAC9B,CAAA;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/host/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,0BAA0B,EAA6B,MAAM,cAAc,CAAA;AAEpF,MAAM,CAAC,MAAM,IAAI,GAAG,gBAAgB,CAAA;AACpC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,YAAY,CAAC,CAAA;AAEpC,MAAM,WAAW,GAAG,qBAAqB,CAAA;AASzC,SAAS,EAAE,CAAI,KAAQ;IACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AAC5B,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACL,IAAI,EAAE,aAAa;YACnB,OAAO;YACP,sEAAsE;YACtE,qEAAqE;YACrE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAuC;SACxE;KACF,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY;IAChC,MAAM,GAAG,GAAG,0BAA0B,EAAE,CAAA;IACxC,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;IACjC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CACd,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,QAAgB,EAAE,OAAgB,EAA+B,EAAE;QAC/G,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAwC,CAAA;QACnE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACjD,CAAC;QACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAA;YAC/E,4EAA4E;YAC5E,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;QACvC,CAAC;QACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC7F,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAA;YAChE,CAAC;YACD,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;YACtC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,qBAAqB,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtD,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAC9B,CAAA;AACH,CAAC"}

package/lib/types/client/Settings.d.ts

@@ -0,0 +1,11 @@
+type RpcCall = (endpoint: string, payload?: unknown, signal?: AbortSignal) => Promise<unknown>;
+export declare function Settings({ configRpcCall }: {
+    configRpcCall: RpcCall;
+}): import("react").DetailedReactHTMLElement<{
+    'data-maestro-guard-settings': string;
+    style: {
+        maxWidth: number;
+    };
+}, HTMLElement>;
+export default Settings;
+//# sourceMappingURL=Settings.d.ts.map

package/lib/types/client/Settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Settings.d.ts","sourceRoot":"","sources":["../../../src/client/Settings.tsx"],"names":[],"mappings":"AAIA,KAAK,OAAO,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAiF9F,wBAAgB,QAAQ,CAAC,EAAE,aAAa,EAAE,EAAE;IAAE,aAAa,EAAE,OAAO,CAAA;CAAE;;;;;gBAiRrE;AAGD,eAAe,QAAQ,CAAA"}

package/lib/types/client/index.d.ts

@@ -2,6 +2,7 @@ interface ClientCtx {
     get?(name: string): unknown;
     effect(fn: () => () => void, label?: string): unknown;
 }
+export declare const inject: readonly ["slots", "connection"];
 export declare function apply(ctx: ClientCtx): void;
 export {};
 //# sourceMappingURL=index.d.ts.map

package/lib/types/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.tsx"],"names":[],"mappings":"AAuCA,UAAU,SAAS;IACjB,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC3B,MAAM,CAAC,EAAE,EAAE,MAAM,MAAM,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CACtD;AAaD,wBAAgB,KAAK,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,CAuB1C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.tsx"],"names":[],"mappings":"AAwCA,UAAU,SAAS;IACjB,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC3B,MAAM,CAAC,EAAE,EAAE,MAAM,MAAM,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CACtD;AAED,eAAO,MAAM,MAAM,kCAAmC,CAAA;AAatD,wBAAgB,KAAK,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,CA+B1C"}

package/lib/types/client/maestro-card.d.ts

@@ -1,5 +1,6 @@
-export function MaestroSettingsTab({ rpcCall }: {
+export function MaestroSettingsTab({ rpcCall, configRpcCall }: {
     rpcCall: any;
+    configRpcCall: any;
 }): import("react").DetailedReactHTMLElement<{
     'data-maestro-settings-card': string;
     style: {

package/lib/types/client/maestro-card.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"maestro-card.d.ts","sourceRoot":"","sources":["../../../src/client/maestro-card.jsx"],"names":[],"mappings":"AA6bA;;;;;;;gBAmPC"}
+{"version":3,"file":"maestro-card.d.ts","sourceRoot":"","sources":["../../../src/client/maestro-card.jsx"],"names":[],"mappings":"AAweA;;;;;;;;gBA0dC"}

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@ddtcorex/dsh-maestro-config",
-  "version": "0.1.0",
+  "version": "0.1.2",
+  "private": false,
   "description": "Maestro Config — shared settings service for the dsh-maestro-* suite over the single namespaced store (~/.dsh/maestro/settings.json)",
   "type": "module",
   "main": "./lib/index.js",
@@ -33,16 +34,14 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-connection": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-host-apiproxy": "0.1.0-rc.8"
+    "@deepseek-ai/dsh-client-connection": "0.1.1-rc.2"
   },
   "dependencies": {
-    "@ddtcorex/dsh-maestro-config-lib": "^0.1.0"
+    "@ddtcorex/dsh-maestro-config-lib": "^0.1.2"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-connection": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-host-apiproxy": "0.1.0-rc.8",
+    "@deepseek-ai/dsh-client-connection": "0.1.1-rc.2",
     "@types/node": "^22.0.0",
     "@types/qrcode": "^1.5.6",
     "@types/react": "~18.3.1",

package/src/client/index.tsx

@@ -7,12 +7,13 @@ import { registerSettingsNavIcon, SETTINGS_NAV_MARKER } from './settings-nav-ico
  * DSH 0.1.x gives external settings sections a generic gear and exposes no
  * icon field in the settings.section contract (mirrors dsh-better-sidebar):
  * the marker only claims this plugin's localized row and this CSS paints the
- * Lucide "audio-lines" glyph as a currentColor mask so it follows native nav
- * hover/active colors at the shell's 16px icon rhythm.
+ * Maestro M-logo glyph as a currentColor mask so it follows native nav
+ * hover/active colors at the shell's 16px icon rhythm. The path matches the
+ * sidebar MaestroTrigger (trigger.tsx#MaestroLogo) — M2 11 L5 4 L8 9 L11 4 L14 11.
  */
 const SETTINGS_NAV_CSS = `
 
-/* maestro: replace the settings-nav fallback gear with the maestro glyph */
+/* maestro: replace the settings-nav fallback gear with the Maestro M-logo glyph */
 [${SETTINGS_NAV_MARKER}] > svg:first-child {
   display: none;
 }
@@ -23,8 +24,8 @@ const SETTINGS_NAV_CSS = `
   width: 16px;
   height: 16px;
   background: currentColor;
-  -webkit-mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='black' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 10v3'/%3E%3Cpath d='M6 4v16'/%3E%3Cpath d='M10 8v8'/%3E%3Cpath d='M14 4v16'/%3E%3Cpath d='M18 6v12'/%3E%3Cpath d='M22 10v3'/%3E%3C/svg%3E") center / contain no-repeat;
-  mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='black' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 10v3'/%3E%3Cpath d='M6 4v16'/%3E%3Cpath d='M10 8v8'/%3E%3Cpath d='M14 4v16'/%3E%3Cpath d='M18 6v12'/%3E%3Cpath d='M22 10v3'/%3E%3C/svg%3E") center / contain no-repeat;
+  -webkit-mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 16 16' fill='none' stroke='black' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 11 L5 4 L8 9 L11 4 L14 11'/%3E%3C/svg%3E") center / contain no-repeat;
+  mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 16 16' fill='none' stroke='black' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 11 L5 4 L8 9 L11 4 L14 11'/%3E%3C/svg%3E") center / contain no-repeat;
 }
 `
 
@@ -42,6 +43,8 @@ interface ClientCtx {
   effect(fn: () => () => void, label?: string): unknown
 }
 
+export const inject = ['slots', 'connection'] as const
+
 function installNavIconStyle(): () => void {
   const tag = document.createElement('style')
   tag.dataset.plugin = '@ddtcorex/dsh-maestro-config'
@@ -65,6 +68,14 @@ export function apply(ctx: ClientCtx): void {
     if (!connection?.rpc?.call) return Promise.reject(new Error('RPC not available'))
     return connection.rpc.call(MAESTRO_RPC_CHANNEL, endpoint, payload, signal)
   }
+  // Generic config RPC for supervisor (independent of review — works when review not installed)
+  const configRpcCall: RpcCall = (endpoint, payload, signal) => {
+    const connection = ctx.get?.('connection') as
+      | { rpc: { call(ch: string, ep: string, p?: unknown, s?: AbortSignal): Promise<unknown> } }
+      | undefined
+    if (!connection?.rpc?.call) return Promise.reject(new Error('RPC not available'))
+    return connection.rpc.call('/dsh-maestro-config', endpoint, payload, signal)
+  }
 
   // Reversible effects: nav-row marker observer + owned style tag.
   ctx.effect(() => registerSettingsNavIcon(() => 'Maestro'), 'maestro: settings nav icon')
@@ -72,8 +83,8 @@ export function apply(ctx: ClientCtx): void {
 
   slots.inject('settings.section', () =>
     slots.register(
-      { name: 'settings.section', id: 'maestro', order: 25, label: () => 'Maestro', inject: () => ({ rpcCall }) },
-      MaestroSettingsTab,
+      { name: 'settings.section', id: 'maestro', order: 25, label: () => 'Maestro', inject: () => ({ rpcCall, configRpcCall }) },
+      MaestroSettingsTab as unknown as (props: { rpcCall: RpcCall }) => unknown,
     ),
   )
 }

package/src/client/maestro-card.jsx

@@ -86,6 +86,32 @@ const codeStyle = {
   wordBreak: 'break-all',
 }
 
+const textareaStyle = {
+  ...inputStyle,
+  height: 120,
+  padding: '8px 12px',
+  resize: 'vertical',
+}
+
+const tabBarStyle = {
+  display: 'flex',
+  gap: 8,
+  borderBottom: '1px solid var(--dsw-alias-border-l2)',
+  marginBottom: 16,
+}
+
+const tabButtonStyle = (active) => ({
+  padding: '8px 14px',
+  border: 'none',
+  borderBottom: active ? '2px solid var(--dsw-alias-button-primary-fill)' : '2px solid transparent',
+  background: 'transparent',
+  color: active ? 'var(--dsw-alias-label-primary)' : 'var(--dsw-alias-label-secondary)',
+  font: 'inherit',
+  fontSize: 13,
+  fontWeight: active ? 600 : 400,
+  cursor: 'pointer',
+})
+
 /** QR code centered in a light tile with an even scanner-friendly quiet zone. */
 function QrImage({ url, size = 104 }) {
   const [dataUrl, setDataUrl] = useState(null)
@@ -147,10 +173,35 @@ function ReviewModelSelector({ value, catalog, fallbackValue, fallbackLabel, onC
     document.addEventListener('keydown', onKey)
     return () => { document.removeEventListener('mousedown', onDown); document.removeEventListener('keydown', onKey) }
   }, [open])
+  const getModelId = (m) => typeof m === 'string' ? m : m.id
+  const getModelName = (m) => typeof m === 'string' ? m : (m.name ?? m.id)
+  const selectedModelInfo = (() => {
+    if (!selectedProvider || !value?.model) return null
+    const raw = (providerGroup?.models ?? []).find(mm => getModelId(mm) === value.model)
+    if (raw === undefined) return null
+    if (typeof raw === 'string') return { id: raw, supportsReasoning: false, reasoningEfforts: [] }
+    return raw
+  })()
+  const supportsReasoning = (() => {
+    if (!selectedModelInfo) return false
+    if (typeof selectedModelInfo.supportsReasoning === 'boolean') return selectedModelInfo.supportsReasoning
+    const efforts = selectedModelInfo.reasoningEfforts ?? selectedModelInfo.reasoning?.efforts?.map(e => e.id) ?? []
+    return efforts.filter(e => e !== 'off').length > 0
+  })()
+  const availableEfforts = (() => {
+    if (!supportsReasoning) return []
+    const efforts = selectedModelInfo?.reasoningEfforts ?? selectedModelInfo?.reasoning?.efforts?.map(e => e.id) ?? []
+    const filtered = efforts.filter(e => e !== 'off' && e !== '')
+    if (filtered.length > 0) return filtered
+    return ['low', 'medium', 'high']
+  })()
+  const warning = selectedEffort !== '' && !supportsReasoning && selectedModelInfo !== null
+    ? `⚠️ This model does not support reasoning effort "${selectedEffort}" — reviews will fail. Clear effort or choose a reasoning-capable model.`
+    : null
   const update = (field, newVal) => {
     if (newVal === '' && field === 'provider') { onChange(null); setOpen(false); setPane('root'); return }
     const next = { provider: value?.provider ?? '', model: value?.model ?? '', ...(value?.reasoningEffort ? { reasoningEffort: value.reasoningEffort } : {}) }
-    if (field === 'provider') { const g = groups.find(x => x.provider === newVal); next.provider = newVal; next.model = g?.models[0] ?? '' }
+    if (field === 'provider') { const g = groups.find(x => x.provider === newVal); const first = g?.models[0]; next.provider = newVal; next.model = first !== undefined ? getModelId(first) : '' }
     else if (field === 'model') { next.model = newVal }
     else if (field === 'reasoningEffort') { if (newVal === '') delete next.reasoningEffort; else next.reasoningEffort = newVal }
     if (!next.provider || !next.model) { onChange(null) } else { onChange(next) }
@@ -235,6 +286,7 @@ function ReviewModelSelector({ value, catalog, fallbackValue, fallbackLabel, onC
         ),
         value && h('p', { style: { ...captionStyle, margin: '8px 4px 2px' } }, `Selected: ${value.provider} / ${value.model}${value.reasoningEffort ? ` (${value.reasoningEffort})` : ''}`),
         !value && effectiveFallback && h('p', { style: { ...captionStyle, margin: '8px 4px 2px' } }, `${effectiveFallbackLabel === 'Use Global' ? 'Using Global' : 'Using DSH default'}: ${effectiveFallback.provider} / ${effectiveFallback.model}${effectiveFallback.reasoningEffort ? ` (${effectiveFallback.reasoningEffort})` : ''}`),
+        warning && h('p', { style: { ...captionStyle, margin: '4px 4px 2px', color: 'var(--dsw-alias-state-error-primary)' } }, warning),
       ),
       pane === 'model' && h('div', null,
         h('button', { type: 'button', style: { ...rowStyle, color: 'var(--dsw-alias-label-secondary)' }, onClick: () => setPane('root') }, h('span', null, '← Back'), h('span', { style: { fontSize: 12 } }, 'Model')),
@@ -247,20 +299,31 @@ function ReviewModelSelector({ value, catalog, fallbackValue, fallbackLabel, onC
               h('div', { style: { fontSize: 11, fontWeight: 600, color: 'var(--dsw-alias-label-secondary)', padding: '6px 10px 2px', textTransform: 'uppercase', letterSpacing: 0.4, display: 'flex', alignItems: 'center', gap: 6 } }, h('span', { style: { width: 6, height: 6, borderRadius: 3, background: 'var(--dsw-alias-border-l2)', flex: 'none' } }), g?.name ?? p),
               ms.length === 0 ? h('p', { style: { ...captionStyle, padding: '2px 10px 2px 28px' } }, 'No models') :
               h('div', { style: { marginLeft: 12, borderLeft: '1px solid var(--dsw-alias-border-l2)', paddingLeft: 6, display: 'flex', flexDirection: 'column', gap: 2 } },
-                ms.map(m => h('button', { key: m, type: 'button', style: { ...rowStyle, paddingLeft: 10, background: value?.provider === p && value?.model === m ? 'var(--dsw-alias-bg-layer-2)' : 'transparent' }, onClick: () => { update('model', m); if (value?.provider !== p) update('provider', p); else { const next = { provider: p, model: m, ...(selectedEffort ? { reasoningEffort: selectedEffort } : {}) }; onChange(next); setPane('root') } } }, h('span', { style: { overflow: 'hidden', textOverflow: 'ellipsis' } }, m), check(value?.provider === p && value?.model === m)))),
+                ms.map(m => {
+                  const mid = getModelId(m)
+                  const mname = getModelName(m)
+                  const active = value?.provider === p && value?.model === mid
+                  return h('button', { key: mid, type: 'button', style: { ...rowStyle, paddingLeft: 10, background: active ? 'var(--dsw-alias-bg-layer-2)' : 'transparent' }, onClick: () => { update('model', mid); if (value?.provider !== p) update('provider', p); else { const next = { provider: p, model: mid, ...(selectedEffort ? { reasoningEffort: selectedEffort } : {}) }; onChange(next); setPane('root') } } }, h('span', { style: { overflow: 'hidden', textOverflow: 'ellipsis' } }, mname), check(active))
+                })),
             )
           }),
         ),
       ),
       pane === 'effort' && h('div', null,
         h('button', { type: 'button', style: { ...rowStyle, color: 'var(--dsw-alias-label-secondary)' }, onClick: () => setPane('root') }, h('span', null, '← Back'), h('span', { style: { fontSize: 12 } }, 'Effort')),
-        h('div', { style: { marginTop: 4 } },
-          [
-            { id: '', label: 'Default effort' },
-            { id: 'low', label: 'low' },
-            { id: 'medium', label: 'medium' },
-            { id: 'high', label: 'high' },
-          ].map(e => h('button', { key: e.id || 'default', type: 'button', style: { ...rowStyle, background: selectedEffort === e.id ? 'var(--dsw-alias-bg-layer-2)' : 'transparent' }, onClick: () => { update('reasoningEffort', e.id); setPane('root') } }, h('span', null, e.label), check(selectedEffort === e.id))),
+        selectedModelInfo === null ? h('p', { style: { ...captionStyle, margin: '8px 4px 2px' } }, 'Select a model first to configure effort.') :
+        !supportsReasoning ? h('div', null,
+          h('p', { style: { ...captionStyle, margin: '8px 4px 6px' } }, 'This model does not support reasoning effort — using provider default'),
+          h('div', { style: { marginTop: 4 } },
+            [{ id: '', label: 'Default effort' }].map(e => h('button', { key: e.id || 'default', type: 'button', style: { ...rowStyle, background: selectedEffort === e.id ? 'var(--dsw-alias-bg-layer-2)' : 'transparent' }, onClick: () => { update('reasoningEffort', e.id); setPane('root') } }, h('span', null, e.label), check(selectedEffort === e.id))),
+          ),
+          warning && h('p', { style: { ...captionStyle, margin: '8px 4px 2px', color: 'var(--dsw-alias-state-error-primary)' } }, warning),
+        ) :
+        h('div', null,
+          h('div', { style: { marginTop: 4 } },
+            [{ id: '', label: 'Default effort' }, ...availableEfforts.map(id => ({ id, label: id }))].map(e => h('button', { key: e.id || 'default', type: 'button', style: { ...rowStyle, background: selectedEffort === e.id ? 'var(--dsw-alias-bg-layer-2)' : 'transparent' }, onClick: () => { update('reasoningEffort', e.id); setPane('root') } }, h('span', null, e.label), check(selectedEffort === e.id))),
+          ),
+          warning && h('p', { style: { ...captionStyle, margin: '8px 4px 2px', color: 'var(--dsw-alias-state-error-primary)' } }, warning),
         ),
       ),
     ),
@@ -336,26 +399,6 @@ function ToggleField({ label, caption, checked, onChange }) {
   )
 }
 
-/** Newest-first list of recorded review runs from the host's reviews.json. */
-function ReviewHistoryPanel({ rpcCall }) {
-  const [entries, setEntries] = useState(null)
-  useEffect(() => {
-    rpcCall(MAESTRO_ENDPOINTS.reviewsList, {})
-      .then(res => { if (res?.ok) setEntries(res.value ?? []) })
-      .catch(() => setEntries([]))
-  }, [])
-  if (entries === null) return h('p', { style: captionStyle }, 'Loading review history…')
-  if (entries.length === 0) return h('p', { style: captionStyle }, 'No reviews recorded yet.')
-  const icon = entry => entry.status === 'completed' ? '✅' : entry.status === 'failed' ? '⚠️' : '👀'
-  return h('ul', { style: { listStyle: 'none', margin: 0, padding: 0 } },
-    entries.map(entry => h('li', { key: entry.id, style: { padding: '6px 0', borderBottom: '1px solid var(--dsw-alias-separator-default, #333)', fontSize: 13 } },
-      h('span', null, `${icon(entry)} ${entry.projectPath} !${entry.mrIid} · ${entry.mode}${entry.trigger !== 'mention' ? ` · ${entry.trigger}` : ''}`),
-      h('div', { style: captionStyle },
-        `${new Date(entry.startedAt).toLocaleString()}${entry.summary ? ` — ${entry.summary}` : ''}${entry.error ? ` — ${entry.error}` : ''}`),
-    )),
-  )
-}
-
 /** One selectable LAN address chip + the QR of the currently selected URL. */
 function LanAccess({ proxyStatus, lanPin }) {
   const urls = proxyStatus?.lanUrls ?? []
@@ -443,7 +486,7 @@ function PublicAccess({ status, pin, showPin, onRevealPin, onHidePin, onRotatePi
   )
 }
 
-export function MaestroSettingsTab({ rpcCall }) {
+export function MaestroSettingsTab({ rpcCall, configRpcCall }) {
   const [status, setStatus] = useState(null)
   const [proxyStatus, setProxyStatus] = useState(null)
   const [config, setConfig] = useState({ tunnelMode: 'quick', projectMappings: [] })
@@ -455,6 +498,13 @@ export function MaestroSettingsTab({ rpcCall }) {
   const [lanPinEnabled, setLanPinEnabled] = useState(false)
   const [lanPin, setLanPin] = useState(null)
   const [showLanPin, setShowLanPin] = useState(false)
+  // Task 3: Guard/Blacklist/Supervisor/Notifier tabs state
+  const [activeTab, setActiveTab] = useState('guard')
+  const [guard, setGuard] = useState({})
+  const [patternsText, setPatternsText] = useState('')
+  const [placeholdersText, setPlaceholdersText] = useState('')
+  const [supervisorCfg, setSupervisorCfg] = useState({})
+  const [notifierCfg, setNotifierCfg] = useState({})
 
   const call = async (endpoint, payload) => {
     const res = await rpcCall(endpoint, payload)
@@ -462,6 +512,60 @@ export function MaestroSettingsTab({ rpcCall }) {
     return res.value
   }
 
+  // Helpers for guard/supervisor/notifier domains via generic config RPC (Task 3)
+  const unwrap = (res) => {
+    if (res && typeof res === 'object' && 'ok' in res) {
+      if (res.ok) return res.value
+      throw new Error(res.error?.message ?? 'RPC failed')
+    }
+    return res
+  }
+  const cfgGet = async (domain) => {
+    if (!configRpcCall) throw new Error('config RPC not available')
+    const res = await configRpcCall('get', { domain })
+    return unwrap(res)
+  }
+  const cfgSet = async (domain, patch) => {
+    if (!configRpcCall) throw new Error('config RPC not available')
+    const res = await configRpcCall('set', { domain, patch })
+    return unwrap(res)
+  }
+  const saveGuard = async (patch) => {
+    setError(null)
+    const next = { ...guard, ...patch }
+    if (patch.gitProtection && guard.gitProtection) next.gitProtection = { ...guard.gitProtection, ...patch.gitProtection }
+    setGuard(next)
+    try { await cfgSet('guard', patch) } catch (e) { setError(e.message ?? String(e)) }
+  }
+  const commitBlacklistPatterns = async (text) => {
+    const patterns = text.split('\n').map(s => s.trim()).filter(Boolean)
+    setError(null)
+    try { await cfgSet('guardBlacklist', { patterns }) } catch (e) { setError(e.message ?? String(e)) }
+  }
+  const commitPlaceholders = async () => {
+    setError(null)
+    let obj = {}
+    try { obj = placeholdersText.trim() ? JSON.parse(placeholdersText) : {}; if (typeof obj !== 'object' || obj === null || Array.isArray(obj)) throw new Error('placeholders must be JSON object') } catch (e) { setError(`placeholders JSON invalid: ${e.message ?? String(e)}`); return }
+    try { await cfgSet('guardBlacklist', { placeholders: obj }) } catch (e) { setError(e.message ?? String(e)) }
+  }
+  const saveSupervisorCfg = async (patch) => {
+    setError(null)
+    setSupervisorCfg(prev => ({ ...prev, ...patch }))
+    try { await cfgSet('supervisor', patch) } catch (e) { setError(e.message ?? String(e)) }
+  }
+  const saveNotifierCfg = async (patch) => {
+    setError(null)
+    setNotifierCfg(prev => {
+      const next = { ...prev }
+      for (const [k, v] of Object.entries(patch)) {
+        if (k === 'telegram' && typeof v === 'object' && v !== null) next.telegram = { ...(prev.telegram ?? {}), ...v }
+        else next[k] = v
+      }
+      return next
+    })
+    try { await cfgSet('notifier', patch) } catch (e) { setError(e.message ?? String(e)) }
+  }
+
   const refresh = async () => {
     try { setStatus(await call(MAESTRO_ENDPOINTS.status, {})) } catch { /* transient failure, ignore */ }
     try { setProxyStatus(await call(MAESTRO_ENDPOINTS.proxyStatus, {})) } catch { /* proxy row may be starting */ }
@@ -474,6 +578,31 @@ export function MaestroSettingsTab({ rpcCall }) {
     call(MAESTRO_ENDPOINTS.getConfig, {})
       .then(saved => setConfig(prev => ({ ...prev, ...saved })))
       .catch(() => { /* first run, no config saved yet — keep defaults */ })
+    // Supervisor model may be stored via generic config service when review not installed — try fallback
+    if (configRpcCall) {
+      configRpcCall('get', { domain: 'supervisor' })
+        .then(res => {
+          if (res?.ok && res.value?.model) {
+            setConfig(prev => ({ ...prev, supervisorModel: res.value.model }))
+          }
+        })
+        .catch(() => { /* supervisor domain not yet set or config service unavailable */ })
+      // Task 3: load Guard/Blacklist/Supervisor/Notifier domains
+      Promise.all([
+        cfgGet('guard').catch(() => ({})),
+        cfgGet('guardBlacklist').catch(() => ({ patterns: [], placeholders: {} })),
+        cfgGet('supervisor').catch(() => ({})),
+        cfgGet('notifier').catch(() => ({})),
+      ]).then(([g, bl, sup, not]) => {
+        setGuard(g ?? {})
+        const pats = Array.isArray(bl?.patterns) ? bl.patterns : []
+        const ph = bl?.placeholders && typeof bl.placeholders === 'object' ? bl.placeholders : {}
+        setPatternsText(pats.join('\n'))
+        setPlaceholdersText(JSON.stringify(ph, null, 2))
+        setSupervisorCfg(sup ?? {})
+        setNotifierCfg(not ?? {})
+      }).catch(() => {})
+    }
     call(MAESTRO_ENDPOINTS.lanPinStatus, {})
       .then(value => { setLanPinEnabled(value.enabled); if (value.enabled) setLanPin(value.pin ?? null) })
       .catch(() => { /* host without the LAN PIN endpoints — keep the row hidden */ })
@@ -559,6 +688,16 @@ export function MaestroSettingsTab({ rpcCall }) {
   const saveField = async (field, value) => {
     setError(null)
     setConfig(prev => ({ ...prev, [field]: value }))
+    // Supervisor model can be saved via generic config service when review not installed (independent install)
+    if (field === 'supervisorModel' && configRpcCall) {
+      try {
+        const res = await configRpcCall('set', { domain: 'supervisor', patch: { model: value } })
+        if (res?.ok) return
+        // Fall through to review RPC if generic set fails
+      } catch (e) {
+        // Fall through to review RPC
+      }
+    }
     try {
       await call(MAESTRO_ENDPOINTS.saveConfig, { [field]: value })
     } catch (err) {
@@ -663,7 +802,6 @@ export function MaestroSettingsTab({ rpcCall }) {
         checked: config.autoRereviewOnPush,
         onChange: checked => saveField('autoRereviewOnPush', checked),
       }),
-      h(ReviewHistoryPanel, { rpcCall }),
     ),
 
     h('div', { style: sectionStyle },
@@ -679,11 +817,147 @@ export function MaestroSettingsTab({ rpcCall }) {
       }),
     ),
 
+    h('div', { style: sectionStyle },
+      h('h4', { style: headingStyle }, 'Supervisor LLM'),
+      h('p', { style: captionStyle }, 'Model used by the supervisor debug-agent to auto-fix DSH Web crashes. Empty = DSH default (or Review model if set). Uses the same provider catalog as Review.'),
+      h(ReviewModelSelector, {
+        value: config.supervisorModel ?? null,
+        catalog,
+        fallbackValue: catalog?.current ?? null,
+        fallbackLabel: 'Use DSH default',
+        onChange: v => saveField('supervisorModel', v),
+        label: 'Supervisor model',
+      }),
+    ),
+
     h('div', { style: sectionStyle },
       h('h4', { style: headingStyle }, 'Projects'),
       h(ProjectMappingsEditor, { mappings: config.projectMappings ?? [], onChange: mappings => saveField('projectMappings', mappings), catalog, globalReviewModel: config.reviewModel ?? null }),
     ),
 
+    // Task 3: Guard/Blacklist/Supervisor/Notifier tabs — data-driven over guard domains
+    h('div', { style: sectionStyle },
+      h('h4', { style: headingStyle }, 'Guard / Blacklist / Supervisor / Notifier'),
+      h('div', { style: tabBarStyle },
+        h('button', { type: 'button', style: tabButtonStyle(activeTab === 'guard'), onClick: () => setActiveTab('guard') }, 'Guard'),
+        h('button', { type: 'button', style: tabButtonStyle(activeTab === 'blacklist'), onClick: () => setActiveTab('blacklist') }, 'Blacklist'),
+        h('button', { type: 'button', style: tabButtonStyle(activeTab === 'supervisor'), onClick: () => setActiveTab('supervisor') }, 'Supervisor'),
+        h('button', { type: 'button', style: tabButtonStyle(activeTab === 'notifier'), onClick: () => setActiveTab('notifier') }, 'Notifier'),
+      ),
+      activeTab === 'guard' && h('div', { 'data-tab': 'guard' },
+        h('p', { style: captionStyle }, 'Enforce publish block, git protection and cwd containment.'),
+        h(ToggleField, {
+          label: 'publishBlocked',
+          caption: 'Block publish-related commands when enabled.',
+          checked: guard.publishBlocked === true,
+          onChange: v => saveGuard({ publishBlocked: v }),
+        }),
+        h(ToggleField, {
+          label: 'gitProtection.enabled',
+          caption: 'Protect pushes to protected branches.',
+          checked: guard.gitProtection?.enabled === true,
+          onChange: v => saveGuard({ gitProtection: { enabled: v, branches: guard.gitProtection?.branches ?? ['master', 'main'] } }),
+        }),
+        h('label', { style: fieldLabelStyle }, 'gitProtection.branches (comma separated)'),
+        h('input', {
+          style: inputStyle,
+          value: (guard.gitProtection?.branches ?? ['master', 'main']).join(', '),
+          placeholder: 'master, main',
+          onChange: e => {
+            const branches = e.target.value.split(',').map(s => s.trim()).filter(Boolean)
+            saveGuard({ gitProtection: { enabled: guard.gitProtection?.enabled ?? true, branches } })
+          },
+        }),
+        h(ToggleField, {
+          label: 'cwdContainment',
+          caption: 'Contain file operations to the session cwd.',
+          checked: guard.cwdContainment === true,
+          onChange: v => saveGuard({ cwdContainment: v }),
+        }),
+        h('label', { style: fieldLabelStyle }, 'credentialPaths (comma separated)'),
+        h('input', {
+          style: inputStyle,
+          value: (guard.credentialPaths ?? []).join(', '),
+          placeholder: '~/.config/credentials.yaml, ~/.config/cloudflared',
+          onChange: e => {
+            const credentialPaths = e.target.value.split(',').map(s => s.trim()).filter(Boolean)
+            saveGuard({ credentialPaths })
+          },
+        }),
+      ),
+      activeTab === 'blacklist' && h('div', { 'data-tab': 'blacklist' },
+        h('p', { style: captionStyle }, 'One pattern per line. These are blocked from being committed or published.'),
+        h('label', { style: fieldLabelStyle }, 'patterns (one per line)'),
+        h('textarea', {
+          style: textareaStyle,
+          value: patternsText,
+          placeholder: 'example-project\nacme-shop',
+          onChange: e => setPatternsText(e.target.value),
+          onBlur: e => commitBlacklistPatterns(e.target.value),
+        }),
+        h('label', { style: fieldLabelStyle }, 'placeholders JSON'),
+        h('textarea', {
+          style: { ...textareaStyle, height: 90 },
+          value: placeholdersText,
+          placeholder: '{"example-project":"my-project"}',
+          onChange: e => setPlaceholdersText(e.target.value),
+          onBlur: () => commitPlaceholders(),
+        }),
+        h('p', { style: captionStyle }, 'Map blocked patterns to their placeholder suggestions.'),
+        h('button', { type: 'button', style: { ...secondaryButtonStyle, marginTop: 8 }, onClick: () => { commitBlacklistPatterns(patternsText); commitPlaceholders() } }, 'Save Blacklist'),
+      ),
+      activeTab === 'supervisor' && h('div', { 'data-tab': 'supervisor' },
+        h('p', { style: captionStyle }, 'Background daemon that auto-resumes crashed sessions.'),
+        h('label', { style: fieldLabelStyle }, 'intervalMs'),
+        h('input', {
+          type: 'number',
+          style: inputStyle,
+          value: supervisorCfg.intervalMs ?? '',
+          placeholder: '5000',
+          onChange: e => { const v = e.target.value === '' ? undefined : Number(e.target.value); saveSupervisorCfg({ intervalMs: v }) },
+        }),
+        h('label', { style: fieldLabelStyle }, 'downThreshold'),
+        h('input', {
+          type: 'number',
+          style: inputStyle,
+          value: supervisorCfg.downThreshold ?? '',
+          placeholder: '3',
+          onChange: e => { const v = e.target.value === '' ? undefined : Number(e.target.value); saveSupervisorCfg({ downThreshold: v }) },
+        }),
+        h(ToggleField, {
+          label: 'autoResumeEnabled',
+          caption: 'Automatically resume down sessions.',
+          checked: supervisorCfg.autoResumeEnabled === true,
+          onChange: v => saveSupervisorCfg({ autoResumeEnabled: v }),
+        }),
+      ),
+      activeTab === 'notifier' && h('div', { 'data-tab': 'notifier' },
+        h('p', { style: captionStyle }, 'Telegram notifications for Maestro events.'),
+        h('label', { style: fieldLabelStyle }, 'telegram.botToken'),
+        h('input', {
+          type: 'password',
+          autoComplete: 'off',
+          style: inputStyle,
+          value: notifierCfg.telegram?.botToken ?? '',
+          placeholder: '123456:ABC-DEF...',
+          onChange: e => saveNotifierCfg({ telegram: { botToken: e.target.value } }),
+        }),
+        h('label', { style: fieldLabelStyle }, 'telegram.chatId'),
+        h('input', {
+          style: inputStyle,
+          value: notifierCfg.telegram?.chatId ?? '',
+          placeholder: '-1001234567890',
+          onChange: e => saveNotifierCfg({ telegram: { chatId: e.target.value } }),
+        }),
+        h(ToggleField, {
+          label: 'telegram.reviewNotifications',
+          caption: 'Also notify about finished reviews.',
+          checked: notifierCfg.telegram?.reviewNotifications === true || notifierCfg.policy?.reviewNotifications === true,
+          onChange: v => saveNotifierCfg({ telegram: { reviewNotifications: v } }),
+        }),
+      ),
+    ),
+
     error && h('p', { style: errorStyle }, error),
   )
 }

package/src/host/index.ts

@@ -1,6 +1,7 @@
-import type {} from '@deepseek-ai/dsh-client-connection'
 import type { Context } from '@deepseek-ai/cordis'
-import type { RpcErrorDetailsMap, RpcResult } from '@deepseek-ai/dsh-host-apiproxy/api'
+
+type RpcResult<T> = { ok: true; value: T } | { ok: false; error: { code: string; message: string; details: object } }
+type RpcErrorDetailsMap = { 'bad-request': { issues: object[] } }
 import { createMaestroConfigService, type MaestroConfigService } from './service.ts'
 
 export const name = 'maestro-config'
@@ -11,6 +12,7 @@ const RPC_CHANNEL = '/dsh-maestro-config'
 declare module '@deepseek-ai/cordis' {
   interface Context {
     maestroConfig: MaestroConfigService
+    connection: { rpc: { handle: (channel: string, handler: (endpoint: string, payload: unknown) => Promise<RpcResult<unknown>>, opts?: unknown) => () => void } }
   }
 }
 
@@ -31,7 +33,13 @@ function fail(message: string): RpcResult<never> {
   }
 }
 
-/** Publish maestroConfig over the shared store + loopback RPC for clients. */
+/**
+ * Publish maestroConfig over the shared store + loopback RPC for clients.
+ * Exposes guard/guardBlacklist/supervisor/notifier domains (Task 1 validators)
+ * via generic get/set — validation is delegated to the lib's domain validators.
+ * Host also handles '/dsh-maestro-config/get' and '/dsh-maestro-config/set'
+ * style calls through the single channel with endpoint dispatch.
+ */
 export function apply(ctx: Context): void {
   const svc = createMaestroConfigService()
   ctx.provide('maestroConfig', svc)
@@ -43,6 +51,7 @@ export function apply(ctx: Context): void {
       }
       if (endpoint === 'get') {
         if (typeof body.domain !== 'string') return fail('domain (string) is required')
+        // guard / guardBlacklist / supervisor / notifier are all valid domains here
         return ok(await svc.get(body.domain))
       }
       if (endpoint === 'set') {