@ddtcorex/dsh-maestro-review 0.1.0

package/README.md

@@ -0,0 +1,53 @@
+# @ddtcorex/dsh-maestro-review
+
+Automated merge-request review for the [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness):
+pluggable **ReviewProvider** (GitLab first), an orchestrator that spins up reviewer/auditor
+child agents on fresh worktrees, webhook intake for GitLab events, and a settings/tunnel
+client UI injected into the DSH Web slots.
+
+Part of the Maestro Harness suite (`dsh-maestro-*`). Cordis patch rows:
+`maestro-review-webhook` (intake), `maestro-review-orchestrator` (pipeline),
+`maestro-review-settings-rpc` (settings UI) — all served by this npm package.
+
+## What it provides
+
+- **ReviewProvider abstraction** — GitLab client today; other forges plug in behind the same
+  interface.
+- **Orchestrator** — reviewer + auditor agent runs against a disposable worktree of the MR,
+  model selection overridable globally (`reviewModel`) and per project mapping.
+- **Webhook intake** — receives GitLab MR events, enqueues reviews (dedup + retention).
+- **Review findings/history/signals** — findings written through the `review-findings`
+  tool by tool-only review subagents (never free text); history + signals tracked per MR.
+- **Govard/workspace tooling** available inside review runs.
+- **Client half** — settings section rendered into DSH Web slots; notification copy stays
+  here, delivery goes through the optional `maestroNotifier` service.
+
+## Settings
+
+Reads its configuration through the **shared namespaced settings store**
+(`~/.dsh/maestro/settings.json`, owned by `@ddtcorex/dsh-maestro-config-lib`) via the flat
+adapter in `src/config-store.ts`; machine runtime state stays in a package-local sidecar.
+
+## Install
+
+```sh
+dsh plugin --profile web add @ddtcorex/dsh-maestro-review
+# or everything at once:
+dsh plugin --profile web add @ddtcorex/dsh-maestro-meta
+```
+
+## Development
+
+```sh
+pnpm install
+pnpm verify        # tsc --noEmit
+pnpm test          # vitest run
+pnpm build         # tsc -> lib/
+pnpm run build:client   # browser bundle -> lib/client.js (required after client changes)
+```
+
+See AGENTS.md for conventions (host/client split, secrets handling, live-validation rules).
+
+## License
+
+MIT

package/client/settings-card.tsx

@@ -0,0 +1,4 @@
+// Maestro Review — Settings card stub (Client)
+export default function ReviewSettingsCard() {
+  return null
+}

package/lib/config-store.d.ts

@@ -0,0 +1,53 @@
+import type { ReviewSkillProfile } from './skills-tool.js';
+export interface ReviewModelSelection {
+    provider: string;
+    model: string;
+    reasoningEffort?: string;
+}
+export interface MaestroUserConfig {
+    gitlabBaseUrl?: string;
+    gitlabToken?: string;
+    botUsername?: string;
+    webhookSecret?: string;
+    webhookPort?: number;
+    projectMappings?: Array<{
+        projectPath: string;
+        localRepoPath: string;
+        reviewProfile?: ReviewSkillProfile;
+        reviewModel?: ReviewModelSelection;
+    }>;
+    /** Override the DSH default model for automated reviews. When absent the global DSH default is used. */
+    reviewModel?: ReviewModelSelection;
+    /** Re-run a quick review whenever new commits land on a previously reviewed MR. */
+    autoRereviewOnPush?: boolean;
+    /** Bound one automated review agent's turn. */
+    agentTimeoutMs?: number;
+    /** Prune Maestro's own review records older than this many days (0 = keep forever). */
+    reviewSessionRetentionDays?: number;
+    tunnelMode?: 'quick' | 'named';
+    quickTarget?: 'dsh-web' | 'webhook';
+    tunnelId?: string;
+    tunnelCredentialsFile?: string;
+    tunnelHostname?: string;
+    proxyPort?: number;
+    proxyHost?: string;
+    lastTunnelRunning?: boolean;
+    /** Gate LAN access behind a second PIN. Default false — LAN stays open. */
+    lanPinEnabled?: boolean;
+    /** Telegram Bot API credentials for one-way notifications. */
+    telegramBotToken?: string;
+    telegramChatId?: string;
+    /** Also notify this chat when a review finishes. Default false. */
+    telegramReviewNotifications?: boolean;
+}
+/**
+ * Settings live in the SHARED namespaced store (`~/.dsh/maestro/settings.json`,
+ * owned by @ddtcorex/dsh-maestro-config-lib); this store is a thin adapter that
+ * keeps the package's flat `MaestroUserConfig` API while delegating persistence.
+ * Machine runtime state (RUNTIME_KEYS) never enters settings — it stays in this
+ * package's own sidecar so a settings edit can never silently flip tunnel state.
+ */
+export declare function configStorePath(dshHome?: string): string;
+export declare function loadUserConfig(dshHome?: string): Promise<MaestroUserConfig>;
+export declare function saveUserConfig(patch: MaestroUserConfig, dshHome?: string): Promise<MaestroUserConfig>;
+//# sourceMappingURL=config-store.d.ts.map

package/lib/config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAO1D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,kBAAkB,CAAC;QAAC,WAAW,CAAC,EAAE,oBAAoB,CAAA;KAAE,CAAC,CAAA;IAC/I,wGAAwG;IACxG,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,uFAAuF;IACvF,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IAC9B,WAAW,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,mEAAmE;IACnE,2BAA2B,CAAC,EAAE,OAAO,CAAA;CACtC;AAMD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAExD;AAyBD,wBAAsB,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAMjF;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAc3G"}

package/lib/config-store.js

@@ -0,0 +1,60 @@
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { RUNTIME_KEYS, readFlat, writeLegacyPatch, } from '@ddtcorex/dsh-maestro-config-lib';
+function resolveDshHome(dshHome) {
+    return dshHome ?? process.env.DSH_HOME ?? join(homedir(), '.dsh');
+}
+/**
+ * Settings live in the SHARED namespaced store (`~/.dsh/maestro/settings.json`,
+ * owned by @ddtcorex/dsh-maestro-config-lib); this store is a thin adapter that
+ * keeps the package's flat `MaestroUserConfig` API while delegating persistence.
+ * Machine runtime state (RUNTIME_KEYS) never enters settings — it stays in this
+ * package's own sidecar so a settings edit can never silently flip tunnel state.
+ */
+export function configStorePath(dshHome) {
+    return join(resolveDshHome(dshHome), 'maestro', 'settings.json');
+}
+function runtimeStatePath(dshHome) {
+    return join(resolveDshHome(dshHome), 'dsh-maestro-review', 'runtime.json');
+}
+async function readRuntimeState(dshHome) {
+    try {
+        return JSON.parse(await readFile(runtimeStatePath(dshHome), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+async function mergeRuntimeState(patch, dshHome) {
+    const path = runtimeStatePath(dshHome);
+    const merged = { ...(await readRuntimeState(dshHome)), ...patch };
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, JSON.stringify(merged, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    await chmod(path, 0o600);
+}
+export async function loadUserConfig(dshHome) {
+    const [flat, runtime] = await Promise.all([
+        readFlat({ dshHome }),
+        readRuntimeState(dshHome),
+    ]);
+    return { ...flat, ...runtime };
+}
+export async function saveUserConfig(patch, dshHome) {
+    const settingsPatch = {};
+    const runtimePatch = {};
+    for (const [key, value] of Object.entries(patch)) {
+        if (RUNTIME_KEYS.includes(key))
+            runtimePatch[key] = value;
+        else
+            settingsPatch[key] = value;
+    }
+    if (Object.keys(settingsPatch).length > 0) {
+        await writeLegacyPatch(settingsPatch, { dshHome });
+    }
+    if (Object.keys(runtimePatch).length > 0) {
+        await mergeRuntimeState(runtimePatch, dshHome);
+    }
+    return loadUserConfig(dshHome);
+}
+//# sourceMappingURL=config-store.js.map

package/lib/config-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,gBAAgB,GACjB,MAAM,kCAAkC,CAAA;AAwCzC,SAAS,cAAc,CAAC,OAAgB;IACtC,OAAO,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAA;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;AAClE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB;IACxC,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,oBAAoB,EAAE,cAAc,CAAC,CAAA;AAC5E,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAA;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA8B,EAC9B,OAAgB;IAEhB,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAA;IACjE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5D,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1F,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;QACrB,gBAAgB,CAAC,OAAO,CAAC;KAC1B,CAAC,CAAA;IACF,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,EAAuB,CAAA;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAwB,EAAE,OAAgB;IAC7E,MAAM,aAAa,GAA4B,EAAE,CAAA;IACjD,MAAM,YAAY,GAA4B,EAAE,CAAA;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAK,YAAkC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;;YAC3E,aAAa,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACjC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,gBAAgB,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,CAAC,CAAA;AAChC,CAAC"}

package/lib/events.d.ts

@@ -0,0 +1,27 @@
+export interface MrOpenedPayload {
+    projectPath: string;
+    projectId: number;
+    mrIid: number;
+    sourceBranch: string;
+}
+export type ReviewMode = 'quick' | 'deep';
+export type ReviewScope = {
+    kind: 'mr';
+} | {
+    kind: 'discussion';
+    discussionId: string;
+    path: string;
+    line: number;
+};
+export interface ReviewRequest extends MrOpenedPayload {
+    /** `push` arrives only when auto re-review on push is enabled and passes the completed-history gate. */
+    trigger: 'reviewer-assignment' | 'mention' | 'push';
+    mode: ReviewMode;
+    scope: ReviewScope;
+}
+declare module '@deepseek-ai/cordis' {
+    interface Events {
+        'maestro/review-request': (payload: ReviewRequest) => void;
+    }
+}
+//# sourceMappingURL=events.d.ts.map

package/lib/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,CAAA;AAEzC,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,GACd;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAE5E,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,wGAAwG;IACxG,OAAO,EAAE,qBAAqB,GAAG,SAAS,GAAG,MAAM,CAAA;IACnD,IAAI,EAAE,UAAU,CAAA;IAChB,KAAK,EAAE,WAAW,CAAA;CACnB;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd,wBAAwB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAA;KAC3D;CACF"}

package/lib/events.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=events.js.map

package/lib/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":""}

package/lib/gitlab-client.d.ts

@@ -0,0 +1,14 @@
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+export declare const name = "maestro-gitlab-client";
+export declare const inject: string[];
+export interface Config {
+    baseUrl: string;
+    projectId: string | number;
+    mrIid: number;
+    token: string;
+    botUsername: string;
+}
+export declare const Config: z<Config>;
+export declare function apply(ctx: Context, config: Config): void;
+//# sourceMappingURL=gitlab-client.d.ts.map

package/lib/gitlab-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab-client.d.ts","sourceRoot":"","sources":["../src/gitlab-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAGxC,eAAO,MAAM,IAAI,0BAA0B,CAAA;AAC3C,eAAO,MAAM,MAAM,UAAY,CAAA;AAE/B,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAM3B,CAAA;AA0BF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA0IxD"}

package/lib/gitlab-client.js

@@ -0,0 +1,146 @@
+import z from '@deepseek-ai/schemastery';
+import { defineTool } from '@deepseek-ai/dsh-tools';
+export const name = 'maestro-gitlab-client';
+export const inject = ['tools'];
+export const Config = z.object({
+    baseUrl: z.string().required(),
+    projectId: z.union([z.string(), z.number()]).required(),
+    mrIid: z.number().required(),
+    token: z.string().role('secret').required(),
+    botUsername: z.string().required(),
+});
+export function apply(ctx, config) {
+    const apiBase = `${config.baseUrl}/api/v4/projects/${config.projectId}/merge_requests/${config.mrIid}`;
+    const headers = { 'PRIVATE-TOKEN': config.token };
+    let cachedDiffRefs;
+    async function getDiffRefs() {
+        if (cachedDiffRefs !== undefined)
+            return cachedDiffRefs;
+        const response = await fetch(apiBase, { headers });
+        if (!response.ok) {
+            throw new Error(`GitLab API error ${response.status}: ${await response.text()}`);
+        }
+        cachedDiffRefs = (await response.json()).diff_refs;
+        return cachedDiffRefs;
+    }
+    ctx.tools.register(defineTool({
+        name: 'gitlab_get_mr_diff',
+        description: 'Fetch the current unified diff for this merge request.',
+        parameters: {},
+        output: {
+            schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string', required: true } } },
+            render: (_args, value) => [{ type: 'text', text: value.text }],
+        },
+        async execute() {
+            const response = await fetch(`${apiBase}/diffs`, { headers });
+            if (!response.ok) {
+                throw new Error(`GitLab API error ${response.status}: ${await response.text()}`);
+            }
+            const diffs = await response.json();
+            const text = diffs.map(d => `--- ${d.old_path}\n+++ ${d.new_path}\n${d.diff}`).join('\n\n');
+            return { text };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'gitlab_post_mr_comment',
+        description: 'Post a Markdown comment (discussion note) on this merge request.',
+        parameters: {
+            body: { type: 'string', required: true, description: 'Markdown comment body.' },
+        },
+        output: {
+            schema: { type: 'object', additionalProperties: false, properties: { posted: { type: 'boolean', required: true } } },
+            render: () => [{ type: 'text', text: 'Comment posted.' }],
+        },
+        async execute(args) {
+            const response = await fetch(`${apiBase}/notes`, {
+                method: 'POST',
+                headers: { ...headers, 'Content-Type': 'application/json' },
+                body: JSON.stringify({ body: args.body }),
+            });
+            if (!response.ok) {
+                throw new Error(`GitLab API error ${response.status}: ${await response.text()}`);
+            }
+            return { posted: true };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'gitlab_list_own_review_threads',
+        description: 'List this merge request\'s unresolved inline discussion threads previously created by this bot account, so you can reply instead of duplicating.',
+        parameters: {},
+        output: {
+            schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string', required: true } } },
+            render: (_args, value) => [{ type: 'text', text: value.text }],
+        },
+        async execute() {
+            const response = await fetch(`${apiBase}/discussions`, { headers });
+            if (!response.ok) {
+                throw new Error(`GitLab API error ${response.status}: ${await response.text()}`);
+            }
+            const discussions = await response.json();
+            const ownThreads = discussions
+                .filter(d => d.notes.length > 0 && d.notes[0].author.username === config.botUsername && !d.notes[0].resolved && d.notes[0].position !== undefined)
+                .map(d => ({ discussionId: d.id, path: d.notes[0].position.new_path, line: d.notes[0].position.new_line, lastCommentBody: d.notes[d.notes.length - 1].body }));
+            return { text: JSON.stringify(ownThreads) };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'gitlab_post_inline_comment',
+        description: 'Create a new inline discussion at a specific file and line in this merge request\'s current diff.',
+        parameters: {
+            path: { type: 'string', required: true, description: 'File path on the new (target) side of the diff.' },
+            line: { type: 'number', required: true, description: 'Line number on the new (target) side of the diff.' },
+            body: { type: 'string', required: true, description: 'Markdown comment body.' },
+        },
+        output: {
+            schema: { type: 'object', additionalProperties: false, properties: { posted: { type: 'boolean', required: true } } },
+            render: () => [{ type: 'text', text: 'Inline comment posted.' }],
+        },
+        async execute(args) {
+            const diffRefs = await getDiffRefs();
+            const response = await fetch(`${apiBase}/discussions`, {
+                method: 'POST',
+                headers: { ...headers, 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    body: args.body,
+                    position: {
+                        position_type: 'text',
+                        base_sha: diffRefs.base_sha,
+                        start_sha: diffRefs.start_sha,
+                        head_sha: diffRefs.head_sha,
+                        old_path: args.path,
+                        new_path: args.path,
+                        new_line: args.line,
+                    },
+                }),
+            });
+            if (!response.ok) {
+                throw new Error(`GitLab API error ${response.status}: ${await response.text()}`);
+            }
+            return { posted: true };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'gitlab_reply_to_thread',
+        description: 'Reply to an existing inline discussion thread (discussionId from gitlab_list_own_review_threads) without resolving it.',
+        parameters: {
+            discussionId: { type: 'string', required: true },
+            body: { type: 'string', required: true, description: 'Markdown reply body.' },
+        },
+        output: {
+            schema: { type: 'object', additionalProperties: false, properties: { posted: { type: 'boolean', required: true } } },
+            render: () => [{ type: 'text', text: 'Reply posted.' }],
+        },
+        async execute(args) {
+            const response = await fetch(`${apiBase}/discussions/${args.discussionId}/notes`, {
+                method: 'POST',
+                headers: { ...headers, 'Content-Type': 'application/json' },
+                body: JSON.stringify({ body: args.body }),
+            });
+            if (!response.ok) {
+                throw new Error(`GitLab API error ${response.status}: ${await response.text()}`);
+            }
+            return { posted: true };
+        },
+    }));
+}
+//# sourceMappingURL=gitlab-client.js.map

package/lib/gitlab-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab-client.js","sourceRoot":"","sources":["../src/gitlab-client.ts"],"names":[],"mappings":"AACA,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAEnD,MAAM,CAAC,MAAM,IAAI,GAAG,uBAAuB,CAAA;AAC3C,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;AAU/B,MAAM,CAAC,MAAM,MAAM,GAAc,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAA;AA0BF,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAc;IAChD,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,OAAO,oBAAoB,MAAM,CAAC,SAAS,mBAAmB,MAAM,CAAC,KAAK,EAAE,CAAA;IACtG,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;IACjD,IAAI,cAA0C,CAAA;IAE9C,KAAK,UAAU,WAAW;QACxB,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,cAAc,CAAA;QACvD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;QAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAClF,CAAC;QACD,cAAc,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAoC,CAAA,CAAC,SAAS,CAAA;QACnF,OAAO,cAAc,CAAA;IACvB,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,wDAAwD;QACrE,UAAU,EAAE,EAAE;QACd,MAAM,EAAE;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;YACjH,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SAC/D;QACD,KAAK,CAAC,OAAO;YACX,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;YAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAClF,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAkB,CAAA;YACnD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,SAAS,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC3F,OAAO,EAAE,IAAI,EAAE,CAAA;QACjB,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,kEAAkE;QAC/E,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wBAAwB,EAAE;SAChF;QACD,MAAM,EAAE;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;YACpH,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;SAC1D;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,QAAQ,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1C,CAAC,CAAA;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAClF,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QACzB,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,kJAAkJ;QAC/J,UAAU,EAAE,EAAE;QACd,MAAM,EAAE;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;YACjH,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SAC/D;QACD,KAAK,CAAC,OAAO;YACX,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,cAAc,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;YACnE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAClF,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAwB,CAAA;YAC/D,MAAM,UAAU,GAAG,WAAW;iBAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC;iBACjJ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;YAClK,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAA;QAC7C,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,4BAA4B;QAClC,WAAW,EAAE,mGAAmG;QAChH,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,iDAAiD,EAAE;YACxG,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,mDAAmD,EAAE;YAC1G,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wBAAwB,EAAE;SAChF;QACD,MAAM,EAAE;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;YACpH,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;SACjE;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAA;YACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,cAAc,EAAE;gBACrD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE;wBACR,aAAa,EAAE,MAAM;wBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;wBAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;wBAC3B,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,QAAQ,EAAE,IAAI,CAAC,IAAI;qBACpB;iBACF,CAAC;aACH,CAAC,CAAA;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAClF,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QACzB,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,wHAAwH;QACrI,UAAU,EAAE;YACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YAChD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sBAAsB,EAAE;SAC9E;QACD,MAAM,EAAE;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;YACpH,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;SACxD;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,gBAAgB,IAAI,CAAC,YAAY,QAAQ,EAAE;gBAChF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1C,CAAC,CAAA;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAClF,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QACzB,CAAC;KACF,CAAC,CAAC,CAAA;AACL,CAAC"}

package/lib/gitlab-webhook.d.ts

@@ -0,0 +1,17 @@
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+export declare const name = "maestro-gitlab-webhook";
+export interface Config {
+    port: number;
+    /** Username of the GitLab service account used for reviewer assignments. */
+    botUsername?: string;
+    /**
+     * Fallback when Maestro Settings has no webhook secret; optional so a
+     * deployment that configures everything through Settings boots without env
+     * vars. With neither source set, every request is rejected (fail closed).
+     */
+    secret?: string;
+}
+export declare const Config: z<Config>;
+export declare function apply(ctx: Context, config: Config): void;
+//# sourceMappingURL=gitlab-webhook.d.ts.map

package/lib/gitlab-webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab-webhook.d.ts","sourceRoot":"","sources":["../src/gitlab-webhook.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAMxC,eAAO,MAAM,IAAI,2BAA2B,CAAA;AAE5C,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAI3B,CAAA;AAkDF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAyFxD"}

package/lib/gitlab-webhook.js

@@ -0,0 +1,144 @@
+import { createServer } from 'node:http';
+import z from '@deepseek-ai/schemastery';
+import { loadUserConfig } from './config-store.js';
+import { secretsMatch } from './secure-compare.js';
+import { routeGitlabReviewRequest } from './review-intake.js';
+export const name = 'maestro-gitlab-webhook';
+export const Config = z.object({
+    port: z.natural().max(65535).required(),
+    botUsername: z.string(),
+    secret: z.string().role('secret'),
+});
+/** GitLab payloads are small; 5 MB is generous and stops unbounded buffering. */
+const MAX_WEBHOOK_BODY_BYTES = 5 * 1024 * 1024;
+function readBody(req, limit = MAX_WEBHOOK_BODY_BYTES) {
+    return new Promise((resolvePromise) => {
+        let raw = '';
+        let settled = false;
+        req.on('data', (chunk) => {
+            if (settled)
+                return;
+            if (raw.length + chunk.length > limit) {
+                settled = true;
+                req.resume();
+                resolvePromise(undefined);
+                return;
+            }
+            raw += chunk.toString();
+        });
+        req.on('end', () => { if (!settled) {
+            settled = true;
+            resolvePromise(raw);
+        } });
+        req.on('error', () => { if (!settled) {
+            settled = true;
+            resolvePromise(undefined);
+        } });
+    });
+}
+function isValidMrOpenedPayload(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const v = value;
+    return typeof v.projectPath === 'string'
+        && typeof v.projectId === 'number'
+        && typeof v.mrIid === 'number'
+        && typeof v.sourceBranch === 'string';
+}
+function hasValidGitlabMrIdentity(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const body = value;
+    const project = body.project;
+    const attributes = body.object_attributes;
+    const mergeRequest = body.merge_request;
+    const source = body.object_kind === 'note' ? mergeRequest : attributes;
+    return typeof project?.id === 'number' && typeof project.path_with_namespace === 'string'
+        && typeof source?.iid === 'number' && typeof source.source_branch === 'string';
+}
+export function apply(ctx, config) {
+    // Settings wins over the boot secret, re-read per request so a change in the
+    // UI takes effect without a restart. With neither source set, every token
+    // fails the comparison (a header string never equals `undefined`), so the
+    // server stays closed until a secret is configured.
+    let warnedUnconfigured = false;
+    async function requestAuthorized(headerValue) {
+        const userConfig = await loadUserConfig();
+        const expected = userConfig.webhookSecret ?? config.secret;
+        if (expected === undefined) {
+            if (!warnedUnconfigured) {
+                warnedUnconfigured = true;
+                console.error('maestro-gitlab-webhook: no webhook secret configured — set one in Maestro Settings or MAESTRO_GITLAB_WEBHOOK_SECRET; rejecting all requests until then');
+            }
+            return false;
+        }
+        return secretsMatch(headerValue, expected);
+    }
+    const server = createServer((req, res) => {
+        if (req.method !== 'POST') {
+            res.writeHead(404).end();
+            return;
+        }
+        void requestAuthorized(req.headers['x-gitlab-token']).then(async (authorized) => {
+            if (!authorized) {
+                res.writeHead(401).end();
+                return;
+            }
+            readBody(req).then(async (raw) => {
+                if (raw === undefined) {
+                    res.writeHead(413).end();
+                    return;
+                }
+                if (req.url === '/hooks/gitlab-mr/trigger') {
+                    let parsed;
+                    try {
+                        parsed = JSON.parse(raw);
+                    }
+                    catch {
+                        res.writeHead(400).end();
+                        return;
+                    }
+                    if (!isValidMrOpenedPayload(parsed)) {
+                        res.writeHead(400).end();
+                        return;
+                    }
+                    const request = {
+                        ...parsed,
+                        trigger: 'mention',
+                        mode: 'quick',
+                        scope: { kind: 'mr' },
+                    };
+                    ctx.emit('maestro/review-request', request);
+                    res.writeHead(200).end();
+                    return;
+                }
+                if (req.url !== '/hooks/gitlab-mr') {
+                    res.writeHead(404).end();
+                    return;
+                }
+                let body;
+                try {
+                    body = JSON.parse(raw);
+                }
+                catch {
+                    res.writeHead(400).end();
+                    return;
+                }
+                const userConfig = await loadUserConfig();
+                if ((body.object_kind === 'merge_request' || body.object_kind === 'note') && !hasValidGitlabMrIdentity(body)) {
+                    res.writeHead(400).end();
+                    return;
+                }
+                const request = routeGitlabReviewRequest(body, userConfig.botUsername ?? config.botUsername ?? 'maestro', { pushEnabled: userConfig.autoRereviewOnPush === true });
+                if (request !== undefined)
+                    ctx.emit('maestro/review-request', request);
+                res.writeHead(200).end();
+            });
+        });
+    });
+    server.listen(config.port);
+    ctx.effect(() => async () => {
+        await new Promise((resolve) => { server.close(() => resolve()); });
+    }, 'gitlab-webhook teardown');
+}
+//# sourceMappingURL=gitlab-webhook.js.map

package/lib/gitlab-webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab-webhook.js","sourceRoot":"","sources":["../src/gitlab-webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAwB,MAAM,WAAW,CAAA;AAE9D,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAE7D,MAAM,CAAC,MAAM,IAAI,GAAG,wBAAwB,CAAA;AAc5C,MAAM,CAAC,MAAM,MAAM,GAAc,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;CAClC,CAAC,CAAA;AAQF,iFAAiF;AACjF,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAE9C,SAAS,QAAQ,CAAC,GAAoB,EAAE,KAAK,GAAG,sBAAsB;IACpE,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,OAAO;gBAAE,OAAM;YACnB,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBACtC,OAAO,GAAG,IAAI,CAAA;gBACd,GAAG,CAAC,MAAM,EAAE,CAAA;gBACZ,cAAc,CAAC,SAAS,CAAC,CAAA;gBACzB,OAAM;YACR,CAAC;YACD,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;QACzB,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,cAAc,CAAC,GAAG,CAAC,CAAA;QAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9E,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,cAAc,CAAC,SAAS,CAAC,CAAA;QAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;WACnC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;WAC/B,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;WAC3B,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAA;AACzC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,IAAI,GAAG,KAAgC,CAAA;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAA8C,CAAA;IACnE,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAwD,CAAA;IAChF,MAAM,YAAY,GAAG,IAAI,CAAC,aAAoD,CAAA;IAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAA;IACtE,OAAO,OAAO,OAAO,EAAE,EAAE,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,mBAAmB,KAAK,QAAQ;WACpF,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAA;AAClF,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAc;IAChD,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAA;IAC9B,KAAK,UAAU,iBAAiB,CAAC,WAA0C;QACzE,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAA;QACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,aAAa,IAAI,MAAM,CAAC,MAAM,CAAA;QAC1D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,kBAAkB,GAAG,IAAI,CAAA;gBACzB,OAAO,CAAC,KAAK,CAAC,wJAAwJ,CAAC,CAAA;YACzK,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAC5C,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;YACxB,OAAM;QACR,CAAC;QACD,KAAK,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;gBACxB,OAAM;YACR,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;oBACtB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;oBACxB,OAAM;gBACR,CAAC;gBACD,IAAI,GAAG,CAAC,GAAG,KAAK,0BAA0B,EAAE,CAAC;oBAC3C,IAAI,MAAe,CAAA;oBACnB,IAAI,CAAC;wBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBAC1B,CAAC;oBAAC,MAAM,CAAC;wBACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;wBACxB,OAAM;oBACR,CAAC;oBACD,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;wBACpC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;wBACxB,OAAM;oBACR,CAAC;oBACD,MAAM,OAAO,GAAkB;wBAC7B,GAAG,MAAM;wBACT,OAAO,EAAE,SAAS;wBAClB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;qBACtB,CAAA;oBACD,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;oBAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;oBACxB,OAAM;gBACR,CAAC;gBAED,IAAI,GAAG,CAAC,GAAG,KAAK,kBAAkB,EAAE,CAAC;oBACnC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;oBACxB,OAAM;gBACR,CAAC;gBACD,IAAI,IAAyB,CAAA;gBAC7B,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;oBACxB,OAAM;gBACR,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAA;gBACzC,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,eAAe,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7G,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;oBACxB,OAAM;gBACR,CAAC;gBACD,MAAM,OAAO,GAAG,wBAAwB,CACtC,IAAI,EACJ,UAAU,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,IAAI,SAAS,EACzD,EAAE,WAAW,EAAE,UAAU,CAAC,kBAAkB,KAAK,IAAI,EAAE,CACxD,CAAA;gBACD,IAAI,OAAO,KAAK,SAAS;oBAAE,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;gBACtE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;YAC1B,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAE1B,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE;QAC1B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IACzE,CAAC,EAAE,yBAAyB,CAAC,CAAA;AAC/B,CAAC"}

package/lib/govard-tool.d.ts

@@ -0,0 +1,11 @@
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+export declare const name = "maestro-govard-tool";
+export declare const inject: string[];
+export interface Config {
+    rootPath?: string;
+    timeoutMs?: number;
+}
+export declare const Config: z<Config>;
+export declare function apply(ctx: Context, config: Config): void;
+//# sourceMappingURL=govard-tool.d.ts.map

package/lib/govard-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"govard-tool.d.ts","sourceRoot":"","sources":["../src/govard-tool.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAGxC,eAAO,MAAM,IAAI,wBAAwB,CAAA;AACzC,eAAO,MAAM,MAAM,UAAY,CAAA;AAE/B,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAG3B,CAAA;AAqCF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA0DxD"}