@ddtcorex/dsh-maestro-review 0.1.0 → 0.1.2

package/src/host/search-tool.ts

@@ -0,0 +1,153 @@
+import { basename, extname, join, resolve, sep } from 'node:path'
+import { readdir, readFile, realpath } from 'node:fs/promises'
+import type { Context } from '@deepseek-ai/cordis'
+import z from '@deepseek-ai/schemastery'
+import { defineTool } from '@deepseek-ai/dsh-tools'
+
+export const name = 'maestro-search-tool'
+export const inject = ['tools']
+
+export interface Config {
+  rootPath?: string
+}
+
+export const Config: z<Config> = z.object({
+  rootPath: z.string(),
+})
+
+/**
+ * Same root-resolution rule as the workspace tools (parity with
+ * @ddtcorex/dsh-maestro-govard/src/workspace-tool.ts): explicit config wins,
+ * otherwise the calling agent's per-session workspace so review agents search
+ * their own worktree instead of the harness process cwd.
+ */
+interface SessionCwdSource {
+  agent?: { session?: { header?: { cwd?: string } } }
+}
+
+function workspaceRootFor(configuredRoot: string | undefined, exec: unknown): string {
+  if (configuredRoot !== undefined) return configuredRoot
+  const cwd = (exec as SessionCwdSource | undefined)?.agent?.session?.header?.cwd
+  return typeof cwd === 'string' && cwd !== '' ? cwd : process.cwd()
+}
+
+async function isInsideRoot(rootPath: string, target: string): Promise<boolean> {
+  const absoluteRoot = resolve(rootPath)
+  const resolved = resolve(absoluteRoot, target)
+  if (resolved !== absoluteRoot && !resolved.startsWith(absoluteRoot + sep)) return false
+  try {
+    const realRoot = await realpath(absoluteRoot)
+    const realTarget = await realpath(resolved)
+    return realTarget === realRoot || realTarget.startsWith(realRoot + sep)
+  } catch {
+    // Unresolvable paths (broken symlinks etc.) cannot be proven contained.
+    return false
+  }
+}
+
+const SKIP_DIRS = new Set(['.git', 'node_modules'])
+const MAX_FILE_BYTES = 1024 * 1024
+const MAX_FILES = 2000
+const MAX_MATCHES = 50
+
+function globToRegExp(glob: string): RegExp | undefined {
+  if (glob === '' || glob === '*') return undefined
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*\*/g, '\u0000').replace(/\*/g, '[^/]*').replace(/\u0000/g, '.*')
+  return new RegExp(`^${escaped}$`)
+}
+
+/** Bounded recursive walk yielding file paths relative to `dir`. */
+async function* walkFiles(dir: string, base: string, budget: { files: number }): AsyncGenerator<string> {
+  if (budget.files <= 0) return
+  let entries
+  try {
+    entries = await readdir(dir, { withFileTypes: true })
+  } catch {
+    return
+  }
+  for (const entry of entries) {
+    if (budget.files <= 0) return
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name)) continue
+      yield* walkFiles(join(dir, entry.name), base, budget)
+      continue
+    }
+    if (!entry.isFile()) continue
+    budget.files -= 1
+    yield join(dir, entry.name)
+  }
+}
+
+/**
+ * Grep-style content search over the review workspace. Reviewers have no
+ * shell; this is how they verify claims against the actual project sources
+ * (tailwind.config.js extensions/safelist, class usages, block wiring).
+ */
+export function apply(ctx: Context, config: Config = {}): void {
+  const configuredRoot = config.rootPath
+
+  ctx.effect(() => ctx.tools.register(defineTool({
+    name: 'maestro_search_files',
+    description: 'Search file contents under the current workspace root with a regular expression. Returns matching lines as "path:line: text". Use this before claiming something does or does not exist in the codebase.',
+    parameters: {
+      pattern: { type: 'string', required: true, description: 'Regular expression (JavaScript syntax) matched against each line.' },
+      path: { type: 'string', description: 'Optional directory or file prefix, relative to the workspace root.' },
+      glob: { type: 'string', description: 'Optional filename filter, e.g. "*.phtml" or "**/*.css".' },
+    },
+    output: {
+      schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          text: { type: 'string', required: true },
+          truncated: { type: 'boolean', required: true },
+        },
+      },
+      render: (_args, value) => [{ type: 'text', text: value.text }],
+    },
+    async execute(args, exec) {
+      const root = workspaceRootFor(configuredRoot, exec)
+      const requested = args.path ?? ''
+      if (!(await isInsideRoot(root, requested))) {
+        return { text: `Path "${requested}" escapes the workspace root.`, truncated: false } as never
+      }
+      const searchRoot = requested === '' ? root : resolve(root, requested)
+
+      let pattern: RegExp
+      try {
+        pattern = new RegExp(args.pattern)
+      } catch (err) {
+        return { text: `Invalid regular expression: ${err instanceof Error ? err.message : String(err)}`, truncated: false } as never
+      }
+      const nameFilter = args.glob === undefined ? undefined : globToRegExp(args.glob)
+
+      const budget = { files: MAX_FILES }
+      const lines: string[] = []
+      let totalMatched = 0
+      let truncated = false
+      for await (const file of walkFiles(searchRoot, root, budget)) {
+        if (nameFilter !== undefined && !nameFilter.test(basename(file))) continue
+        if (extname(file) === '.zip') continue
+        let content: string
+        try {
+          const stat = await readFile(file)
+          if (stat.byteLength > MAX_FILE_BYTES) continue
+          content = stat.toString('utf-8')
+        } catch {
+          continue
+        }
+        const relative = file.startsWith(root + sep) ? file.slice(root.length + 1) : basename(file)
+        content.split('\n').forEach((row, index) => {
+          if (!pattern.test(row)) return
+          totalMatched += 1
+          if (totalMatched <= MAX_MATCHES) {
+            lines.push(`${relative}:${index + 1}: ${row.trim().slice(0, 240)}`)
+          }
+        })
+      }
+      if (budget.files <= 0 || totalMatched > MAX_MATCHES) truncated = true
+      const header = lines.length === 0 ? `No matches for /${args.pattern}/` : `${lines.length} match(es)${truncated ? ' (truncated)' : ''}:`
+      return { text: [header, ...lines].join('\n'), truncated } as never
+    },
+  }), 'maestro search tool'))
+}

package/src/{settings-rpc.ts → host/settings-rpc.ts}

@@ -1,10 +1,9 @@
 import type { Context } from '@deepseek-ai/cordis'
 import type {} from '@deepseek-ai/dsh-client-connection'
-import type { RpcErrorDetailsMap, RpcResult } from '@deepseek-ai/dsh-host-apiproxy/api'
+import type { RpcErrorDetailsMap, RpcResult } from '@deepseek-ai/dsh-client-connection'
 import { existsSync, statSync } from 'node:fs'
 import { loadUserConfig, saveUserConfig, type MaestroUserConfig } from './config-store.js'
 import { listReviews } from './review-history.js'
-import { readPin, rotatePin, readLanPin, rotateLanPin } from './pin-store.js'
 import { pinRotationText, type NotifierLike } from './notify.js'
 
 export const name = 'maestro-settings-rpc'
@@ -13,7 +12,7 @@ export const inject = ['connection', 'maestroTunnel']
 /** Keys the Settings card may persist; anything else is a rejected save. */
 const SAVABLE_KEYS = new Set<keyof MaestroUserConfig>([
   'gitlabBaseUrl', 'gitlabToken', 'botUsername', 'webhookSecret', 'webhookPort',
-  'projectMappings', 'reviewModel', 'autoRereviewOnPush', 'agentTimeoutMs', 'reviewSessionRetentionDays',
+  'projectMappings', 'reviewModel', 'supervisorModel', 'autoRereviewOnPush', 'agentTimeoutMs', 'reviewSessionRetentionDays',
   'tunnelMode', 'quickTarget', 'tunnelId', 'tunnelCredentialsFile', 'tunnelHostname',
   'proxyPort', 'proxyHost', 'lanPinEnabled', 'telegramBotToken', 'telegramChatId',
   'telegramReviewNotifications',
@@ -87,6 +86,14 @@ function validateSavePayload(payload: unknown): { ok: true; patch: Partial<Maest
       const err = validateReviewModel(value)
       if (err !== null) return { ok: false, message: err }
     }
+    if (key === 'supervisorModel') {
+      if (value === null) {
+        patch[key as keyof MaestroUserConfig] = undefined as never
+        continue
+      }
+      const err = validateReviewModel(value)
+      if (err !== null) return { ok: false, message: err.replace('reviewModel', 'supervisorModel') }
+    }
     if (key === 'webhookPort' && value !== undefined && (typeof value !== 'number' || !Number.isInteger(value) || value < 1 || value > 65535)) {
       return { ok: false, message: 'webhookPort must be an integer between 1 and 65535.' }
     }
@@ -165,10 +172,10 @@ export function apply(ctx: Context): void {
       return ok(ctx.maestroTunnel.proxyStatus())
     }
     if (endpoint === MAESTRO_ENDPOINTS.getPin) {
-      return ok({ pin: await readPin() })
+      return ok({ pin: await ctx.maestroTunnel.getPin() })
     }
     if (endpoint === MAESTRO_ENDPOINTS.rotatePin) {
-      const pin = await rotatePin()
+      const pin = await ctx.maestroTunnel.rotatePin()
       // Delivery is deliberately detached: a slow/unavailable notifier cannot make the
       // explicit security operation appear to fail or hold the Settings UI open.
       void loadUserConfig().then((config) => {
@@ -196,7 +203,7 @@ export function apply(ctx: Context): void {
       // Disabled by default; the LAN PIN is only read (and generated) once the
       // user opts in, so an untouched install keeps LAN access open.
       if (config.lanPinEnabled !== true) return ok({ enabled: false })
-      return ok({ enabled: true, pin: await readLanPin() })
+      return ok({ enabled: true, pin: await ctx.maestroTunnel.getLanPin() })
     }
     if (endpoint === MAESTRO_ENDPOINTS.lanPinSetEnabled) {
       const enabled = (payload as { enabled?: unknown } | undefined)?.enabled === true
@@ -207,7 +214,7 @@ export function apply(ctx: Context): void {
       return ok({ enabled })
     }
     if (endpoint === MAESTRO_ENDPOINTS.lanPinRotate) {
-      return ok({ pin: await rotateLanPin() })
+      return ok({ pin: await ctx.maestroTunnel.rotateLanPin() })
     }
     if (endpoint === MAESTRO_ENDPOINTS.reviewsList) {
       return ok(await listReviews(20))
@@ -220,15 +227,44 @@ export function apply(ctx: Context): void {
     if (endpoint === MAESTRO_ENDPOINTS.modelsList) {
       const agentDefaultModel = ctx.get('agentDefaultModel') as { currentSelection(): { provider: string; model: string; reasoningEffort?: string } } | undefined
       const fallbackSelection = agentDefaultModel?.currentSelection() ?? { provider: 'deepseek-official', model: 'deepseek-chat' }
-      const llm = ctx.get('llm') as { listProviders?: () => Array<{ id: string; name: string }>; listModels?: (provider: string) => Promise<Array<{ id: string; name?: string }>> } | undefined
+      type LlmReasoningEffort = { id: string; name: string }
+      type LlmModelInfoWithReasoning = { id: string; name?: string; reasoning?: { efforts: LlmReasoningEffort[] } }
+      const llm = ctx.get('llm') as {
+        listProviders?: () => Array<{ id: string; name: string }>
+        listModels?: (provider: string) => Promise<readonly LlmModelInfoWithReasoning[]>
+        resolveModelInfo?: (provider: string, model: string) => Promise<LlmModelInfoWithReasoning & { reasoning?: { efforts: LlmReasoningEffort[] } }>
+      } | undefined
       if (llm?.listProviders !== undefined && llm?.listModels !== undefined) {
         try {
           const providers = llm.listProviders()
-          const groups: Array<{ provider: string; name: string; models: string[] }> = []
+          const groups: Array<{ provider: string; name: string; models: Array<{ id: string; name?: string; supportsReasoning: boolean; reasoningEfforts: string[]; reasoning?: { efforts: LlmReasoningEffort[] } }> }> = []
           for (const p of providers) {
             try {
               const models = await llm.listModels(p.id)
-              groups.push({ provider: p.id, name: p.name, models: models.map(m => m.id) })
+              const enriched = await Promise.all(models.map(async (m) => {
+                let efforts: string[] = (m as LlmModelInfoWithReasoning).reasoning?.efforts?.map(e => e.id) ?? []
+                let reasoningObj = (m as LlmModelInfoWithReasoning).reasoning
+                if (efforts.length === 0 && typeof llm.resolveModelInfo === 'function') {
+                  try {
+                    const resolved = await llm.resolveModelInfo(p.id, m.id)
+                    if (resolved?.reasoning?.efforts) {
+                      reasoningObj = resolved.reasoning
+                      efforts = resolved.reasoning.efforts.map(e => e.id)
+                    }
+                  } catch {
+                    // ignore resolve failures, keep original
+                  }
+                }
+                const supportsReasoning = efforts.filter(e => e !== 'off').length > 0
+                return {
+                  id: m.id,
+                  name: m.name,
+                  supportsReasoning,
+                  reasoningEfforts: efforts,
+                  ...(reasoningObj ? { reasoning: reasoningObj } : {}),
+                }
+              }))
+              groups.push({ provider: p.id, name: p.name, models: enriched })
             } catch {
               groups.push({ provider: p.id, name: p.name, models: [] })
             }
@@ -239,7 +275,14 @@ export function apply(ctx: Context): void {
         }
       }
       // Fallback: single group containing the current selection so dropdown still works
-      return ok({ groups: [{ provider: fallbackSelection.provider, name: fallbackSelection.provider, models: [fallbackSelection.model] }], current: fallbackSelection })
+      return ok({
+        groups: [{
+          provider: fallbackSelection.provider,
+          name: fallbackSelection.provider,
+          models: [{ id: fallbackSelection.model, name: fallbackSelection.model, supportsReasoning: false, reasoningEfforts: [] }],
+        }],
+        current: fallbackSelection,
+      })
     }
     return fail(`Unknown endpoint: ${endpoint}`)
   }

package/src/{skills-tool.ts → host/skills-tool.ts}

@@ -16,6 +16,10 @@ export const REVIEW_PROFILE_SKILLS: Record<ReviewSkillProfile, readonly string[]
     'govard-toolbox',
     'govard-magento',
     'magento2-dev-core',
+    // Frontend passes: without these a Hyvä/Tailwind MR is reviewed on model
+    // priors alone (utility-class claims were unverifiable and wrong in practice).
+    'magento2-frontend-dev',
+    'magento2-hyva-dev',
     'magento2-code-review',
     'magento2-linter',
     'magento2-security-scan',
@@ -25,7 +29,7 @@ export const REVIEW_PROFILE_SKILLS: Record<ReviewSkillProfile, readonly string[]
   generic: [],
 }
 
-export const MAESTRO_SKILLS_INSTALL_COMMAND = 'curl -fsSL https://raw.githubusercontent.com/ddtcorex/maestro-skills/master/install.sh | bash -s -- --scope personal --target dsh --skills govard-toolbox,govard-magento,magento2-dev-core,magento2-code-review,magento2-linter,magento2-security-scan,magento2-performance-audit -y'
+export const MAESTRO_SKILLS_INSTALL_COMMAND = 'curl -fsSL https://raw.githubusercontent.com/ddtcorex/maestro-skills/master/install.sh | bash -s -- --scope personal --target dsh --skills govard-toolbox,govard-magento,magento2-dev-core,magento2-frontend-dev,magento2-hyva-dev,magento2-code-review,magento2-linter,magento2-security-scan,magento2-performance-audit -y'
 
 // This is deliberately process-local and keyed by the reviewer Agent object,
 // which every Cordis child context inherits. Preset mounting inserts child

package/src/host/tdd-evidence-tool.ts

@@ -0,0 +1,85 @@
+import { resolve, sep } from 'node:path'
+import { readFile, stat, realpath } from 'node:fs/promises'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import type { Context } from '@deepseek-ai/cordis'
+import { defineTool } from '@deepseek-ai/dsh-tools'
+import z from '@deepseek-ai/schemastery'
+
+export const name='maestro-tdd-evidence-tool'
+export const inject=['tools']
+export const Config:z<{rootPath?:string}> = z.object({rootPath:z.string()})
+interface SC{agent?:{session?:{header?:{cwd?:string}}}}
+function workspaceRootFor(c:string|undefined,e:unknown):string{ if(c!==undefined) return c; const cwd=(e as SC|undefined)?.agent?.session?.header?.cwd; return typeof cwd==='string'&&cwd!==''?cwd:process.cwd()}
+async function isInsideRoot(r:string,t:string):Promise<boolean>{
+  const ar=resolve(r); const rs=resolve(ar,t)
+  if(rs!==ar && !rs.startsWith(ar+sep)) return false
+  try{ const rr=await realpath(ar); const rt=await realpath(rs); return rt===rr||rt.startsWith(rr+sep)}catch{
+    try{ const rr=await realpath(ar); const parent=resolve(rs,'..'); const rp=await realpath(parent); return rp===rr||rp.startsWith(rr+sep)}catch{ return rs===ar || rs.startsWith(ar+sep) }
+  }
+}
+const execFileAsync=promisify(execFile)
+
+export function apply(ctx:Context, config:{rootPath?:string}={}):void{
+  const configuredRoot=config.rootPath
+  // simple in-memory red evidence store per process
+  const redEvidence=new Set<string>()
+  ctx.effect(()=>ctx.tools.register(defineTool({
+    name:'maestro_tdd_evidence',
+    description:'Capture TDD evidence: red (failing test), green (passing), verify (pnpm verify). Enforces red-before-green.',
+    parameters:{
+      op:{type:'string', enum:['red','green','verify'], required:true},
+      testFile:{type:'string'},
+      evidence:{type:'string'},
+    },
+    output:{
+      schema:{
+        type:'object', additionalProperties:true,
+        properties:{
+          ok:{type:'boolean', required:true},
+          phase:{type:'string'},
+          error:{type:'string'},
+          verify:{type:'object', additionalProperties:true},
+        }
+      },
+      render:(_a,v:{ok:boolean, error?:string})=>[{type:'text', text: v.ok? 'ok' : (v.error ?? 'error')}],
+    },
+    async execute(args, exec){
+      const op=(args as {op:string}).op
+      const rawTest=(args as {testFile?:string}).testFile
+      const root=workspaceRootFor(configuredRoot, exec)
+      if(rawTest && !(await isInsideRoot(root, rawTest))) return {text:`Path "${rawTest}" escapes the workspace root.`, truncated:false} as never
+      if(op==='red'){
+        if(!rawTest) return {text:'testFile required for red', truncated:false} as never
+        const abs=resolve(root, rawTest)
+        try{ const s=await stat(abs); if(!s.isFile()) return {ok:false, phase:'red', error:'test file not found'} as never }catch{ return {ok:false, phase:'red', error:'test file not found'} as never }
+        const content=await readFile(abs,'utf-8').catch(()=>'')
+        // red evidence is that file contains failing expectation (throw, expect fail, etc.)
+        redEvidence.add(rawTest)
+        return {ok:true, phase:'red', testFile: rawTest, evidence: content.slice(0,500), redEvidenceSize: redEvidence.size} as never
+      }
+      if(op==='green'){
+        if(!rawTest) return {text:'testFile required for green', truncated:false} as never
+        if(!redEvidence.has(rawTest)){
+          // also check file exists? If not in redEvidence, error must contain 'red'
+          return {ok:false, phase:'green', error:'red evidence required before green — run op:red first'} as never
+        }
+        const abs=resolve(root, rawTest)
+        try{ await stat(abs) }catch{ return {ok:false, phase:'green', error:'test file not found'} as never }
+        return {ok:true, phase:'green', testFile: rawTest} as never
+      }
+      if(op==='verify'){
+        // try to run pnpm verify -- if not available, return ok false but with verify object
+        try{
+          const {stdout}=await execFileAsync('pnpm', ['verify'], {cwd:root, timeout:30000}) as any
+          return {ok:true, phase:'verify', verify:{passed:true, output: String(stdout).slice(0,2000)}} as never
+        }catch(e:any){
+          const out=(e.stdout ?? '') + (e.stderr ?? '') + String(e.message)
+          const passed=out.includes('Tests') && !out.includes('FAIL')
+          return {ok:passed, phase:'verify', verify:{passed, output: out.slice(0,2000)}, error: passed? undefined : 'verify failed'} as never
+        }
+      }
+      return {text:`unknown op ${op}`, truncated:false} as never
+    }
+  }), 'tdd evidence'))
+}

package/src/host/tool-policy.ts

@@ -0,0 +1,49 @@
+import type { Context } from '@deepseek-ai/cordis'
+import type { PreToolDecision, ToolExecution } from '@deepseek-ai/dsh-tools'
+
+export const name = 'maestro-review-tool-policy'
+
+/**
+ * Host-level tools that leak into every agent but make no sense for a review
+ * agent: review sessions must stay read-only on the worktree and side-effect
+ * free on the harness (no personal memory writes, no todo lists, no plugin
+ * marketplace suggestions, no sidebar UI, no nested subagents).
+ *
+ * Deny-listed rather than allow-listed on purpose: DSH has no per-agent tool
+ * scoping yet, and a reviewer genuinely needs the shared search/read/gitlab
+ * surface — an allow-list would break on every new host capability.
+ */
+export const REVIEW_DENIED_TOOLS: readonly string[] = [
+  'memory',
+  'memory_suggest',
+  'dtodo',
+  'find_dsh_plugin',
+  'sidebar_open',
+  'subagent_claude_code',
+  'subagent_codex',
+  'maestro_write_file',
+]
+
+/** Pure predicate: returns the denial reason for denied tools, else undefined. */
+export function deniedToolForReview(toolName: string): string | undefined {
+  if (!REVIEW_DENIED_TOOLS.includes(toolName)) return undefined
+  return `Tool "${toolName}" is not available to Maestro review agents: reviews stay read-only on the worktree and side-effect free on the harness.`
+}
+
+export function createReviewToolPolicyHandler(): (
+  exec: ToolExecution,
+  next: () => Promise<PreToolDecision>,
+) => Promise<PreToolDecision> {
+  return async (exec, next) => {
+    const toolName = exec.name ?? ''
+    const reason = deniedToolForReview(toolName)
+    if (reason !== undefined) return { kind: 'deny', reason }
+    return next()
+  }
+}
+
+/** Agent-scoped: register inside an agent setup fiber so the policy dies with that agent. */
+export function apply(ctx: Context): void {
+  const handler = createReviewToolPolicyHandler()
+  ctx.effect(() => ctx.on('tools/pre-execute', handler))
+}

package/src/{workspace-tool.ts → host/workspace-tool.ts}

@@ -47,10 +47,28 @@ async function resolveInRoot(rootPath: string, requestedPath: string): Promise<s
   }
 }
 
+/**
+ * Structural view of the tool run-context fields this tool needs. Mirrors the
+ * `@deepseek-ai/dsh-tool-fs` session-cwd semantics: without an explicit pinned
+ * root, relative paths resolve against the CALLING agent's per-session
+ * workspace (`exec.agent.session.header.cwd`), so subagents whose session
+ * lives in a checkout or review worktree read their own tree instead of the
+ * harness host's `process.cwd()`.
+ */
+interface SessionCwdSource {
+  agent?: { session?: { header?: { cwd?: string } } }
+}
+
+function workspaceRootFor(configuredRoot: string | undefined, exec: unknown): string {
+  if (configuredRoot !== undefined) return configuredRoot
+  const cwd = (exec as SessionCwdSource | undefined)?.agent?.session?.header?.cwd
+  return typeof cwd === 'string' && cwd !== '' ? cwd : process.cwd()
+}
+
 export function apply(ctx: Context, config: Config = {}): void {
-  const rootPath = config.rootPath ?? process.cwd()
+  const configuredRoot = config.rootPath
 
-  ctx.tools.register(defineTool({
+  ctx.effect(() => ctx.tools.register(defineTool({
     name: 'maestro_read_file',
     description: 'Read a text file relative to the current workspace root.',
     parameters: {
@@ -60,15 +78,15 @@ export function apply(ctx: Context, config: Config = {}): void {
       schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string', required: true } } },
       render: (_args, value) => [{ type: 'text', text: value.text }],
     },
-    async execute(args) {
-      const target = await resolveInRoot(rootPath, args.path)
+    async execute(args, exec) {
+      const target = await resolveInRoot(workspaceRootFor(configuredRoot, exec), args.path)
       if (target === undefined) return { isError: true, text: `Path "${args.path}" escapes the workspace root.` } as never
       const text = await readFile(target, 'utf-8')
       return { text }
     },
-  }))
+  })))
 
-  ctx.tools.register(defineTool({
+  ctx.effect(() => ctx.tools.register(defineTool({
     name: 'maestro_write_file',
     description: 'Write a text file relative to the current workspace root, creating parent directories as needed.',
     parameters: {
@@ -79,12 +97,12 @@ export function apply(ctx: Context, config: Config = {}): void {
       schema: { type: 'object', additionalProperties: false, properties: { written: { type: 'boolean', required: true } } },
       render: (args) => [{ type: 'text', text: `Wrote ${args.path}` }],
     },
-    async execute(args) {
-      const target = await resolveInRoot(rootPath, args.path)
+    async execute(args, exec) {
+      const target = await resolveInRoot(workspaceRootFor(configuredRoot, exec), args.path)
       if (target === undefined) return { isError: true, text: `Path "${args.path}" escapes the workspace root.` } as never
       await mkdir(dirname(target), { recursive: true })
       await writeFile(target, args.content, 'utf-8')
       return { written: true }
     },
-  }))
+  })))
 }

package/lib/pin-store.d.ts

@@ -1,5 +0,0 @@
-export declare function readPin(): Promise<string>;
-export declare function rotatePin(): Promise<string>;
-export declare function readLanPin(): Promise<string>;
-export declare function rotateLanPin(): Promise<string>;
-//# sourceMappingURL=pin-store.d.ts.map

package/lib/pin-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pin-store.d.ts","sourceRoot":"","sources":["../src/pin-store.ts"],"names":[],"mappings":"AAAA,wBAAsB,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAsB;AACtE,wBAAsB,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAAsB;AACxE,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAAsB;AACzE,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAAsB"}

package/lib/pin-store.js

@@ -1,5 +0,0 @@
-export async function readPin() { return '00000000'; }
-export async function rotatePin() { return '00000000'; }
-export async function readLanPin() { return '00000000'; }
-export async function rotateLanPin() { return '00000000'; }
-//# sourceMappingURL=pin-store.js.map

package/lib/pin-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pin-store.js","sourceRoot":"","sources":["../src/pin-store.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,KAAK,UAAU,OAAO,KAAsB,OAAO,UAAU,CAAA,CAAC,CAAC;AACtE,MAAM,CAAC,KAAK,UAAU,SAAS,KAAsB,OAAO,UAAU,CAAA,CAAC,CAAC;AACxE,MAAM,CAAC,KAAK,UAAU,UAAU,KAAsB,OAAO,UAAU,CAAA,CAAC,CAAC;AACzE,MAAM,CAAC,KAAK,UAAU,YAAY,KAAsB,OAAO,UAAU,CAAA,CAAC,CAAC"}

package/src/pin-store.ts

@@ -1,4 +0,0 @@
-export async function readPin(): Promise<string> { return '00000000' }
-export async function rotatePin(): Promise<string> { return '00000000' }
-export async function readLanPin(): Promise<string> { return '00000000' }
-export async function rotateLanPin(): Promise<string> { return '00000000' }