@ddtcorex/dsh-maestro-review 0.1.0

package/src/gitlab-client.ts

@@ -0,0 +1,186 @@
+import type { Context } from '@deepseek-ai/cordis'
+import z from '@deepseek-ai/schemastery'
+import { defineTool } from '@deepseek-ai/dsh-tools'
+
+export const name = 'maestro-gitlab-client'
+export const inject = ['tools']
+
+export interface Config {
+  baseUrl: string
+  projectId: string | number
+  mrIid: number
+  token: string
+  botUsername: string
+}
+
+export const Config: z<Config> = z.object({
+  baseUrl: z.string().required(),
+  projectId: z.union([z.string(), z.number()]).required(),
+  mrIid: z.number().required(),
+  token: z.string().role('secret').required(),
+  botUsername: z.string().required(),
+})
+
+interface GitlabDiff {
+  old_path: string
+  new_path: string
+  diff: string
+}
+
+interface GitlabDiffRefs {
+  base_sha: string
+  start_sha: string
+  head_sha: string
+}
+
+interface GitlabDiscussionNote {
+  body: string
+  author: { username: string }
+  position?: { new_path: string, new_line: number | null }
+  resolved: boolean
+}
+
+interface GitlabDiscussion {
+  id: string
+  notes: GitlabDiscussionNote[]
+}
+
+export function apply(ctx: Context, config: Config): void {
+  const apiBase = `${config.baseUrl}/api/v4/projects/${config.projectId}/merge_requests/${config.mrIid}`
+  const headers = { 'PRIVATE-TOKEN': config.token }
+  let cachedDiffRefs: GitlabDiffRefs | undefined
+
+  async function getDiffRefs(): Promise<GitlabDiffRefs> {
+    if (cachedDiffRefs !== undefined) return cachedDiffRefs
+    const response = await fetch(apiBase, { headers })
+    if (!response.ok) {
+      throw new Error(`GitLab API error ${response.status}: ${await response.text()}`)
+    }
+    cachedDiffRefs = (await response.json() as { diff_refs: GitlabDiffRefs }).diff_refs
+    return cachedDiffRefs
+  }
+
+  ctx.tools.register(defineTool({
+    name: 'gitlab_get_mr_diff',
+    description: 'Fetch the current unified diff for this merge request.',
+    parameters: {},
+    output: {
+      schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string', required: true } } },
+      render: (_args, value) => [{ type: 'text', text: value.text }],
+    },
+    async execute() {
+      const response = await fetch(`${apiBase}/diffs`, { headers })
+      if (!response.ok) {
+        throw new Error(`GitLab API error ${response.status}: ${await response.text()}`)
+      }
+      const diffs = await response.json() as GitlabDiff[]
+      const text = diffs.map(d => `--- ${d.old_path}\n+++ ${d.new_path}\n${d.diff}`).join('\n\n')
+      return { text }
+    },
+  }))
+
+  ctx.tools.register(defineTool({
+    name: 'gitlab_post_mr_comment',
+    description: 'Post a Markdown comment (discussion note) on this merge request.',
+    parameters: {
+      body: { type: 'string', required: true, description: 'Markdown comment body.' },
+    },
+    output: {
+      schema: { type: 'object', additionalProperties: false, properties: { posted: { type: 'boolean', required: true } } },
+      render: () => [{ type: 'text', text: 'Comment posted.' }],
+    },
+    async execute(args) {
+      const response = await fetch(`${apiBase}/notes`, {
+        method: 'POST',
+        headers: { ...headers, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ body: args.body }),
+      })
+      if (!response.ok) {
+        throw new Error(`GitLab API error ${response.status}: ${await response.text()}`)
+      }
+      return { posted: true }
+    },
+  }))
+
+  ctx.tools.register(defineTool({
+    name: 'gitlab_list_own_review_threads',
+    description: 'List this merge request\'s unresolved inline discussion threads previously created by this bot account, so you can reply instead of duplicating.',
+    parameters: {},
+    output: {
+      schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string', required: true } } },
+      render: (_args, value) => [{ type: 'text', text: value.text }],
+    },
+    async execute() {
+      const response = await fetch(`${apiBase}/discussions`, { headers })
+      if (!response.ok) {
+        throw new Error(`GitLab API error ${response.status}: ${await response.text()}`)
+      }
+      const discussions = await response.json() as GitlabDiscussion[]
+      const ownThreads = discussions
+        .filter(d => d.notes.length > 0 && d.notes[0].author.username === config.botUsername && !d.notes[0].resolved && d.notes[0].position !== undefined)
+        .map(d => ({ discussionId: d.id, path: d.notes[0].position!.new_path, line: d.notes[0].position!.new_line, lastCommentBody: d.notes[d.notes.length - 1].body }))
+      return { text: JSON.stringify(ownThreads) }
+    },
+  }))
+
+  ctx.tools.register(defineTool({
+    name: 'gitlab_post_inline_comment',
+    description: 'Create a new inline discussion at a specific file and line in this merge request\'s current diff.',
+    parameters: {
+      path: { type: 'string', required: true, description: 'File path on the new (target) side of the diff.' },
+      line: { type: 'number', required: true, description: 'Line number on the new (target) side of the diff.' },
+      body: { type: 'string', required: true, description: 'Markdown comment body.' },
+    },
+    output: {
+      schema: { type: 'object', additionalProperties: false, properties: { posted: { type: 'boolean', required: true } } },
+      render: () => [{ type: 'text', text: 'Inline comment posted.' }],
+    },
+    async execute(args) {
+      const diffRefs = await getDiffRefs()
+      const response = await fetch(`${apiBase}/discussions`, {
+        method: 'POST',
+        headers: { ...headers, 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          body: args.body,
+          position: {
+            position_type: 'text',
+            base_sha: diffRefs.base_sha,
+            start_sha: diffRefs.start_sha,
+            head_sha: diffRefs.head_sha,
+            old_path: args.path,
+            new_path: args.path,
+            new_line: args.line,
+          },
+        }),
+      })
+      if (!response.ok) {
+        throw new Error(`GitLab API error ${response.status}: ${await response.text()}`)
+      }
+      return { posted: true }
+    },
+  }))
+
+  ctx.tools.register(defineTool({
+    name: 'gitlab_reply_to_thread',
+    description: 'Reply to an existing inline discussion thread (discussionId from gitlab_list_own_review_threads) without resolving it.',
+    parameters: {
+      discussionId: { type: 'string', required: true },
+      body: { type: 'string', required: true, description: 'Markdown reply body.' },
+    },
+    output: {
+      schema: { type: 'object', additionalProperties: false, properties: { posted: { type: 'boolean', required: true } } },
+      render: () => [{ type: 'text', text: 'Reply posted.' }],
+    },
+    async execute(args) {
+      const response = await fetch(`${apiBase}/discussions/${args.discussionId}/notes`, {
+        method: 'POST',
+        headers: { ...headers, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ body: args.body }),
+      })
+      if (!response.ok) {
+        throw new Error(`GitLab API error ${response.status}: ${await response.text()}`)
+      }
+      return { posted: true }
+    },
+  }))
+}

package/src/gitlab-webhook.ts

@@ -0,0 +1,166 @@
+import { createServer, type IncomingMessage } from 'node:http'
+import type { Context } from '@deepseek-ai/cordis'
+import z from '@deepseek-ai/schemastery'
+import { loadUserConfig } from './config-store.js'
+import { secretsMatch } from './secure-compare.js'
+import type { MrOpenedPayload, ReviewRequest } from './events.ts'
+import { routeGitlabReviewRequest } from './review-intake.js'
+
+export const name = 'maestro-gitlab-webhook'
+
+export interface Config {
+  port: number
+  /** Username of the GitLab service account used for reviewer assignments. */
+  botUsername?: string
+  /**
+   * Fallback when Maestro Settings has no webhook secret; optional so a
+   * deployment that configures everything through Settings boots without env
+   * vars. With neither source set, every request is rejected (fail closed).
+   */
+  secret?: string
+}
+
+export const Config: z<Config> = z.object({
+  port: z.natural().max(65535).required(),
+  botUsername: z.string(),
+  secret: z.string().role('secret'),
+})
+
+interface GitlabMrWebhookBody {
+  object_kind: string
+  project: { id: number; path_with_namespace: string }
+  object_attributes: { iid: number; action: string; source_branch: string }
+}
+
+/** GitLab payloads are small; 5 MB is generous and stops unbounded buffering. */
+const MAX_WEBHOOK_BODY_BYTES = 5 * 1024 * 1024
+
+function readBody(req: IncomingMessage, limit = MAX_WEBHOOK_BODY_BYTES): Promise<string | undefined> {
+  return new Promise((resolvePromise) => {
+    let raw = ''
+    let settled = false
+    req.on('data', (chunk: Buffer) => {
+      if (settled) return
+      if (raw.length + chunk.length > limit) {
+        settled = true
+        req.resume()
+        resolvePromise(undefined)
+        return
+      }
+      raw += chunk.toString()
+    })
+    req.on('end', () => { if (!settled) { settled = true; resolvePromise(raw) } })
+    req.on('error', () => { if (!settled) { settled = true; resolvePromise(undefined) } })
+  })
+}
+
+function isValidMrOpenedPayload(value: unknown): value is MrOpenedPayload {
+  if (typeof value !== 'object' || value === null) return false
+  const v = value as Record<string, unknown>
+  return typeof v.projectPath === 'string'
+    && typeof v.projectId === 'number'
+    && typeof v.mrIid === 'number'
+    && typeof v.sourceBranch === 'string'
+}
+
+function hasValidGitlabMrIdentity(value: unknown): boolean {
+  if (typeof value !== 'object' || value === null) return false
+  const body = value as Record<string, unknown>
+  const project = body.project as Record<string, unknown> | undefined
+  const attributes = body.object_attributes as Record<string, unknown> | undefined
+  const mergeRequest = body.merge_request as Record<string, unknown> | undefined
+  const source = body.object_kind === 'note' ? mergeRequest : attributes
+  return typeof project?.id === 'number' && typeof project.path_with_namespace === 'string'
+    && typeof source?.iid === 'number' && typeof source.source_branch === 'string'
+}
+
+export function apply(ctx: Context, config: Config): void {
+  // Settings wins over the boot secret, re-read per request so a change in the
+  // UI takes effect without a restart. With neither source set, every token
+  // fails the comparison (a header string never equals `undefined`), so the
+  // server stays closed until a secret is configured.
+  let warnedUnconfigured = false
+  async function requestAuthorized(headerValue: string | string[] | undefined): Promise<boolean> {
+    const userConfig = await loadUserConfig()
+    const expected = userConfig.webhookSecret ?? config.secret
+    if (expected === undefined) {
+      if (!warnedUnconfigured) {
+        warnedUnconfigured = true
+        console.error('maestro-gitlab-webhook: no webhook secret configured — set one in Maestro Settings or MAESTRO_GITLAB_WEBHOOK_SECRET; rejecting all requests until then')
+      }
+      return false
+    }
+    return secretsMatch(headerValue, expected)
+  }
+
+  const server = createServer((req, res) => {
+    if (req.method !== 'POST') {
+      res.writeHead(404).end()
+      return
+    }
+    void requestAuthorized(req.headers['x-gitlab-token']).then(async (authorized) => {
+      if (!authorized) {
+        res.writeHead(401).end()
+        return
+      }
+      readBody(req).then(async (raw) => {
+        if (raw === undefined) {
+          res.writeHead(413).end()
+          return
+        }
+        if (req.url === '/hooks/gitlab-mr/trigger') {
+          let parsed: unknown
+          try {
+            parsed = JSON.parse(raw)
+          } catch {
+            res.writeHead(400).end()
+            return
+          }
+          if (!isValidMrOpenedPayload(parsed)) {
+            res.writeHead(400).end()
+            return
+          }
+          const request: ReviewRequest = {
+            ...parsed,
+            trigger: 'mention',
+            mode: 'quick',
+            scope: { kind: 'mr' },
+          }
+          ctx.emit('maestro/review-request', request)
+          res.writeHead(200).end()
+          return
+        }
+
+        if (req.url !== '/hooks/gitlab-mr') {
+          res.writeHead(404).end()
+          return
+        }
+        let body: GitlabMrWebhookBody
+        try {
+          body = JSON.parse(raw)
+        } catch {
+          res.writeHead(400).end()
+          return
+        }
+        const userConfig = await loadUserConfig()
+        if ((body.object_kind === 'merge_request' || body.object_kind === 'note') && !hasValidGitlabMrIdentity(body)) {
+          res.writeHead(400).end()
+          return
+        }
+        const request = routeGitlabReviewRequest(
+          body,
+          userConfig.botUsername ?? config.botUsername ?? 'maestro',
+          { pushEnabled: userConfig.autoRereviewOnPush === true },
+        )
+        if (request !== undefined) ctx.emit('maestro/review-request', request)
+        res.writeHead(200).end()
+      })
+    })
+  })
+
+  server.listen(config.port)
+
+  ctx.effect(() => async () => {
+    await new Promise<void>((resolve) => { server.close(() => resolve()) })
+  }, 'gitlab-webhook teardown')
+}

package/src/govard-tool.ts

@@ -0,0 +1,114 @@
+import { spawn } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import type { Context } from '@deepseek-ai/cordis'
+import z from '@deepseek-ai/schemastery'
+import { defineTool } from '@deepseek-ai/dsh-tools'
+
+export const name = 'maestro-govard-tool'
+export const inject = ['tools']
+
+export interface Config {
+  rootPath?: string
+  timeoutMs?: number
+}
+
+export const Config: z<Config> = z.object({
+  rootPath: z.string(),
+  timeoutMs: z.number().min(1_000).default(300_000),
+})
+
+interface RunResult {
+  code: number | null
+  stdout: string
+  stderr: string
+}
+
+function run(command: string, args: string[], cwd: string, timeoutMs: number): Promise<RunResult> {
+  return new Promise((promiseResolve, promiseReject) => {
+    const child = spawn(command, args, { cwd })
+    let stdout = ''
+    let stderr = ''
+    const timer = setTimeout(() => {
+      child.kill('SIGKILL')
+      promiseReject(new Error(`"${command} ${args.join(' ')}" timed out after ${timeoutMs}ms`))
+    }, timeoutMs)
+    child.stdout?.on('data', (chunk: Buffer) => { stdout += chunk.toString() })
+    child.stderr?.on('data', (chunk: Buffer) => { stderr += chunk.toString() })
+    child.on('error', (err) => {
+      clearTimeout(timer)
+      promiseReject(err)
+    })
+    child.on('close', (code) => {
+      clearTimeout(timer)
+      promiseResolve({ code, stdout, stderr })
+    })
+  })
+}
+
+function textResult(result: RunResult, successText: string): { text: string } {
+  if (result.code !== 0) {
+    throw new Error(`Exit ${result.code}: ${result.stderr || result.stdout}`)
+  }
+  return { text: result.stdout.length > 0 ? result.stdout : successText }
+}
+
+export function apply(ctx: Context, config: Config): void {
+  const rootPath = config.rootPath ?? process.cwd()
+  const timeoutMs = config.timeoutMs ?? 300_000
+
+  async function ensureInitialized(): Promise<void> {
+    if (existsSync(join(rootPath, '.govard.yml'))) return
+    const result = await run('govard', ['init', '--framework', 'magento2', '-y'], rootPath, timeoutMs)
+    if (result.code !== 0) throw new Error(`govard init failed: ${result.stderr || result.stdout}`)
+  }
+
+  ctx.tools.register(defineTool({
+    name: 'govard_env_up',
+    description: 'Bring up the local Magento 2 Govard environment for the current worktree, initializing it first if needed.',
+    parameters: {},
+    output: {
+      schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string', required: true } } },
+      render: (_args, value) => [{ type: 'text', text: value.text }],
+    },
+    async execute() {
+      await ensureInitialized()
+      const result = await run('govard', ['up'], rootPath, timeoutMs)
+      return textResult(result, 'Environment is up.')
+    },
+  }))
+
+  ctx.tools.register(defineTool({
+    name: 'govard_shell',
+    description: 'Run one non-interactive command inside the Govard-managed container (e.g. a test suite) and return its output.',
+    parameters: {
+      command: { type: 'string', required: true, description: 'Shell command to run inside the container, e.g. "vendor/bin/phpunit".' },
+    },
+    output: {
+      schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string', required: true } } },
+      render: (_args, value) => [{ type: 'text', text: value.text }],
+    },
+    async execute(args) {
+      const result = await run('govard', ['shell', '-c', args.command], rootPath, timeoutMs)
+      return textResult(result, '(no output)')
+    },
+  }))
+
+  ctx.tools.register(defineTool({
+    name: 'govard_env_down',
+    description: 'Tear down the local Govard environment for the current worktree, removing volumes.',
+    parameters: {},
+    output: {
+      schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string', required: true } } },
+      render: (_args, value) => [{ type: 'text', text: value.text }],
+    },
+    async execute() {
+      const result = await run('govard', ['down', '-v'], rootPath, timeoutMs)
+      return textResult(result, 'Environment is down.')
+    },
+  }))
+
+  ctx.effect(() => async () => {
+    await run('govard', ['down', '-v'], rootPath, timeoutMs).catch(() => undefined)
+  }, 'govard-tool teardown')
+}

package/src/index.ts

@@ -0,0 +1,15 @@
+import type { Context } from '@deepseek-ai/cordis'
+
+export const name = '@ddtcorex/dsh-maestro-review'
+
+export function apply(ctx: Context): void {
+  ctx.effect(() => ctx.connection.rpc.handle('/dsh-maestro-review', async (endpoint, payload) => {
+    if (endpoint === 'status') return { ok: true, value: { provider: 'gitlab' } }
+    if (endpoint === 'providers') return { ok: true, value: { providers: ['gitlab', 'github'] } }
+    if (endpoint === 'review') {
+      const body = payload as Record<string, unknown> | undefined
+      return { ok: true, value: { received: true, provider: (body as any)?.provider ?? 'gitlab' } }
+    }
+    return { ok: false, error: { code: 'bad-request', message: `Unknown endpoint: ${endpoint}`, details: { issues: [{ message: String(endpoint) }] } as any } }
+  }, { authority: 'loopback' }), 'maestro-review rpc')
+}

package/src/notify.ts

@@ -0,0 +1,30 @@
+/** Provider-neutral notifier contract plus every message text this plugin owns. */
+
+export interface NotifyDeliveryResult {
+  sent: boolean
+  reason?: 'not-configured' | 'request-failed' | 'unknown-provider'
+}
+
+/**
+ * Structural view of the optional `maestroNotifier` service published by
+ * `@ddtcorex/dsh-maestro-notifier`. Consumed via `ctx.get` so an absent
+ * notifier plugin degrades to "no notifications" instead of breaking reviews.
+ */
+export interface NotifierLike {
+  send(providerId: string, target: Record<string, unknown>, message: { text: string }): Promise<NotifyDeliveryResult>
+}
+
+export function reviewDigestText(notification: {
+  projectPath: string
+  mrIid: number
+  status: 'completed' | 'failed'
+  summary?: string
+}): string {
+  const outcome = notification.status === 'completed' ? '✅ completed' : '⚠️ failed'
+  const summary = notification.summary === undefined ? '' : `\n${notification.summary}`
+  return `Maestro review of ${notification.projectPath} !${notification.mrIid}: ${outcome}${summary}`
+}
+
+export function pinRotationText(pin: string): string {
+  return `DSH public access PIN was rotated\nNew PIN: ${pin}`
+}