@ddtcorex/dsh-maestro-review 0.4.0 → 0.5.1

package/profiles/reviewer-ci/pnpm-lock.yaml

@@ -0,0 +1,62 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    dependencies:
+      '@ddtcorex/dsh-maestro-review':
+        specifier: link:../../packages/dsh-maestro-review
+        version: link:../../packages/dsh-maestro-review
+      '@ddtcorex/maestro-skills':
+        specifier: ^2.11.0
+        version: 2.11.0(@deepseek-ai/cordis@4.0.2)
+      '@deepseek-ai/dsh-agent-presets':
+        specifier: link:../../deepseek-harness/packages/preset/agent-presets
+        version: link:../../deepseek-harness/packages/preset/agent-presets
+      '@deepseek-ai/dsh-base':
+        specifier: link:../../deepseek-harness/packages/bundle/base
+        version: link:../../deepseek-harness/packages/bundle/base
+
+packages:
+
+  '@ddtcorex/maestro-skills@2.11.0':
+    resolution: {integrity: sha512-S+Nh8jYct1shXuluvveXZIo38wnyTVFMf1A4fNrUi7Ht3Bo6rFio++YqCjf3RL6RIO+mvytTq5ux1hMnc2Ti0w==}
+    peerDependencies:
+      '@deepseek-ai/cordis': ^4.0.0
+
+  '@deepseek-ai/cordis@4.0.2':
+    resolution: {integrity: sha512-asOnXP1TzFSFQlHb1iegDZp0z/8WD1c7YNrwJR/Tx2bzNuMXfcekE/I67Iv6SQXeLB4csxqCngzQKANP7gdw0g==}
+    hasBin: true
+    peerDependencies:
+      '@deepseek-ai/cordis-plugin-include': ^1.0.7
+      '@deepseek-ai/cordis-plugin-loader': ^1.0.3
+    peerDependenciesMeta:
+      '@deepseek-ai/cordis-plugin-include':
+        optional: true
+      '@deepseek-ai/cordis-plugin-loader':
+        optional: true
+
+  '@deepseek-ai/cosmokit@1.8.3':
+    resolution: {integrity: sha512-qBo+ronVM6Eu2WNVJXi8JcMiqZ19T9BRIpV+5qJUFPXjGH/Z0QKcQMC/IZJ7L394YTOtJgcovbk9qP0w2GsBXQ==}
+
+  '@standard-schema/spec@1.1.0':
+    resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
+
+snapshots:
+
+  '@ddtcorex/maestro-skills@2.11.0(@deepseek-ai/cordis@4.0.2)':
+    dependencies:
+      '@deepseek-ai/cordis': 4.0.2
+
+  '@deepseek-ai/cordis@4.0.2':
+    dependencies:
+      '@deepseek-ai/cosmokit': 1.8.3
+      '@standard-schema/spec': 1.1.0
+
+  '@deepseek-ai/cosmokit@1.8.3': {}
+
+  '@standard-schema/spec@1.1.0': {}

package/profiles/reviewer-ci/pnpm-workspace.yaml

@@ -0,0 +1,12 @@
+# Marks profiles/reviewer-ci as its OWN standalone pnpm workspace root — without
+# this file, pnpm's workspace-root detection walks up and finds
+# packages/dsh-maestro-review's own pnpm-workspace.yaml two levels up (this
+# profile is nested inside that package's directory tree), silently folding
+# the profile into that unrelated workspace instead of installing it
+# independently (verified 2026-09-03: `pnpm --dir profiles/reviewer-ci install`
+# printed "Scope: all 2 workspace projects" and resolved relative to `../..`
+# without this file present).
+packages: []
+minimumReleaseAgeExclude:
+  - '@ddtcorex/dsh-maestro-review@0.3.1'
+  - '@ddtcorex/maestro-skills@2.11.0'

package/src/host/ci-clone.ts

@@ -0,0 +1,54 @@
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { gitlabAuthHeaders } from './gitlab-auth.js'
+
+/**
+ * Source checkout for CI deep reviews (spec §3): clone the source project at
+ * the MR head SHA with the PAT over oauth2. The token lives only in the clone
+ * URL passed to git — errors rethrown here are redacted, and the clone dir is
+ * ephemeral (fresh container per job; the orchestrator removes it in `finally`).
+ */
+
+export type RunFn = (cmd: string, args: string[], cwd?: string) => Promise<void>
+
+const execFileAsync = promisify(execFile)
+
+/** Production runner (execFile — no shell, argv cannot leak into shell history). */
+export const defaultRun: RunFn = async (cmd, args, cwd) => {
+  await execFileAsync(cmd, args, { cwd, timeout: 120_000 })
+}
+
+export function redactCloneUrl(url: string): string {
+  return url.replace(/oauth2:[^@]+@/, 'oauth2:***@')
+}
+
+async function repoHttpUrl(fetcher: typeof fetch, host: string, projectId: number, token: string): Promise<string> {
+  const res = await fetcher(`https://${host}/api/v4/projects/${projectId}`, { headers: gitlabAuthHeaders(token) })
+  if (!res.ok) throw new Error(`GitLab API error ${res.status}: ${(await res.text()).slice(0, 200)}`)
+  const body = (await res.json()) as { http_url_to_repo?: string }
+  if (!body.http_url_to_repo) throw new Error('project has no http_url_to_repo')
+  return body.http_url_to_repo
+}
+
+export async function cloneSourceRepo(opts: {
+  fetcher: typeof fetch
+  run: RunFn
+  host: string
+  projectId: number
+  sourceBranch: string
+  headSha: string
+  token: string
+  dir: string
+}): Promise<string> {
+  const httpUrl = await repoHttpUrl(opts.fetcher, opts.host, opts.projectId, opts.token)
+  const authed = httpUrl.replace('https://', `https://oauth2:${opts.token}@`)
+  try {
+    await opts.run('git', ['clone', '--depth', '50', '--branch', opts.sourceBranch, '--', authed, opts.dir])
+    await opts.run('git', ['fetch', '--depth', '50', 'origin', opts.headSha], opts.dir)
+    await opts.run('git', ['checkout', '--detach', opts.headSha], opts.dir)
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err)
+    throw new Error(redactCloneUrl(message))
+  }
+  return opts.dir
+}

package/src/host/ci-coexist.ts

@@ -0,0 +1,45 @@
+import { gitlabAuthHeaders } from './gitlab-auth.js'
+import { parseReviewMarker } from './review-marker.js'
+
+/**
+ * Coexistence checks (spec §4): the CI flow yields to a completed review of
+ * the same head SHA carrying a review marker (i.e. an earlier CI review —
+ * webhook reviews post marker-free and stay invisible here) and to an
+ * in-flight review (eyes running-marker). Fetch failures fail open toward
+ * running — a missing signal must never block a review, only a present one
+ * skips it.
+ */
+export async function hasCompletedReviewForSha(
+  fetcher: typeof fetch, baseUrl: string, token: string, projectId: number, mrIid: number, sha: string,
+): Promise<boolean> {
+  try {
+    const res = await fetcher(
+      `${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/notes?per_page=100&sort=desc&order_by=created_at`,
+      { headers: gitlabAuthHeaders(token) },
+    )
+    if (!res.ok) return false
+    const notes = (await res.json()) as Array<{ body?: string }>
+    return notes.some((n) => {
+      const m = typeof n.body === 'string' ? parseReviewMarker(n.body) : undefined
+      return m?.sha.toLowerCase() === sha.toLowerCase() && m?.status === 'completed'
+    })
+  } catch {
+    return false
+  }
+}
+
+export async function hasRunningEyes(
+  fetcher: typeof fetch, baseUrl: string, token: string, projectId: number, mrIid: number,
+): Promise<boolean> {
+  try {
+    const res = await fetcher(
+      `${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji`,
+      { headers: gitlabAuthHeaders(token) },
+    )
+    if (!res.ok) return false
+    const awards = (await res.json()) as Array<{ name?: string }>
+    return awards.some((a) => a.name === 'eyes')
+  } catch {
+    return false
+  }
+}

package/src/host/config-store.ts

@@ -14,17 +14,30 @@ export interface ReviewModelSelection {
   reasoningEffort?: string
 }
 
+export interface ProjectMapping {
+  projectPath: string
+  localRepoPath: string
+  reviewProfile?: ReviewSkillProfile
+  reviewModel?: ReviewModelSelection
+  /** Per-project override of autoRereviewOnPush (undefined = inherit global). */
+  rereviewOnPush?: boolean
+  /** Per-project override of autoReviewOnAssign (undefined = inherit global). */
+  reviewOnAssign?: boolean
+}
+
 export interface MaestroUserConfig {
   gitlabBaseUrl?: string
   gitlabToken?: string
   botUsername?: string
   webhookSecret?: string
   webhookPort?: number
-  projectMappings?: Array<{ projectPath: string; localRepoPath: string; reviewProfile?: ReviewSkillProfile; reviewModel?: ReviewModelSelection }>
+  projectMappings?: Array<ProjectMapping>
   /** Override the DSH default model for automated reviews. When absent the global DSH default is used. */
   reviewModel?: ReviewModelSelection
   /** Re-run a quick review whenever new commits land on a previously reviewed MR. */
   autoRereviewOnPush?: boolean
+  /** Trigger an automatic quick review when the bot is assigned as MR reviewer (default true). */
+  autoReviewOnAssign?: boolean
   /** Bound one automated review agent's turn. */
   agentTimeoutMs?: number
   /** Prune Maestro's own review records older than this many days (0 = keep forever). */

package/src/host/events.ts

@@ -11,15 +11,44 @@ export type ReviewScope =
   | { kind: 'mr' }
   | { kind: 'discussion'; discussionId: string; path: string; line: number }
 
+import type { ReviewSkillProfile } from './skills-tool.js'
+
 export interface ReviewRequest extends MrOpenedPayload {
   /** `push` arrives only when auto re-review on push is enabled and passes the completed-history gate. */
   trigger: 'reviewer-assignment' | 'mention' | 'push'
   mode: ReviewMode
   scope: ReviewScope
+  /**
+   * CI-only override (ci-trigger sets it from REVIEW_PROFILE). The GitLab webhook
+   * producer never sets it — mapped projects resolve their profile from the mapping.
+   * Undefined preserves the legacy diff-only generic review.
+   */
+  reviewProfile?: ReviewSkillProfile
+  /**
+   * CI-only: MR head SHA from fetchMrDetail (ci-trigger sets it). Feeds the
+   * comment marker so later CI runs can yield to this review. The GitLab
+   * webhook producer never sets it — webhook comments stay marker-free.
+   */
+  headSha?: string
+  /** Short (8-char) head-sha hint for `push` triggers, taken from the webhook
+   * body — feeds the in-flight key so two concurrent pushes stop deduping
+   * each other. Absent when the body carries no sha. */
+  pushSha?: string
+}
+
+export interface ReviewResult {
+  /** false = the review could not run or failed outright (infra error) — a CI caller should exit non-zero. */
+  ok: boolean
+  summary?: string
+  failures: string[]
+  durationMs: number
 }
 
 declare module '@deepseek-ai/cordis' {
   interface Events {
     'maestro/review-request': (payload: ReviewRequest) => void
   }
+  interface Context {
+    reviewRunner: (payload: ReviewRequest) => Promise<ReviewResult>
+  }
 }

package/src/host/gitlab-auth.ts

@@ -0,0 +1,13 @@
+/**
+ * Centralized GitLab API auth header (spec: token-kind aware).
+ *
+ * Personal / project / group tokens authenticate with `PRIVATE-TOKEN`.
+ * A CI job token (`CI_JOB_TOKEN`, cross-project via the target's job-token
+ * allowlist) authenticates with `JOB-TOKEN` instead — `PRIVATE-TOKEN` 401s.
+ * The kind comes from `GITLAB_TOKEN_KIND=job` (set by docker/entrypoint.sh
+ * when it falls back to `CI_JOB_TOKEN`); anything else means PRIVATE-TOKEN.
+ */
+export function gitlabAuthHeaders(token: string): Record<string, string> {
+  if (process.env.GITLAB_TOKEN_KIND === 'job') return { 'JOB-TOKEN': token }
+  return { 'PRIVATE-TOKEN': token }
+}

package/src/host/gitlab-client.ts

@@ -3,6 +3,7 @@ import z from '@deepseek-ai/schemastery'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import { mkdirSync, writeFileSync } from 'node:fs'
 import { join, resolve } from 'node:path'
+import { gitlabAuthHeaders } from './gitlab-auth.js'
 
 export const name = 'maestro-gitlab-client'
 export const inject = ['tools']
@@ -46,6 +47,27 @@ export function selectFileDiff(diffs: GitlabDiff[], path: string): string | unde
   return `--- ${d.old_path}\n+++ ${d.new_path}\n${d.diff}`
 }
 
+/**
+ * `fetch` with a hard ceiling: aborts the request after `ms` (default 15s)
+ * and throws `GitLab API timeout after <ms>ms` on abort. The timer is always
+ * cleared on settle. Pre-agent lookups degrade the throw to `undefined` at
+ * their own call site; post-agent callers let it reach `writeFailedReport`.
+ */
+export async function fetchWithTimeout(
+  url: string, init: RequestInit | undefined, ms = 15_000,
+): Promise<Response> {
+  const controller = new AbortController()
+  const timer = setTimeout(() => controller.abort(), ms)
+  try {
+    return await fetch(url, { ...init, signal: controller.signal })
+  } catch (err) {
+    if ((err as Error)?.name === 'AbortError') throw new Error(`GitLab API timeout after ${ms}ms`)
+    throw err
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
 interface GitlabDiffRefs {
   base_sha: string
   start_sha: string
@@ -119,7 +141,7 @@ export function selectOwnThreads(
 
 export function apply(ctx: Context, config: Config): void {
   const apiBase = `${config.baseUrl}/api/v4/projects/${config.projectId}/merge_requests/${config.mrIid}`
-  const headers = { 'PRIVATE-TOKEN': config.token }
+  const headers = gitlabAuthHeaders(config.token)
   let cachedDiffRefs: GitlabDiffRefs | undefined
   let cachedDiffs: GitlabDiff[] | undefined
 

package/src/host/incremental.ts

@@ -1,3 +1,5 @@
+import { gitlabAuthHeaders } from './gitlab-auth.js'
+import { fetchWithTimeout } from './gitlab-client.js'
 export interface CompareCommit {
   short_id?: string
   title?: string
@@ -55,9 +57,9 @@ export async function fetchMrDetailHeadSha(
   baseUrl: string, token: string, projectId: number, mrIid: number,
 ): Promise<string | undefined> {
   try {
-    const response = await fetch(
+    const response = await fetchWithTimeout(
       `${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}`,
-      { headers: { 'PRIVATE-TOKEN': token } },
+      { headers: gitlabAuthHeaders(token) },
     )
     if (!response.ok) return undefined
     const body = await response.json() as { diff_refs?: { head_sha?: string } }
@@ -72,9 +74,9 @@ export async function fetchCompare(
   baseUrl: string, token: string, projectId: number, from: string, to: string,
 ): Promise<CompareResult | undefined> {
   try {
-    const response = await fetch(
+    const response = await fetchWithTimeout(
       `${baseUrl}/api/v4/projects/${projectId}/repository/compare?from=${encodeURIComponent(from)}&to=${encodeURIComponent(to)}`,
-      { headers: { 'PRIVATE-TOKEN': token } },
+      { headers: gitlabAuthHeaders(token) },
     )
     if (!response.ok) return undefined
     return await response.json() as CompareResult