@ddtcorex/dsh-maestro-review 0.1.0

package/lib/workspace-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-tool.d.ts","sourceRoot":"","sources":["../src/workspace-tool.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAGxC,eAAO,MAAM,IAAI,2BAA2B,CAAA;AAC5C,eAAO,MAAM,MAAM,UAAY,CAAA;AAE/B,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAE3B,CAAA;AAkCF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,MAAW,GAAG,IAAI,CAwC7D"}

package/lib/workspace-tool.js

@@ -0,0 +1,86 @@
+import { basename, dirname, resolve, sep } from 'node:path';
+import { mkdir, readFile, realpath, writeFile } from 'node:fs/promises';
+import z from '@deepseek-ai/schemastery';
+import { defineTool } from '@deepseek-ai/dsh-tools';
+export const name = 'maestro-workspace-tool';
+export const inject = ['tools'];
+export const Config = z.object({
+    rootPath: z.string(),
+});
+async function resolveInRoot(rootPath, requestedPath) {
+    const absoluteRoot = resolve(rootPath);
+    const target = resolve(absoluteRoot, requestedPath);
+    if (target !== absoluteRoot && !target.startsWith(absoluteRoot + sep))
+        return undefined;
+    let realRoot;
+    try {
+        realRoot = await realpath(absoluteRoot);
+    }
+    catch {
+        return undefined;
+    }
+    let existing = target;
+    const pending = [];
+    while (true) {
+        let real;
+        try {
+            real = await realpath(existing);
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                return undefined;
+            const parent = dirname(existing);
+            if (parent === existing)
+                return undefined;
+            pending.unshift(basename(existing));
+            existing = parent;
+            continue;
+        }
+        const realTarget = pending.length > 0 ? resolve(real, ...pending) : real;
+        if (realTarget !== realRoot && !realTarget.startsWith(realRoot + sep))
+            return undefined;
+        return target;
+    }
+}
+export function apply(ctx, config = {}) {
+    const rootPath = config.rootPath ?? process.cwd();
+    ctx.tools.register(defineTool({
+        name: 'maestro_read_file',
+        description: 'Read a text file relative to the current workspace root.',
+        parameters: {
+            path: { type: 'string', required: true, description: 'Path relative to the workspace root.' },
+        },
+        output: {
+            schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string', required: true } } },
+            render: (_args, value) => [{ type: 'text', text: value.text }],
+        },
+        async execute(args) {
+            const target = await resolveInRoot(rootPath, args.path);
+            if (target === undefined)
+                return { isError: true, text: `Path "${args.path}" escapes the workspace root.` };
+            const text = await readFile(target, 'utf-8');
+            return { text };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'maestro_write_file',
+        description: 'Write a text file relative to the current workspace root, creating parent directories as needed.',
+        parameters: {
+            path: { type: 'string', required: true, description: 'Path relative to the workspace root.' },
+            content: { type: 'string', required: true, description: 'File content to write.' },
+        },
+        output: {
+            schema: { type: 'object', additionalProperties: false, properties: { written: { type: 'boolean', required: true } } },
+            render: (args) => [{ type: 'text', text: `Wrote ${args.path}` }],
+        },
+        async execute(args) {
+            const target = await resolveInRoot(rootPath, args.path);
+            if (target === undefined)
+                return { isError: true, text: `Path "${args.path}" escapes the workspace root.` };
+            await mkdir(dirname(target), { recursive: true });
+            await writeFile(target, args.content, 'utf-8');
+            return { written: true };
+        },
+    }));
+}
+//# sourceMappingURL=workspace-tool.js.map

package/lib/workspace-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-tool.js","sourceRoot":"","sources":["../src/workspace-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEvE,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAEnD,MAAM,CAAC,MAAM,IAAI,GAAG,wBAAwB,CAAA;AAC5C,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;AAM/B,MAAM,CAAC,MAAM,MAAM,GAAc,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAA;AAEF,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,aAAqB;IAClE,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;IACnD,IAAI,MAAM,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAEvF,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,QAAQ,GAAG,MAAM,CAAA;IACrB,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAA;YACtE,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;YAChC,IAAI,MAAM,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAA;YACzC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;YACnC,QAAQ,GAAG,MAAM,CAAA;YACjB,SAAQ;QACV,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACxE,IAAI,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC;YAAE,OAAO,SAAS,CAAA;QACvF,OAAO,MAAM,CAAA;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAAiB,EAAE;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IAEjD,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,0DAA0D;QACvE,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE;SAC9F;QACD,MAAM,EAAE;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;YACjH,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SAC/D;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YACvD,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,+BAA+B,EAAW,CAAA;YACpH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAC5C,OAAO,EAAE,IAAI,EAAE,CAAA;QACjB,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,kGAAkG;QAC/G,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE;YAC7F,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wBAAwB,EAAE;SACnF;QACD,MAAM,EAAE;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;YACrH,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;SACjE;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YACvD,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,+BAA+B,EAAW,CAAA;YACpH,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACjD,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAC1B,CAAC;KACF,CAAC,CAAC,CAAA;AACL,CAAC"}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@ddtcorex/dsh-maestro-review",
+  "version": "0.1.0",
+  "description": "Maestro Review — pluggable ReviewProvider (GitLab/GitHub) + orchestrator for automated MR review",
+  "type": "module",
+  "main": "./lib/index.js",
+  "types": "./lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js",
+    "./lib/*": "./lib/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "README.md",
+    "lib",
+    "src",
+    "presets",
+    "client"
+  ],
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-client-connection": "^0.1.1-rc.2"
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "^3.0.0",
+    "@ddtcorex/dsh-maestro-config-lib": "^0.1.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "typescript": "^5.8.0",
+    "vitest": "^2.0.0",
+    "@types/node": "^22.0.0",
+    "@deepseek-ai/dsh-agent": "0.1.0-rc.8",
+    "@deepseek-ai/dsh-agent-default-model": "0.1.0-rc.8",
+    "@deepseek-ai/dsh-agent-presets": "0.1.0-rc.8",
+    "@deepseek-ai/dsh-host-apiproxy": "0.1.0-rc.8",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.8",
+    "@deepseek-ai/dsh-session": "0.1.0-rc.8",
+    "@deepseek-ai/dsh-session-title": "0.1.0-rc.8",
+    "@deepseek-ai/dsh-subagent": "0.1.0-rc.8",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.8"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "verify": "tsc --noEmit"
+  }
+}

package/presets/maestro-auditor/agent.cordis.yml

@@ -0,0 +1,10 @@
+- id: persona
+  name: '@deepseek-ai/dsh-persona'
+  config:
+    text: |
+      You are Maestro Auditor, a Performance Architect. Workflow:
+      1. Call govard_env_up to bring up the merge request's Magento 2 environment.
+      2. Call govard_shell to run the test suite (e.g. "vendor/bin/phpunit") and any profiling commands.
+      3. Analyze the output for regressions, N+1 queries, or memory issues.
+      4. Call govard_env_down to tear the environment down.
+      5. Output a Markdown report. Do not call gitlab_post_mr_comment yourself — the orchestrator posts the combined report.

package/presets/maestro-auditor/preset.yml

@@ -0,0 +1,2 @@
+name: Maestro Auditor
+description: Automated Performance Architect that profiles a GitLab merge request's Magento 2 environment via Govard. Invoked programmatically by dsh-maestro-review's orchestrator — not meant for manual selection.

package/presets/maestro-coder/agent.cordis.yml

@@ -0,0 +1,223 @@
+# Non-persona rows below are copied from maestro-skills/.dsh-plugin/agent.cordis.yml
+# (formerly agent-dev-skills), which is itself derived from DeepSeek Harness's
+# `standard` preset (MIT License, Copyright (c) 2026 DeepSeek). Attribution
+# retained per MIT license requirements.
+
+- id: agent-instructions
+  name: '@deepseek-ai/dsh-agent-instructions'
+  config:
+    maxBytes: 65536
+
+# ── shell ───────────────────────────────────────────────────────────────────
+
+# `shell-env` stays in the HOST composition: it publishes host-level env vars
+# before any session exists, so there is no agent to key it by. Both shell
+# tools here consume the host registry; their executors (`bash-sandbox`/
+# `pwsh-sandbox`) are host-plane too.
+- id: tool-bash
+  name: '@deepseek-ai/dsh-tool-bash'
+  disabled: !!js process.platform === 'win32'
+
+- id: tool-pwsh
+  name: '@deepseek-ai/dsh-tool-pwsh'
+  disabled: !!js process.platform !== 'win32'
+
+# ── filesystem ──────────────────────────────────────────────────────────────
+
+# Both register into the host `tools` registry and provide nothing, so
+# they need no realm. The `fs` service and its policy stay in the host.
+- id: tool-fs
+  name: '@deepseek-ai/dsh-tool-fs'
+
+- id: tool-fs-search
+  name: '@deepseek-ai/dsh-tool-fs-search'
+  config:
+    sampleOverCapGlobResults: false
+
+# ── background jobs ────────────────────────────────────────────────────────
+
+# Only the model-facing controls. The task registry stays on the host plane
+# and is keyed by owning agent, so one host instance serves every session;
+# what this preset chooses is whether its agent can use `run_in_background`.
+- id: tool-jobs
+  name: '@deepseek-ai/dsh-tool-jobs'
+
+# ── skills ──────────────────────────────────────────────────────────────────
+
+# The skill registry lives in the host composition and is layered per scope,
+# so these rows register into this preset's layer without needing a realm.
+# skill-filesystem scans ~/.dsh/skills/ by default. Install maestro-skills
+# (plugin or installer) for DSH; this package's install.sh validates the Magento
+# review set.
+- id: skill-filesystem
+  name: '@deepseek-ai/dsh-skill-filesystem'
+
+- id: tool-skill
+  name: '@deepseek-ai/dsh-tool-skill'
+
+# ── goals ───────────────────────────────────────────────────────────────────
+
+# Only the model-facing tool. The goal service, its session driver, and the
+# `/goal` command stay on the host plane and are keyed by session, so what
+# this preset chooses is whether its agent can call the goal tool.
+- id: tool-goal
+  name: '@deepseek-ai/dsh-tool-goal'
+
+# ── plan mode ───────────────────────────────────────────────────────────────
+
+- id: planning
+  name: cordis:group
+  group: true
+  isolate:
+    planMode: true
+  config:
+    - id: plan-mode
+      name: '@deepseek-ai/dsh-plan-mode'
+      config:
+        section: |
+          You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+          Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+
+          The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed to keep the tool catalog unchanged. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.
+
+          Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.
+
+          Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+
+          When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+
+# ── compaction ──────────────────────────────────────────────────────────────
+
+# `compaction-basic` reads `toolResultPrune` through `ctx.get`, so the pruner
+# must share this realm rather than sit outside it. `tokenMeter` is
+# deliberately NOT in this realm: the meter stays on the HOST plane, keyed by
+# Session, so what this preset chooses is only whether its agent compacts.
+- id: compaction
+  name: cordis:group
+  group: true
+  isolate:
+    compaction: true
+    toolResultPruner: true
+  config:
+    - id: compaction-basic
+      name: '@deepseek-ai/dsh-compaction-basic'
+
+    - id: command-compact
+      name: '@deepseek-ai/dsh-command-compact'
+
+    - id: tool-result-pruner
+      name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+      config:
+        thresholdChars: 8192
+        headChars: 4096
+        tailChars: 1024
+
+# ── delegation and workflows ────────────────────────────────────────────────
+
+# The `subagents` registry and its spawn/fork backends live in the HOST
+# composition: it's a process singleton, and this preset contributes only the
+# delegation TOOLS that resolve that registry. `workflows` is different —
+# nothing outside an agent reads it — so every row reaching it shares this
+# one entry-local realm.
+- id: delegation
+  name: cordis:group
+  group: true
+  isolate:
+    workflowEngine: true
+  config:
+    - id: tool-subagent-control
+      name: '@deepseek-ai/dsh-tool-subagent-control'
+
+    - id: tool-subagent-list-agents
+      name: '@deepseek-ai/dsh-tool-subagent-control/list-agents'
+
+    - id: tool-subagent
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: spawn
+        toolName: subagent
+        backgroundMode: continuable
+
+    - id: tool-subagent-fork
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: fork
+        toolName: subagent_fork
+        backgroundMode: continuable
+
+    # Production dsh does not install these optional providers. Install the
+    # matching Bundle in this Profile and restart the Host, then copy this
+    # preset and remove `disabled` from the matching tool row. Host
+    # availability alone grants no tool.
+    - id: tool-subagent-codex
+      name: '@deepseek-ai/dsh-tool-subagent'
+      disabled: true
+      config:
+        provider: codex
+        toolName: subagent_codex
+        backgroundMode: one-shot
+        maxDepth: provider-managed
+
+    - id: tool-subagent-claude-code
+      name: '@deepseek-ai/dsh-tool-subagent'
+      disabled: true
+      config:
+        provider: claude-code
+        toolName: subagent_claude_code
+        backgroundMode: one-shot
+        maxDepth: provider-managed
+
+    - id: workflow-worker-thread
+      name: '@deepseek-ai/dsh-workflow-worker-thread'
+      config:
+        provider: spawn
+
+    - id: tool-workflow
+      name: '@deepseek-ai/dsh-tool-workflow'
+
+    - id: tool-ralph
+      name: '@deepseek-ai/dsh-tool-ralph'
+      config:
+        subagentProvider: spawn
+        maxRounds: 64
+
+# ── remaining model-facing rows ─────────────────────────────────────────────
+
+- id: tool-ask-user
+  name: '@deepseek-ai/dsh-tool-ask-user'
+
+- id: tool-todo
+  name: '@deepseek-ai/dsh-tool-todo'
+  config:
+    allowParallelInProgress: true
+
+- id: tool-web
+  name: '@deepseek-ai/dsh-tool-web'
+  config:
+    fetch: false
+    searchTimeoutMs: 60000
+
+# ── maestro-coder-specific rows ─────────────────────────────────────────────
+
+- id: persona
+  name: '@deepseek-ai/dsh-persona'
+  config:
+    text: |
+      You are Maestro Coder, a strictly-compliant Pair Programming Assistant.
+      MANDATORY WORKFLOW:
+      1. Always call maestro_get_skills BEFORE writing code to understand the conventions.
+      2. Use maestro_read_file to analyze existing project modules.
+      3. Write highly optimized, clean code and save via maestro_write_file.
+      4. If requested, call govard_shell to run unit tests and verify your code. Do not explain unnecessarily.
+
+- id: skills-tool
+  name: '@ddtcorex/dsh-maestro-review/lib/skills-tool.js'
+
+- id: workspace-tool
+  name: '@ddtcorex/dsh-maestro-govard/lib/workspace-tool.js'
+
+- id: govard-tool
+  name: '@ddtcorex/dsh-maestro-govard/lib/govard-tool.js'
+  config:
+    rootPath: null

package/presets/maestro-coder/preset.yml

@@ -0,0 +1,2 @@
+name: Maestro Coder
+description: Strictly-compliant pair programming assistant. Reads project skills before writing code, edits files in the current workspace, and runs tests via Govard. Select this in the DSH Web GUI agent picker for interactive coding sessions.

package/presets/maestro-reviewer/agent.cordis.yml

@@ -0,0 +1,14 @@
+- id: persona
+  name: '@deepseek-ai/dsh-persona'
+  config:
+    text: |
+      You are Maestro Reviewer, an AI Tech Lead. Workflow:
+      1. Call maestro_load_review_profile with the profile named by the review request before inspecting code. It fails closed if the required skill set is incomplete.
+      2. Call gitlab_list_own_review_threads to see which findings you already raised on this merge request.
+      3. Call gitlab_get_mr_diff to read the current diff.
+      4. For each existing thread whose file/line was touched by the new commits, decide whether it still applies, looks fixed, or needs a different comment — reply to it (status: "reply"). Never resolve a thread yourself.
+      5. For genuinely new issues with no existing thread, prepare a new inline comment (status: "new").
+      6. Call report_review_findings exactly once with your complete list of findings, then stop. Do not call gitlab_post_mr_comment, gitlab_post_inline_comment, or gitlab_reply_to_thread yourself — the orchestrator posts them from your report_review_findings call.
+
+- id: skills-tool
+  name: '@ddtcorex/dsh-maestro-review/lib/skills-tool.js'

package/presets/maestro-reviewer/preset.yml

@@ -0,0 +1,2 @@
+name: Maestro Reviewer
+description: Automated AI Tech Lead that reviews a GitLab merge request's diff against project coding standards. Invoked programmatically by dsh-maestro-review's orchestrator — not meant for manual selection.

package/src/augment.d.ts

@@ -0,0 +1,47 @@
+import type { ModelSelection } from '@deepseek-ai/dsh-agent'
+
+declare module '@deepseek-ai/dsh-host-webserver' {}
+declare module '@deepseek-ai/dsh-client-connection' {}
+declare module '@deepseek-ai/dsh-client-ui-slots' {}
+declare module '@deepseek-ai/dsh-client-ui-settings' {}
+declare module '@deepseek-ai/dsh-host-apiproxy/api' {
+  export type RpcResult<T> = { ok: true; value: T } | { ok: false; error: any }
+  export type RpcErrorDetailsMap = { 'bad-request': { issues: any[] } }
+}
+declare module '@deepseek-ai/dsh-tools' {
+  export function defineTool(...args: any[]): any
+}
+
+import '@deepseek-ai/cordis'
+
+declare module '@deepseek-ai/cordis' {
+  interface Context {
+    webServer: { port: number; register: any }
+    connection: { rpc: { handle: (channel: string, handler: any, opts?: any) => () => void; call: any } }
+    maestroTunnel: {
+      status(): any
+      start(): Promise<any>
+      stop(): Promise<any>
+      proxyStatus(): any
+      reloadConfig(): Promise<void>
+      initialReady(): Promise<void>
+    }
+    logger?: {
+      info?: (...args: any[]) => void
+      warn?: (...args: any[]) => void
+      error?: (...args: any[]) => void
+    }
+    tools: { register: any; preExecute?: any }
+    agents: any
+    sessions: any
+    skills: any
+    /** DSH default-model service (injected by the host; structural shape only). */
+    agentDefaultModel: {
+      currentSelection(): ModelSelection
+    }
+    agentPresets: { mount(agentCtx: Context, id: string): Promise<unknown> | unknown }
+    sessionTitle: { rename(session: unknown, title: string): Promise<unknown> | unknown }
+    /** Current agent identity inside an agent-scoped context (WeakMap key). */
+    agent?: object
+  }
+}

package/src/config-store.ts

@@ -0,0 +1,109 @@
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { dirname, join } from 'node:path'
+import type { ReviewSkillProfile } from './skills-tool.js'
+import {
+  RUNTIME_KEYS,
+  readFlat,
+  writeLegacyPatch,
+} from '@ddtcorex/dsh-maestro-config-lib'
+
+export interface ReviewModelSelection {
+  provider: string
+  model: string
+  reasoningEffort?: string
+}
+
+export interface MaestroUserConfig {
+  gitlabBaseUrl?: string
+  gitlabToken?: string
+  botUsername?: string
+  webhookSecret?: string
+  webhookPort?: number
+  projectMappings?: Array<{ projectPath: string; localRepoPath: string; reviewProfile?: ReviewSkillProfile; reviewModel?: ReviewModelSelection }>
+  /** Override the DSH default model for automated reviews. When absent the global DSH default is used. */
+  reviewModel?: ReviewModelSelection
+  /** Re-run a quick review whenever new commits land on a previously reviewed MR. */
+  autoRereviewOnPush?: boolean
+  /** Bound one automated review agent's turn. */
+  agentTimeoutMs?: number
+  /** Prune Maestro's own review records older than this many days (0 = keep forever). */
+  reviewSessionRetentionDays?: number
+  tunnelMode?: 'quick' | 'named'
+  quickTarget?: 'dsh-web' | 'webhook'
+  tunnelId?: string
+  tunnelCredentialsFile?: string
+  tunnelHostname?: string
+  proxyPort?: number
+  proxyHost?: string
+  lastTunnelRunning?: boolean
+  /** Gate LAN access behind a second PIN. Default false — LAN stays open. */
+  lanPinEnabled?: boolean
+  /** Telegram Bot API credentials for one-way notifications. */
+  telegramBotToken?: string
+  telegramChatId?: string
+  /** Also notify this chat when a review finishes. Default false. */
+  telegramReviewNotifications?: boolean
+}
+
+function resolveDshHome(dshHome?: string): string {
+  return dshHome ?? process.env.DSH_HOME ?? join(homedir(), '.dsh')
+}
+
+/**
+ * Settings live in the SHARED namespaced store (`~/.dsh/maestro/settings.json`,
+ * owned by @ddtcorex/dsh-maestro-config-lib); this store is a thin adapter that
+ * keeps the package's flat `MaestroUserConfig` API while delegating persistence.
+ * Machine runtime state (RUNTIME_KEYS) never enters settings — it stays in this
+ * package's own sidecar so a settings edit can never silently flip tunnel state.
+ */
+export function configStorePath(dshHome?: string): string {
+  return join(resolveDshHome(dshHome), 'maestro', 'settings.json')
+}
+
+function runtimeStatePath(dshHome?: string): string {
+  return join(resolveDshHome(dshHome), 'dsh-maestro-review', 'runtime.json')
+}
+
+async function readRuntimeState(dshHome?: string): Promise<Record<string, unknown>> {
+  try {
+    return JSON.parse(await readFile(runtimeStatePath(dshHome), 'utf8')) as Record<string, unknown>
+  } catch {
+    return {}
+  }
+}
+
+async function mergeRuntimeState(
+  patch: Record<string, unknown>,
+  dshHome?: string,
+): Promise<void> {
+  const path = runtimeStatePath(dshHome)
+  const merged = { ...(await readRuntimeState(dshHome)), ...patch }
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 })
+  await writeFile(path, JSON.stringify(merged, null, 2), { encoding: 'utf-8', mode: 0o600 })
+  await chmod(path, 0o600)
+}
+
+export async function loadUserConfig(dshHome?: string): Promise<MaestroUserConfig> {
+  const [flat, runtime] = await Promise.all([
+    readFlat({ dshHome }),
+    readRuntimeState(dshHome),
+  ])
+  return { ...flat, ...runtime } as MaestroUserConfig
+}
+
+export async function saveUserConfig(patch: MaestroUserConfig, dshHome?: string): Promise<MaestroUserConfig> {
+  const settingsPatch: Record<string, unknown> = {}
+  const runtimePatch: Record<string, unknown> = {}
+  for (const [key, value] of Object.entries(patch)) {
+    if ((RUNTIME_KEYS as readonly string[]).includes(key)) runtimePatch[key] = value
+    else settingsPatch[key] = value
+  }
+  if (Object.keys(settingsPatch).length > 0) {
+    await writeLegacyPatch(settingsPatch, { dshHome })
+  }
+  if (Object.keys(runtimePatch).length > 0) {
+    await mergeRuntimeState(runtimePatch, dshHome)
+  }
+  return loadUserConfig(dshHome)
+}

package/src/events.ts

@@ -0,0 +1,25 @@
+export interface MrOpenedPayload {
+  projectPath: string
+  projectId: number
+  mrIid: number
+  sourceBranch: string
+}
+
+export type ReviewMode = 'quick' | 'deep'
+
+export type ReviewScope =
+  | { kind: 'mr' }
+  | { kind: 'discussion'; discussionId: string; path: string; line: number }
+
+export interface ReviewRequest extends MrOpenedPayload {
+  /** `push` arrives only when auto re-review on push is enabled and passes the completed-history gate. */
+  trigger: 'reviewer-assignment' | 'mention' | 'push'
+  mode: ReviewMode
+  scope: ReviewScope
+}
+
+declare module '@deepseek-ai/cordis' {
+  interface Events {
+    'maestro/review-request': (payload: ReviewRequest) => void
+  }
+}