@ddtcorex/dsh-maestro-review 0.1.2 → 0.3.0

package/src/host/providers/gitlab.ts

@@ -1,4 +1,4 @@
-import { createServer, type IncomingMessage } from 'node:http'
+import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { Context } from '@deepseek-ai/cordis'
 import z from '@deepseek-ai/schemastery'
 import { loadUserConfig } from '../config-store.js'
@@ -8,15 +8,13 @@ import { routeGitlabReviewRequest } from '../review-intake.js'
 import type { ReviewProvider, ReviewRequest } from './interface.js'
 
 export const name = 'maestro-review-webhook'
+export const inject = ['webServer'] as const
 
 export interface Config {
-  port: number
   botUsername?: string
   secret?: string
 }
-
 export const Config: z<Config> = z.object({
-  port: z.natural().max(65535).required(),
   botUsername: z.string(),
   secret: z.string().role('secret'),
 })
@@ -108,83 +106,37 @@ export function apply(ctx: Context, config: Config): void {
     const userConfig = await loadUserConfig()
     const expected = userConfig.webhookSecret ?? config.secret
     if (expected === undefined) {
-      if (!warnedUnconfigured) {
-        warnedUnconfigured = true
-        console.error('maestro-review-webhook: no webhook secret configured — set one in Maestro Settings or MAESTRO_GITLAB_WEBHOOK_SECRET; rejecting all requests until then')
-      }
+      if (!warnedUnconfigured) { warnedUnconfigured = true; console.error('maestro-review-webhook: no webhook secret configured — set one in Maestro Settings or MAESTRO_GITLAB_WEBHOOK_SECRET; rejecting all requests until then') }
       return false
     }
     return secretsMatch(headerValue, expected)
   }
-
-  const server = createServer((req, res) => {
-    if (req.method !== 'POST') {
-      res.writeHead(404).end()
-      return
-    }
-    void requestAuthorized(req.headers['x-gitlab-token']).then(async (authorized) => {
-      if (!authorized) {
-        res.writeHead(401).end()
-        return
-      }
-      readBody(req).then(async (raw) => {
-        if (raw === undefined) {
-          res.writeHead(413).end()
-          return
-        }
-        if (req.url === '/hooks/gitlab-mr/trigger') {
-          let parsed: unknown
-          try {
-            parsed = JSON.parse(raw)
-          } catch {
-            res.writeHead(400).end()
-            return
-          }
-          if (!isValidMrOpenedPayload(parsed)) {
-            res.writeHead(400).end()
-            return
-          }
-          const request: OrchestratorReviewRequest = {
-            ...parsed,
-            trigger: 'mention',
-            mode: 'quick',
-            scope: { kind: 'mr' },
-          }
-          ctx.emit('maestro/review-request', request)
-          res.writeHead(200).end()
-          return
-        }
-
-        if (req.url !== '/hooks/gitlab-mr') {
-          res.writeHead(404).end()
-          return
-        }
-        let body: GitlabMrWebhookBody
-        try {
-          body = JSON.parse(raw)
-        } catch {
-          res.writeHead(400).end()
-          return
+  function makeHandler(expectedPath: string) {
+    return (req: IncomingMessage, res: ServerResponse) => {
+      if (req.method !== 'POST') { res.writeHead(404).end(); return }
+      if (req.url !== expectedPath) { res.writeHead(404).end(); return }
+      void requestAuthorized(req.headers['x-gitlab-token']).then(async (authorized) => {
+        if (!authorized) { res.writeHead(401).end(); return }
+        const raw = await readBody(req)
+        if (raw === undefined) { res.writeHead(413).end(); return }
+        if (expectedPath === '/hooks/gitlab-mr/trigger') {
+          let parsed: unknown; try { parsed = JSON.parse(raw) } catch { res.writeHead(400).end(); return }
+          if (!isValidMrOpenedPayload(parsed)) { res.writeHead(400).end(); return }
+          const request: OrchestratorReviewRequest = { ...(parsed as any), trigger: 'mention', mode: 'quick', scope: { kind: 'mr' } }
+          ctx.emit('maestro/review-request', request); res.writeHead(200).end(); return
         }
+        let body: GitlabMrWebhookBody; try { body = JSON.parse(raw) } catch { res.writeHead(400).end(); return }
         const userConfig = await loadUserConfig()
-        if ((body.object_kind === 'merge_request' || body.object_kind === 'note') && !hasValidGitlabMrIdentity(body)) {
-          res.writeHead(400).end()
-          return
-        }
-        const request = routeGitlabReviewRequest(
-          body,
-          userConfig.botUsername ?? config.botUsername ?? 'maestro',
-          { pushEnabled: userConfig.autoRereviewOnPush === true },
-        )
+        if ((body.object_kind === 'merge_request' || body.object_kind === 'note') && !hasValidGitlabMrIdentity(body)) { res.writeHead(400).end(); return }
+        const request = routeGitlabReviewRequest(body, userConfig.botUsername ?? config.botUsername ?? 'maestro', { pushEnabled: userConfig.autoRereviewOnPush === true })
         if (request !== undefined) ctx.emit('maestro/review-request', request)
         res.writeHead(200).end()
       })
-    })
-  })
-
-  server.listen(config.port)
-
-  ctx.effect(() => async () => {
-    await new Promise<void>((resolve) => { server.close(() => resolve()) })
-  }, 'gitlab-webhook teardown')
+    }
+  }
+  const h1 = makeHandler('/hooks/gitlab-mr')
+  const h2 = makeHandler('/hooks/gitlab-mr/trigger')
+  const dispose1 = (ctx as any).webServer.register({ kind: 'exact', path: '/hooks/gitlab-mr', handler: h1 })
+  const dispose2 = (ctx as any).webServer.register({ kind: 'exact', path: '/hooks/gitlab-mr/trigger', handler: h2 })
+  ctx.effect(() => () => { dispose1(); dispose2() }, 'gitlab-webhook teardown')
 }

package/src/host/skills-tool.ts

@@ -5,7 +5,7 @@ import type {} from '@deepseek-ai/dsh-agent'
 export const name = 'maestro-skills-tool'
 export const inject = ['skills', 'tools']
 
-export type ReviewSkillProfile = 'magento2' | 'generic'
+export type ReviewSkillProfile = 'magento2' | 'laravel' | 'symfony' | 'wordpress' | 'generic'
 
 /**
  * Exact skill names rather than a fuzzy search: a review must not silently
@@ -25,11 +25,26 @@ export const REVIEW_PROFILE_SKILLS: Record<ReviewSkillProfile, readonly string[]
     'magento2-security-scan',
     'magento2-performance-audit',
   ],
+  laravel: [
+    'govard-toolbox',
+    'govard-laravel',
+    'php-dev-core',
+  ],
+  symfony: [
+    'govard-toolbox',
+    'govard-symfony',
+    'php-dev-core',
+  ],
+  wordpress: [
+    'govard-toolbox',
+    'govard-wordpress',
+    'php-dev-core',
+  ],
   /** Diff review against general best practices; no project skill set required. */
   generic: [],
 }
 
-export const MAESTRO_SKILLS_INSTALL_COMMAND = 'curl -fsSL https://raw.githubusercontent.com/ddtcorex/maestro-skills/master/install.sh | bash -s -- --scope personal --target dsh --skills govard-toolbox,govard-magento,magento2-dev-core,magento2-frontend-dev,magento2-hyva-dev,magento2-code-review,magento2-linter,magento2-security-scan,magento2-performance-audit -y'
+export const MAESTRO_SKILLS_INSTALL_COMMAND = 'curl -fsSL https://raw.githubusercontent.com/ddtcorex/maestro-skills/master/install.sh | bash -s -- --scope personal --target dsh --skills govard-toolbox,govard-magento,govard-laravel,govard-symfony,govard-wordpress,php-dev-core,magento2-dev-core,magento2-frontend-dev,magento2-hyva-dev,magento2-code-review,magento2-linter,magento2-security-scan,magento2-performance-audit -y'
 
 // This is deliberately process-local and keyed by the reviewer Agent object,
 // which every Cordis child context inherits. Preset mounting inserts child
@@ -139,7 +154,7 @@ export function apply(ctx: Context): void {
     name: 'maestro_load_review_profile',
     description: 'Load the complete, exact skill set required for a configured review profile. Fails if any required skill is unavailable.',
     parameters: {
-      profile: { type: 'string', required: true, description: 'Review profile configured for the project. Supported: "magento2" (full Magento skill set), "generic" (no skills required).' },
+      profile: { type: 'string', required: true, description: 'Review profile configured for the project. Supported: "magento2" (full Magento skill set), "laravel" (Govard Laravel + PHP), "symfony" (Govard Symfony + PHP), "wordpress" (Govard WordPress + PHP), "generic" (no skills required).' },
     },
     output: {
       schema: {

package/lib/gitlab-webhook.d.ts

@@ -1,17 +0,0 @@
-import type { Context } from '@deepseek-ai/cordis';
-import z from '@deepseek-ai/schemastery';
-export declare const name = "maestro-gitlab-webhook";
-export interface Config {
-    port: number;
-    /** Username of the GitLab service account used for reviewer assignments. */
-    botUsername?: string;
-    /**
-     * Fallback when Maestro Settings has no webhook secret; optional so a
-     * deployment that configures everything through Settings boots without env
-     * vars. With neither source set, every request is rejected (fail closed).
-     */
-    secret?: string;
-}
-export declare const Config: z<Config>;
-export declare function apply(ctx: Context, config: Config): void;
-//# sourceMappingURL=gitlab-webhook.d.ts.map

package/lib/gitlab-webhook.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"gitlab-webhook.d.ts","sourceRoot":"","sources":["../src/host/gitlab-webhook.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAMxC,eAAO,MAAM,IAAI,2BAA2B,CAAA;AAE5C,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAI3B,CAAA;AAkDF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAyFxD"}

package/lib/gitlab-webhook.js

@@ -1,144 +0,0 @@
-import { createServer } from 'node:http';
-import z from '@deepseek-ai/schemastery';
-import { loadUserConfig } from './config-store.js';
-import { secretsMatch } from './secure-compare.js';
-import { routeGitlabReviewRequest } from './review-intake.js';
-export const name = 'maestro-gitlab-webhook';
-export const Config = z.object({
-    port: z.natural().max(65535).required(),
-    botUsername: z.string(),
-    secret: z.string().role('secret'),
-});
-/** GitLab payloads are small; 5 MB is generous and stops unbounded buffering. */
-const MAX_WEBHOOK_BODY_BYTES = 5 * 1024 * 1024;
-function readBody(req, limit = MAX_WEBHOOK_BODY_BYTES) {
-    return new Promise((resolvePromise) => {
-        let raw = '';
-        let settled = false;
-        req.on('data', (chunk) => {
-            if (settled)
-                return;
-            if (raw.length + chunk.length > limit) {
-                settled = true;
-                req.resume();
-                resolvePromise(undefined);
-                return;
-            }
-            raw += chunk.toString();
-        });
-        req.on('end', () => { if (!settled) {
-            settled = true;
-            resolvePromise(raw);
-        } });
-        req.on('error', () => { if (!settled) {
-            settled = true;
-            resolvePromise(undefined);
-        } });
-    });
-}
-function isValidMrOpenedPayload(value) {
-    if (typeof value !== 'object' || value === null)
-        return false;
-    const v = value;
-    return typeof v.projectPath === 'string'
-        && typeof v.projectId === 'number'
-        && typeof v.mrIid === 'number'
-        && typeof v.sourceBranch === 'string';
-}
-function hasValidGitlabMrIdentity(value) {
-    if (typeof value !== 'object' || value === null)
-        return false;
-    const body = value;
-    const project = body.project;
-    const attributes = body.object_attributes;
-    const mergeRequest = body.merge_request;
-    const source = body.object_kind === 'note' ? mergeRequest : attributes;
-    return typeof project?.id === 'number' && typeof project.path_with_namespace === 'string'
-        && typeof source?.iid === 'number' && typeof source.source_branch === 'string';
-}
-export function apply(ctx, config) {
-    // Settings wins over the boot secret, re-read per request so a change in the
-    // UI takes effect without a restart. With neither source set, every token
-    // fails the comparison (a header string never equals `undefined`), so the
-    // server stays closed until a secret is configured.
-    let warnedUnconfigured = false;
-    async function requestAuthorized(headerValue) {
-        const userConfig = await loadUserConfig();
-        const expected = userConfig.webhookSecret ?? config.secret;
-        if (expected === undefined) {
-            if (!warnedUnconfigured) {
-                warnedUnconfigured = true;
-                console.error('maestro-gitlab-webhook: no webhook secret configured — set one in Maestro Settings or MAESTRO_GITLAB_WEBHOOK_SECRET; rejecting all requests until then');
-            }
-            return false;
-        }
-        return secretsMatch(headerValue, expected);
-    }
-    const server = createServer((req, res) => {
-        if (req.method !== 'POST') {
-            res.writeHead(404).end();
-            return;
-        }
-        void requestAuthorized(req.headers['x-gitlab-token']).then(async (authorized) => {
-            if (!authorized) {
-                res.writeHead(401).end();
-                return;
-            }
-            readBody(req).then(async (raw) => {
-                if (raw === undefined) {
-                    res.writeHead(413).end();
-                    return;
-                }
-                if (req.url === '/hooks/gitlab-mr/trigger') {
-                    let parsed;
-                    try {
-                        parsed = JSON.parse(raw);
-                    }
-                    catch {
-                        res.writeHead(400).end();
-                        return;
-                    }
-                    if (!isValidMrOpenedPayload(parsed)) {
-                        res.writeHead(400).end();
-                        return;
-                    }
-                    const request = {
-                        ...parsed,
-                        trigger: 'mention',
-                        mode: 'quick',
-                        scope: { kind: 'mr' },
-                    };
-                    ctx.emit('maestro/review-request', request);
-                    res.writeHead(200).end();
-                    return;
-                }
-                if (req.url !== '/hooks/gitlab-mr') {
-                    res.writeHead(404).end();
-                    return;
-                }
-                let body;
-                try {
-                    body = JSON.parse(raw);
-                }
-                catch {
-                    res.writeHead(400).end();
-                    return;
-                }
-                const userConfig = await loadUserConfig();
-                if ((body.object_kind === 'merge_request' || body.object_kind === 'note') && !hasValidGitlabMrIdentity(body)) {
-                    res.writeHead(400).end();
-                    return;
-                }
-                const request = routeGitlabReviewRequest(body, userConfig.botUsername ?? config.botUsername ?? 'maestro', { pushEnabled: userConfig.autoRereviewOnPush === true });
-                if (request !== undefined)
-                    ctx.emit('maestro/review-request', request);
-                res.writeHead(200).end();
-            });
-        });
-    });
-    server.listen(config.port);
-    ctx.effect(() => async () => {
-        await new Promise((resolve) => { server.close(() => resolve()); });
-    }, 'gitlab-webhook teardown');
-}
-//# sourceMappingURL=gitlab-webhook.js.map

package/lib/gitlab-webhook.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gitlab-webhook.js","sourceRoot":"","sources":["../src/host/gitlab-webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAwB,MAAM,WAAW,CAAA;AAE9D,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAE7D,MAAM,CAAC,MAAM,IAAI,GAAG,wBAAwB,CAAA;AAc5C,MAAM,CAAC,MAAM,MAAM,GAAc,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;CAClC,CAAC,CAAA;AAQF,iFAAiF;AACjF,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAE9C,SAAS,QAAQ,CAAC,GAAoB,EAAE,KAAK,GAAG,sBAAsB;IACpE,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,OAAO;gBAAE,OAAM;YACnB,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBACtC,OAAO,GAAG,IAAI,CAAA;gBACd,GAAG,CAAC,MAAM,EAAE,CAAA;gBACZ,cAAc,CAAC,SAAS,CAAC,CAAA;gBACzB,OAAM;YACR,CAAC;YACD,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;QACzB,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,cAAc,CAAC,GAAG,CAAC,CAAA;QAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9E,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,cAAc,CAAC,SAAS,CAAC,CAAA;QAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;WACnC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;WAC/B,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;WAC3B,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAA;AACzC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,IAAI,GAAG,KAAgC,CAAA;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAA8C,CAAA;IACnE,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAwD,CAAA;IAChF,MAAM,YAAY,GAAG,IAAI,CAAC,aAAoD,CAAA;IAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAA;IACtE,OAAO,OAAO,OAAO,EAAE,EAAE,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,mBAAmB,KAAK,QAAQ;WACpF,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAA;AAClF,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAc;IAChD,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAA;IAC9B,KAAK,UAAU,iBAAiB,CAAC,WAA0C;QACzE,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAA;QACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,aAAa,IAAI,MAAM,CAAC,MAAM,CAAA;QAC1D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,kBAAkB,GAAG,IAAI,CAAA;gBACzB,OAAO,CAAC,KAAK,CAAC,wJAAwJ,CAAC,CAAA;YACzK,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAC5C,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;YACxB,OAAM;QACR,CAAC;QACD,KAAK,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;gBACxB,OAAM;YACR,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;oBACtB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;oBACxB,OAAM;gBACR,CAAC;gBACD,IAAI,GAAG,CAAC,GAAG,KAAK,0BAA0B,EAAE,CAAC;oBAC3C,IAAI,MAAe,CAAA;oBACnB,IAAI,CAAC;wBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBAC1B,CAAC;oBAAC,MAAM,CAAC;wBACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;wBACxB,OAAM;oBACR,CAAC;oBACD,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;wBACpC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;wBACxB,OAAM;oBACR,CAAC;oBACD,MAAM,OAAO,GAAkB;wBAC7B,GAAG,MAAM;wBACT,OAAO,EAAE,SAAS;wBAClB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;qBACtB,CAAA;oBACD,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;oBAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;oBACxB,OAAM;gBACR,CAAC;gBAED,IAAI,GAAG,CAAC,GAAG,KAAK,kBAAkB,EAAE,CAAC;oBACnC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;oBACxB,OAAM;gBACR,CAAC;gBACD,IAAI,IAAyB,CAAA;gBAC7B,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;oBACxB,OAAM;gBACR,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAA;gBACzC,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,eAAe,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7G,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;oBACxB,OAAM;gBACR,CAAC;gBACD,MAAM,OAAO,GAAG,wBAAwB,CACtC,IAAI,EACJ,UAAU,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,IAAI,SAAS,EACzD,EAAE,WAAW,EAAE,UAAU,CAAC,kBAAkB,KAAK,IAAI,EAAE,CACxD,CAAA;gBACD,IAAI,OAAO,KAAK,SAAS;oBAAE,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;gBACtE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;YAC1B,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAE1B,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE;QAC1B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IACzE,CAAC,EAAE,yBAAyB,CAAC,CAAA;AAC/B,CAAC"}

package/src/host/gitlab-webhook.ts

@@ -1,166 +0,0 @@
-import { createServer, type IncomingMessage } from 'node:http'
-import type { Context } from '@deepseek-ai/cordis'
-import z from '@deepseek-ai/schemastery'
-import { loadUserConfig } from './config-store.js'
-import { secretsMatch } from './secure-compare.js'
-import type { MrOpenedPayload, ReviewRequest } from './events.ts'
-import { routeGitlabReviewRequest } from './review-intake.js'
-
-export const name = 'maestro-gitlab-webhook'
-
-export interface Config {
-  port: number
-  /** Username of the GitLab service account used for reviewer assignments. */
-  botUsername?: string
-  /**
-   * Fallback when Maestro Settings has no webhook secret; optional so a
-   * deployment that configures everything through Settings boots without env
-   * vars. With neither source set, every request is rejected (fail closed).
-   */
-  secret?: string
-}
-
-export const Config: z<Config> = z.object({
-  port: z.natural().max(65535).required(),
-  botUsername: z.string(),
-  secret: z.string().role('secret'),
-})
-
-interface GitlabMrWebhookBody {
-  object_kind: string
-  project: { id: number; path_with_namespace: string }
-  object_attributes: { iid: number; action: string; source_branch: string }
-}
-
-/** GitLab payloads are small; 5 MB is generous and stops unbounded buffering. */
-const MAX_WEBHOOK_BODY_BYTES = 5 * 1024 * 1024
-
-function readBody(req: IncomingMessage, limit = MAX_WEBHOOK_BODY_BYTES): Promise<string | undefined> {
-  return new Promise((resolvePromise) => {
-    let raw = ''
-    let settled = false
-    req.on('data', (chunk: Buffer) => {
-      if (settled) return
-      if (raw.length + chunk.length > limit) {
-        settled = true
-        req.resume()
-        resolvePromise(undefined)
-        return
-      }
-      raw += chunk.toString()
-    })
-    req.on('end', () => { if (!settled) { settled = true; resolvePromise(raw) } })
-    req.on('error', () => { if (!settled) { settled = true; resolvePromise(undefined) } })
-  })
-}
-
-function isValidMrOpenedPayload(value: unknown): value is MrOpenedPayload {
-  if (typeof value !== 'object' || value === null) return false
-  const v = value as Record<string, unknown>
-  return typeof v.projectPath === 'string'
-    && typeof v.projectId === 'number'
-    && typeof v.mrIid === 'number'
-    && typeof v.sourceBranch === 'string'
-}
-
-function hasValidGitlabMrIdentity(value: unknown): boolean {
-  if (typeof value !== 'object' || value === null) return false
-  const body = value as Record<string, unknown>
-  const project = body.project as Record<string, unknown> | undefined
-  const attributes = body.object_attributes as Record<string, unknown> | undefined
-  const mergeRequest = body.merge_request as Record<string, unknown> | undefined
-  const source = body.object_kind === 'note' ? mergeRequest : attributes
-  return typeof project?.id === 'number' && typeof project.path_with_namespace === 'string'
-    && typeof source?.iid === 'number' && typeof source.source_branch === 'string'
-}
-
-export function apply(ctx: Context, config: Config): void {
-  // Settings wins over the boot secret, re-read per request so a change in the
-  // UI takes effect without a restart. With neither source set, every token
-  // fails the comparison (a header string never equals `undefined`), so the
-  // server stays closed until a secret is configured.
-  let warnedUnconfigured = false
-  async function requestAuthorized(headerValue: string | string[] | undefined): Promise<boolean> {
-    const userConfig = await loadUserConfig()
-    const expected = userConfig.webhookSecret ?? config.secret
-    if (expected === undefined) {
-      if (!warnedUnconfigured) {
-        warnedUnconfigured = true
-        console.error('maestro-gitlab-webhook: no webhook secret configured — set one in Maestro Settings or MAESTRO_GITLAB_WEBHOOK_SECRET; rejecting all requests until then')
-      }
-      return false
-    }
-    return secretsMatch(headerValue, expected)
-  }
-
-  const server = createServer((req, res) => {
-    if (req.method !== 'POST') {
-      res.writeHead(404).end()
-      return
-    }
-    void requestAuthorized(req.headers['x-gitlab-token']).then(async (authorized) => {
-      if (!authorized) {
-        res.writeHead(401).end()
-        return
-      }
-      readBody(req).then(async (raw) => {
-        if (raw === undefined) {
-          res.writeHead(413).end()
-          return
-        }
-        if (req.url === '/hooks/gitlab-mr/trigger') {
-          let parsed: unknown
-          try {
-            parsed = JSON.parse(raw)
-          } catch {
-            res.writeHead(400).end()
-            return
-          }
-          if (!isValidMrOpenedPayload(parsed)) {
-            res.writeHead(400).end()
-            return
-          }
-          const request: ReviewRequest = {
-            ...parsed,
-            trigger: 'mention',
-            mode: 'quick',
-            scope: { kind: 'mr' },
-          }
-          ctx.emit('maestro/review-request', request)
-          res.writeHead(200).end()
-          return
-        }
-
-        if (req.url !== '/hooks/gitlab-mr') {
-          res.writeHead(404).end()
-          return
-        }
-        let body: GitlabMrWebhookBody
-        try {
-          body = JSON.parse(raw)
-        } catch {
-          res.writeHead(400).end()
-          return
-        }
-        const userConfig = await loadUserConfig()
-        if ((body.object_kind === 'merge_request' || body.object_kind === 'note') && !hasValidGitlabMrIdentity(body)) {
-          res.writeHead(400).end()
-          return
-        }
-        const request = routeGitlabReviewRequest(
-          body,
-          userConfig.botUsername ?? config.botUsername ?? 'maestro',
-          { pushEnabled: userConfig.autoRereviewOnPush === true },
-        )
-        if (request !== undefined) ctx.emit('maestro/review-request', request)
-        res.writeHead(200).end()
-      })
-    })
-  })
-
-  server.listen(config.port)
-
-  ctx.effect(() => async () => {
-    await new Promise<void>((resolve) => { server.close(() => resolve()) })
-  }, 'gitlab-webhook teardown')
-}