@ddtcorex/dsh-maestro-review 0.4.0 → 0.5.1

package/src/host/providers/ci-trigger.ts

@@ -0,0 +1,168 @@
+import type { Context } from '@deepseek-ai/cordis'
+import z from '@deepseek-ai/schemastery'
+import { join } from 'node:path'
+import type { ReviewRequest, ReviewResult } from '../events.js'
+import { lastCompletedReview } from '../review-history.js'
+import type { ReviewSkillProfile } from '../skills-tool.js'
+import { gitlabAuthHeaders } from '../gitlab-auth.js'
+import { hasCompletedReviewForSha, hasRunningEyes } from '../ci-coexist.js'
+
+export const name = 'maestro-review-ci-trigger'
+export const inject = ['reviewRunner'] as const
+
+const REVIEW_PROFILES = ['magento2', 'laravel', 'symfony', 'wordpress', 'generic'] as const
+
+export interface CiEnvConfig {
+  gitlabBaseUrl: string
+  gitlabToken: string
+  sourceProjectId: number
+  mrIid: number
+  mode: 'quick' | 'deep'
+  dryRun: boolean
+  reviewProfile?: ReviewSkillProfile
+  /** Mirror of Settings UI autoRereviewOnPush (default off): re-review new pushes. */
+  rereviewOnPush: boolean
+}
+
+export const CiEnvConfig: z<CiEnvConfig> = z.object({
+  gitlabBaseUrl: z.string().required(),
+  gitlabToken: z.string().role('secret').required(),
+  sourceProjectId: z.number().required(),
+  mrIid: z.number().required(),
+  mode: z.union([z.const('quick'), z.const('deep')]).default('quick'),
+  dryRun: z.boolean().default(false),
+  reviewProfile: z.union([z.const('magento2'), z.const('laravel'), z.const('symfony'), z.const('wordpress'), z.const('generic')]),
+  rereviewOnPush: z.boolean().default(false),
+})
+
+/**
+ * Reads the CI contract env vars (spec §5.2) — not Cordis-supplied config, since these are
+ * per-run values a static profile config cannot hold. schemastery's `.required()` only rejects
+ * `undefined`, not an empty string, so GITLAB_HOST/MAESTRO_GITLAB_TOKEN presence is checked here
+ * before defaulting to `''` — otherwise a missing env var would silently pass validation.
+ */
+export function parseCiEnvConfig(env: Record<string, string | undefined>): CiEnvConfig {
+  if (env.GITLAB_HOST === undefined) throw new Error('missing GITLAB_HOST')
+  if (env.MAESTRO_GITLAB_TOKEN === undefined) throw new Error('missing MAESTRO_GITLAB_TOKEN')
+  if (env.REVIEW_PROFILE !== undefined && !(REVIEW_PROFILES as readonly string[]).includes(env.REVIEW_PROFILE)) {
+    throw new Error(`unsupported REVIEW_PROFILE "${env.REVIEW_PROFILE}" (supported: ${REVIEW_PROFILES.join(', ')})`)
+  }
+  return CiEnvConfig({
+    gitlabBaseUrl: `https://${env.GITLAB_HOST}`,
+    gitlabToken: env.MAESTRO_GITLAB_TOKEN,
+    sourceProjectId: Number(env.SOURCE_PROJECT_ID),
+    mrIid: Number(env.MR_IID),
+    mode: env.REVIEW_MODE === 'deep' ? 'deep' : 'quick',
+    dryRun: env.REVIEW_DRY_RUN === '1',
+    reviewProfile: env.REVIEW_PROFILE as ReviewSkillProfile | undefined,
+    rereviewOnPush: env.REVIEW_ON_PUSH === '1',
+  })
+}
+
+/** The one field a webhook payload carries that env vars don't — orchestrator fetches the diff itself. */
+export async function fetchMrSourceBranch(config: CiEnvConfig, fetcher: typeof fetch = fetch): Promise<string> {
+  return (await fetchMrDetail(config, fetcher)).sourceBranch
+}
+
+/** MR detail pieces CI needs in one call: source branch (worktree) + head SHA (push-gate) + project path (comment header/link). */
+export async function fetchMrDetail(config: CiEnvConfig, fetcher: typeof fetch = fetch): Promise<{ sourceBranch: string; headSha: string; projectPath: string }> {
+  const url = `${config.gitlabBaseUrl}/api/v4/projects/${config.sourceProjectId}/merge_requests/${config.mrIid}`
+  const res = await fetcher(url, { headers: gitlabAuthHeaders(config.gitlabToken) })
+  if (!res.ok) throw new Error(`GitLab API error ${res.status}: ${await res.text()}`)
+  const body = await res.json() as { source_branch?: string; sha?: string; references?: { full?: string } }
+  if (typeof body.source_branch !== 'string') throw new Error('GitLab merge request response is missing source_branch')
+  if (typeof body.sha !== 'string') throw new Error('GitLab merge request response is missing sha')
+  // references.full looks like "group/sub/project!123" — the real path feeds the
+  // comment header and View-MR link. Absent on old servers: fall back to project/<id>.
+  const full = body.references?.full
+  const projectPath = typeof full === 'string' && full.includes('!') ? full.slice(0, full.indexOf('!')) : `project/${config.sourceProjectId}`
+  return { sourceBranch: body.source_branch, headSha: body.sha, projectPath }
+}
+
+export async function runCiTrigger(
+  ctx: Context,
+  config: CiEnvConfig,
+  deps: {
+    fetcher?: typeof fetch
+    writeFile?: typeof import('node:fs/promises').writeFile
+    history?: { lastCompletedReview(projectId: number, mrIid: number): Promise<{ headSha?: string } | undefined> }
+  } = {},
+): Promise<ReviewResult> {
+  const { sourceBranch, headSha, projectPath } = await fetchMrDetail(config, deps.fetcher)
+  // Push-gate (mirror of the webhook autoRereviewOnPush semantics): the bridge fires
+  // on every MR pipeline, so skip when this exact head SHA already completed — and
+  // skip new pushes too unless REVIEW_ON_PUSH=1. A re-run then gets the H6 incremental
+  // block from history for free. Cache miss (no history) fails open toward running.
+  const history = deps.history ?? { lastCompletedReview }
+  const prior = await history.lastCompletedReview(config.sourceProjectId, config.mrIid)
+  let result: ReviewResult
+  if (prior?.headSha === headSha) {
+    result = { ok: true, summary: `already reviewed at ${headSha}, skipping`, failures: [], durationMs: 0 }
+  } else if (prior !== undefined && !config.rereviewOnPush) {
+    result = { ok: true, summary: `new commits since ${prior.headSha} but REVIEW_ON_PUSH is not set, skipping`, failures: [], durationMs: 0 }
+  } else {
+    // Coexistence (CI yields to webhook): the CI history store is invisible to
+    // the webhook flow and vice versa, so check the MR itself for a completed
+    // review marker of this SHA or an in-flight eyes marker before booting.
+    const coFetcher = deps.fetcher ?? fetch
+    if (await hasCompletedReviewForSha(coFetcher, config.gitlabBaseUrl, config.gitlabToken, config.sourceProjectId, config.mrIid, headSha)) {
+      result = { ok: true, summary: `webhook already reviewed ${headSha} — skipping`, failures: [], durationMs: 0 }
+    } else if (await hasRunningEyes(coFetcher, config.gitlabBaseUrl, config.gitlabToken, config.sourceProjectId, config.mrIid)) {
+      result = { ok: true, summary: 'another review is running — skipping', failures: [], durationMs: 0 }
+    } else {
+    // The reviewer-ci profile's own projectMappings is always [], so the
+    // orchestrator's mapping lookup on projectPath never matches regardless
+    // of its exact value — but the real path feeds the comment header and
+    // View-MR link, so prefer it over the synthetic project/<id> fallback.
+    const request: ReviewRequest = {
+      projectPath,
+      projectId: config.sourceProjectId,
+      mrIid: config.mrIid,
+      sourceBranch,
+      headSha,
+      trigger: 'mention',
+      mode: config.mode,
+      scope: { kind: 'mr' },
+      reviewProfile: config.reviewProfile,
+    }
+    result = await ctx.reviewRunner(request)
+    }
+  }
+  const { writeFile } = deps.writeFile !== undefined ? { writeFile: deps.writeFile } : await import('node:fs/promises')
+  // entrypoint.sh cds into deepseek-harness before execing dsh, so a bare relative
+  // path would land inside the harness checkout (lost with the container). The
+  // entrypoint exports REVIEW_REPORT_DIR=$PWD captured before the cd, so reports land
+  // in the CI job's working directory where `artifacts:` picks them up.
+  const reportDir = process.env.REVIEW_REPORT_DIR?.trim() || '.'
+  const report = { ...result, projectId: config.sourceProjectId, mrIid: config.mrIid, mode: config.mode, generatedAt: new Date().toISOString() }
+  await writeFile(join(reportDir, 'review-report.json'), JSON.stringify(report, null, 2), 'utf-8')
+  const md = `# Review Report\n\n**Project:** ${config.sourceProjectId} !${config.mrIid}\n**Mode:** ${config.mode}\n**Duration:** ${result.durationMs}ms\n\n${result.summary ?? '(no summary)'}\n${result.failures.length > 0 ? `\nFailures:\n${result.failures.map(f => `- ${f}`).join('\n')}\n` : ''}`
+  await writeFile(join(reportDir, 'review-report.md'), md, 'utf-8')
+  return result
+}
+
+export function apply(ctx: Context): void {
+  ctx.effect(() => {
+    void (async () => {
+      try {
+        const config = parseCiEnvConfig(process.env)
+        console.log(`[review] ci-trigger starting: project ${config.sourceProjectId} !${config.mrIid} mode=${config.mode} dryRun=${config.dryRun}`)
+        const result = config.dryRun
+          ? { ok: true, summary: '[dry-run] config valid, skipping review', failures: [], durationMs: 0 }
+          : await runCiTrigger(ctx, config)
+        console.log(`[review] ci-trigger finished: ok=${result.ok} summary=${JSON.stringify(result.summary)} failures=${result.failures.length}`)
+        for (const failure of result.failures) console.error(`[review] ci-trigger failure: ${failure}`)
+        const exit = ctx.get('appExit')
+        if (exit === undefined) {
+          console.error('[review] ctx.get(\'appExit\') is undefined — the launcher did not provide it, process cannot signal its real exit code')
+        } else {
+          exit(result.ok ? 0 : 1)
+        }
+      } catch (err) {
+        console.error('maestro-review-ci-trigger:', err instanceof Error ? err.message : String(err))
+        ctx.get('appExit')?.(1)
+      }
+    })()
+    return () => {}
+  }, 'maestro-review-ci-trigger run')
+}

package/src/host/providers/gitlab.ts

@@ -4,7 +4,7 @@ import z from '@deepseek-ai/schemastery'
 import { loadUserConfig } from '../config-store.js'
 import { secretsMatch } from '../secure-compare.js'
 import type { MrOpenedPayload, ReviewRequest as OrchestratorReviewRequest } from '../events.js'
-import { routeGitlabReviewRequest } from '../review-intake.js'
+import { describeDrop, routeGitlabReviewRequest } from '../review-intake.js'
 import type { ReviewProvider, ReviewRequest } from './interface.js'
 
 export const name = 'maestro-review-webhook'
@@ -127,9 +127,24 @@ export function apply(ctx: Context, config: Config): void {
         }
         let body: GitlabMrWebhookBody; try { body = JSON.parse(raw) } catch { res.writeHead(400).end(); return }
         const userConfig = await loadUserConfig()
-        if ((body.object_kind === 'merge_request' || body.object_kind === 'note') && !hasValidGitlabMrIdentity(body)) { res.writeHead(400).end(); return }
-        const request = routeGitlabReviewRequest(body, userConfig.botUsername ?? config.botUsername ?? 'maestro', { pushEnabled: userConfig.autoRereviewOnPush === true })
-        if (request !== undefined) ctx.emit('maestro/review-request', request)
+        const botUsername = userConfig.botUsername ?? config.botUsername ?? 'maestro'
+        if ((body.object_kind === 'merge_request' || body.object_kind === 'note') && !hasValidGitlabMrIdentity(body)) {
+          console.error(`maestro-review-webhook: drop invalid-identity object_kind=${(body as { object_kind?: unknown }).object_kind ?? 'unknown'}`)
+          res.writeHead(400).end(); return
+        }
+        // The orchestrator is the sole push gate (resolveReviewTriggers);
+        // intake always emits so per-project overrides keep working.
+        const request = routeGitlabReviewRequest(body, botUsername, { pushEnabled: true })
+        if (request === undefined) {
+          const reason = describeDrop(body, botUsername, { pushEnabled: true })
+          if (reason !== undefined) {
+            const project = (body as { project?: { path_with_namespace?: unknown } }).project
+            const source = (body as { object_attributes?: { iid?: unknown } }).object_attributes
+            console.error(`maestro-review-webhook: drop ${reason} project=${typeof project?.path_with_namespace === 'string' ? project.path_with_namespace : 'unknown'} mr=!${typeof source?.iid === 'number' ? source.iid : '?'}`)
+          }
+        } else {
+          ctx.emit('maestro/review-request', request)
+        }
         res.writeHead(200).end()
       })
     }

package/src/host/review-history.ts

@@ -64,10 +64,12 @@ function failStaleRunning(entries: ReviewHistoryEntry[]): boolean {
 
 /** Prepend a running entry; the oldest entries fall off past `HISTORY_CAP`. */
 export async function recordReviewStart(entry: Omit<ReviewHistoryEntry, 'status'>, dshHome?: string): Promise<void> {
-  const all = await readAll(dshHome)
-  if (failStaleRunning(all)) await writeAll(all, dshHome)
-  all.unshift({ ...entry, status: 'running' })
-  await writeAll(all.slice(0, HISTORY_CAP), dshHome)
+  return withHistoryLock(async () => {
+    const all = await readAll(dshHome)
+    if (failStaleRunning(all)) await writeAll(all, dshHome)
+    all.unshift({ ...entry, status: 'running' })
+    await writeAll(all.slice(0, HISTORY_CAP), dshHome)
+  })
 }
 
 /** Attach an outcome to the entry with this id; unknown ids are ignored. */
@@ -76,11 +78,13 @@ export async function recordReviewFinish(
   patch: { status: 'completed' | 'failed'; summary?: string; error?: string },
   dshHome?: string,
 ): Promise<void> {
-  const all = await readAll(dshHome)
-  const entry = all.find((candidate) => candidate.id === id)
-  if (entry === undefined) return
-  Object.assign(entry, patch, { finishedAt: Date.now() })
-  await writeAll(all, dshHome)
+  return withHistoryLock(async () => {
+    const all = await readAll(dshHome)
+    const entry = all.find((candidate) => candidate.id === id)
+    if (entry === undefined) return
+    Object.assign(entry, patch, { finishedAt: Date.now() })
+    await writeAll(all, dshHome)
+  })
 }
 
 /** Newest-first slice of the log. */
@@ -103,36 +107,62 @@ export async function lastCompletedReview(projectId: number, mrIid: number, dshH
 /**
  * Drop history entries and failed-report files older than `retentionDays`.
  * `0` disables pruning entirely. Maestro records only — DSH session
- * transcripts are never touched.
+ * transcripts are never touched. Entries still `running` are always kept:
+ * a prune must never delete a review that just started (see D3).
  */
 export async function pruneHistory(retentionDays: number, dshHome?: string): Promise<void> {
   if (!Number.isFinite(retentionDays) || retentionDays <= 0) return
-  const all = await readAll(dshHome)
-  failStaleRunning(all)
-  const cutoff = Date.now() - retentionDays * DAY_MS
-  const kept: ReviewHistoryEntry[] = []
-  for (const entry of all) {
-    if ((entry.finishedAt ?? entry.startedAt) < cutoff) continue
-    kept.push(entry)
-  }
-  await writeAll(kept, dshHome)
+  return withHistoryLock(async () => {
+    const all = await readAll(dshHome)
+    failStaleRunning(all)
+    const cutoff = Date.now() - retentionDays * DAY_MS
+    const kept: ReviewHistoryEntry[] = []
+    for (const entry of all) {
+      if (entry.status === 'running') {
+        kept.push(entry)
+        continue
+      }
+      if ((entry.finishedAt ?? entry.startedAt) < cutoff) continue
+      kept.push(entry)
+    }
+    await writeAll(kept, dshHome)
+  }).then(async () => {
+    const home = dshHome ?? process.env.DSH_HOME ?? join(homedir(), '.dsh')
+    const failedDir = join(home, 'maestro', 'failed-reports')
+    const cutoff = Date.now() - retentionDays * DAY_MS
+    let names: string[]
+    try {
+      names = await readdir(failedDir)
+    } catch {
+      return
+    }
+    await Promise.all(names.map(async (name) => {
+      // Failed reports are named `<mrIid>-<epoch-ms>.md`.
+      const match = /^-?\d+-(\d{13,})\.md$/.exec(name)
+      if (match === null) return
+      const stamp = Number(match[1])
+      if (!Number.isFinite(stamp) || stamp >= cutoff) return
+      await rm(join(failedDir, name), { force: true }).catch(() => {})
+    }))
+  })
+}
 
-  const home = dshHome ?? process.env.DSH_HOME ?? join(homedir(), '.dsh')
-  const failedDir = join(home, 'maestro', 'failed-reports')
-  let names: string[]
-  try {
-    names = await readdir(failedDir)
-  } catch {
-    return
-  }
-  await Promise.all(names.map(async (name) => {
-    // Failed reports are named `<mrIid>-<epoch-ms>.md`.
-    const match = /^-?\d+-(\d{13,})\.md$/.exec(name)
-    if (match === null) return
-    const stamp = Number(match[1])
-    if (!Number.isFinite(stamp) || stamp >= cutoff) return
-    await rm(join(failedDir, name), { force: true }).catch(() => {})
-  }))
+/**
+ * In-process promise-chain mutex serializing the read-modify-write cycles of
+ * `recordReviewStart` / `recordReviewFinish` / `pruneHistory`, so a
+ * fire-and-forget `void pruneHistory()` can no longer clobber an entry that
+ * started concurrently (last-writer-wins on a stale read). Two `dsh web`
+ * processes sharing one `DSH_HOME` is unsupported, so a cross-process file
+ * lock is deliberately out of scope.
+ */
+let historyMutex: Promise<void> = Promise.resolve()
+function withHistoryLock<T>(work: () => Promise<T>): Promise<T> {
+  const next = historyMutex.then(work, work)
+  historyMutex = next.then(
+    () => undefined,
+    () => undefined,
+  )
+  return next
 }
 
 const DAY_MS = 24 * 60 * 60_000

package/src/host/review-intake.ts

@@ -35,6 +35,19 @@ function isMentioned(text: string, botUsername: string): boolean {
   return new RegExp(`(^|[^A-Za-z0-9_.-])@${escaped}(?=$|[^A-Za-z0-9_.-])`, 'i').test(text)
 }
 
+/**
+ * Short head-sha hint for the in-flight key: prefers `last_commit.id`, falls
+ * back to `checkout_sha`. Returns `undefined` when the body carries no sha.
+ */
+function shortPushSha(attributes: JsonRecord): string | undefined {
+  const lastCommit = record(attributes.last_commit)
+  const raw = typeof lastCommit?.id === 'string' ? lastCommit.id
+    : typeof attributes.checkout_sha === 'string' ? attributes.checkout_sha
+    : undefined
+  if (raw === undefined || raw.trim() === '') return undefined
+  return raw.slice(0, 8)
+}
+
 function noteScope(attributes: JsonRecord): ReviewScope | undefined {
   const position = record(attributes.position)
   if (position === undefined) return { kind: 'mr' }
@@ -49,6 +62,28 @@ export interface RouteOptions {
   pushEnabled?: boolean
 }
 
+/** Actionable provider-layer drop reasons. Generic non-review GitLab noise
+ * (closes, label edits, ...) intentionally has no reason and stays silent. */
+export type DropReason = 'invalid-identity' | 'push-gate-off'
+
+/**
+ * Name why this webhook body will NOT route at the provider layer, or
+ * `undefined` when it routes (or is generic noise the provider ignores).
+ * Pure — the provider logs the returned reason with project/mr context.
+ */
+export function describeDrop(body: unknown, botUsername: string, options: RouteOptions = {}): DropReason | undefined {
+  const value = record(body)
+  if (value === undefined || botUsername.trim() === '') return 'invalid-identity'
+  const payload = mrPayload(value)
+  if (payload === undefined) return 'invalid-identity'
+  if (value.object_kind === 'merge_request') {
+    const attributes = record(value.object_attributes)
+    const hasNewCommits = typeof attributes?.oldrev === 'string' && attributes.oldrev !== ''
+    if (hasNewCommits && options.pushEnabled !== true) return 'push-gate-off'
+  }
+  return undefined
+}
+
 export function routeGitlabReviewRequest(body: unknown, botUsername: string, options: RouteOptions = {}): ReviewRequest | undefined {
   const value = record(body)
   if (value === undefined || botUsername.trim() === '') return undefined
@@ -65,7 +100,7 @@ export function routeGitlabReviewRequest(body: unknown, botUsername: string, opt
     if (options.pushEnabled === true) {
       const hasNewCommits = typeof attributes.oldrev === 'string' && attributes.oldrev !== ''
       if (hasNewCommits) {
-        return { ...payload, trigger: 'push', mode: 'quick', scope: { kind: 'mr' } }
+        return { ...payload, trigger: 'push', mode: 'quick', scope: { kind: 'mr' }, pushSha: shortPushSha(attributes) }
       }
     }
 

package/src/host/review-marker.ts

@@ -0,0 +1,25 @@
+/**
+ * Machine-readable review comment identity (spec: coexistence §4-5).
+ *
+ * Every posted review comment (webhook + CI, quick + deep) ends with an
+ * invisible marker so the CI flow can detect "this head SHA already has a
+ * completed review" without access to the webhook's history store.
+ */
+
+export type ReviewFlow = 'ci-quick' | 'ci-deep' | 'webhook'
+
+export function reviewMarker(sha: string, flow: ReviewFlow): string {
+  return `<!-- maestro-review sha=${sha} flow=${flow} status=completed -->`
+}
+
+export function parseReviewMarker(body: string): { sha: string; flow: string; status: string } | undefined {
+  const m = /<!-- maestro-review sha=([0-9a-fA-F]+) flow=([a-z-]+) status=([a-z]+) -->/.exec(body)
+  if (!m) return undefined
+  return { sha: m[1], flow: m[2], status: m[3] }
+}
+
+/** CI detection is env-based (established pattern): the reviewer job always sets these. */
+export function resolveFlow(mode: 'quick' | 'deep'): ReviewFlow {
+  if (process.env.SOURCE_PROJECT_ID === undefined) return 'webhook'
+  return mode === 'deep' ? 'ci-deep' : 'ci-quick'
+}

package/src/host/review-signals.ts

@@ -4,31 +4,34 @@
  * GitLab error is swallowed so it can never fail the review itself.
  */
 
+import { gitlabAuthHeaders } from './gitlab-auth.js'
+import { fetchWithTimeout } from './gitlab-client.js'
+
 export interface ReviewSignals {
   start(): Promise<void>
   finish(outcome: 'completed' | 'failed'): Promise<void>
 }
 
 async function award(baseUrl: string, token: string, projectId: number, mrIid: number, name: string): Promise<void> {
-  await fetch(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji`, {
+  await fetchWithTimeout(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji`, {
     method: 'POST',
-    headers: { 'PRIVATE-TOKEN': token, 'Content-Type': 'application/json' },
+    headers: { ...gitlabAuthHeaders(token), 'Content-Type': 'application/json' },
     body: JSON.stringify({ name }),
   })
 }
 
 /** Remove only this bot's stale running markers; other users' awards stay untouched. */
 async function unawardOwn(baseUrl: string, token: string, projectId: number, mrIid: number, botUsername: string): Promise<void> {
-  const response = await fetch(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji`, {
-    headers: { 'PRIVATE-TOKEN': token },
+  const response = await fetchWithTimeout(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji`, {
+    headers: gitlabAuthHeaders(token),
   })
   if (!response.ok) return
   const awards = (await response.json()) as Array<{ id?: number; name?: string; user?: { username?: string } }>
   for (const awardItem of Array.isArray(awards) ? awards : []) {
     if (awardItem.name !== 'eyes' || awardItem.user?.username !== botUsername || typeof awardItem.id !== 'number') continue
-    await fetch(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji/${awardItem.id}`, {
+    await fetchWithTimeout(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji/${awardItem.id}`, {
       method: 'DELETE',
-      headers: { 'PRIVATE-TOKEN': token },
+      headers: gitlabAuthHeaders(token),
     }).catch(() => {})
   }
 }

package/src/host/settings-rpc.ts

@@ -12,7 +12,7 @@ export const inject = ['connection', 'maestroTunnel']
 /** Keys the Settings card may persist; anything else is a rejected save. */
 const SAVABLE_KEYS = new Set<keyof MaestroUserConfig>([
   'gitlabBaseUrl', 'gitlabToken', 'botUsername', 'webhookSecret', 'webhookPort',
-  'projectMappings', 'reviewModel', 'autoRereviewOnPush', 'agentTimeoutMs', 'reviewSessionRetentionDays',
+  'projectMappings', 'reviewModel', 'autoRereviewOnPush', 'autoReviewOnAssign', 'agentTimeoutMs', 'reviewSessionRetentionDays',
   'tunnelMode', 'quickTarget', 'tunnelId', 'tunnelCredentialsFile', 'tunnelHostname',
   'proxyPort', 'proxyHost', 'lanPinEnabled', 'telegramBotToken', 'telegramChatId',
   'telegramReviewNotifications',

package/templates/reviewer-project.gitlab-ci.yml

@@ -0,0 +1,90 @@
+# ddtcorex/maestro-reviewer — dedicated reviewer project
+stages: [review]
+
+variables:
+  # Image registry — pin the SHA for reproducibility
+  REVIEWER_IMAGE: "ddtcorex/maestro-reviewer:latest"
+  # Or use $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA when building the image in the same project
+
+review:
+  stage: review
+  image: $REVIEWER_IMAGE
+  # Only runs when triggered from the source project (or manually)
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "pipeline"          # bridge trigger
+    - if: $CI_PIPELINE_SOURCE == "trigger"           # token trigger
+    - if: $CI_PIPELINE_SOURCE == "web"               # manual retry
+      when: manual
+  variables:
+    GIT_STRATEGY: none   # no need to check out the reviewer repo
+  # Every parameter comes from env (SOURCE_PROJECT_ID, MR_IID, GITLAB_HOST, REVIEW_MODE) — no CLI args.
+  script:
+    - /entrypoint.sh
+  # History cache — the push-gate (skip already-reviewed head SHAs) and incremental
+  # context read $DSH_HOME/dsh-maestro-review/reviews.json, which is ephemeral in a
+  # fresh container. entrypoint.sh symlinks it at this cached path (one store, many
+  # MRs — entries are keyed per MR inside). Cache miss fails open toward reviewing.
+  cache:
+    key: maestro-review-history
+    paths:
+      - .maestro-history/
+  artifacts:
+    when: always
+    expire_in: 1 week
+    paths:
+      - review-report.json
+      - review-report.md
+  # Secrets — Protected + Masked, only available on the reviewer project's protected branches.
+  # MAESTRO_GITLAB_TOKEN is REQUIRED and must be a user PAT or Group/Project
+  # Access Token (api scope). CI_JOB_TOKEN is NOT enough: proven 2026-09-04 on
+  # GitLab 18.11 that reads work (GET=200) but posting the review comment fails
+  # (POST /notes=401) even with the source project allowlisting this reviewer —
+  # the run would "complete" without ever posting. A human-tied PAT needs yearly
+  # rotation; prefer a bot/group token where the instance allows creating one.
+  # MAESTRO_GITLAB_TOKEN (api scope) — required
+  # Route selection is key-based (entrypoint.sh swaps the baked settings variant):
+  # OPENCODE_GO_API_KEY → opencode profile (default, host mirror; serves opencode-go
+  #   AND deepseek-official-via-zen). Set alone, or with DEEPSEEK_API_KEY (opencode wins).
+  # DEEPSEEK_API_KEY → deepseek profile ONLY when OPENCODE_GO_API_KEY is absent
+  #   (deepseek-official straight from api.deepseek.com — needs a LIVE deepseek.com key).
+  # TELEGRAM_BOT_TOKEN / TELEGRAM_CHAT_ID (optional)
+  # Opencode model (optional, one variable — default muse-spark-1.3-contributor):
+  # OPENCODE_MODEL: "muse-spark-1.3-contributor"
+  # Model pin (optional, as a pair — unset both for the host-mirrored default
+  #   = opencode-go/muse-spark-1.3-contributor, baked in docker/ci-settings.yaml):
+  # REVIEW_MODEL_PROVIDER: "opencode-go"             # or "deepseek-official"
+  # REVIEW_MODEL: "muse-spark-1.3-contributor"       # e.g. deepseek-v4-flash (deepseek-official via zen)
+  #   Only the provider's key is needed — no settings mount required. ID without
+  #   provider fails the review with a provider error (not silently the wrong
+  #   model); provider without ID is ignored.
+  # Review skill profile (optional — unset for the legacy diff-only generic review):
+  # REVIEW_PROFILE: "magento2"                       # magento2 | laravel | symfony | wordpress | generic
+  #   The reviewer must load the full skill set or the review fails closed
+  #   (no half-skilled review). Runtime-backed checks still degrade without a
+  #   checkout — the profile adds framework checklists, not a govard run.
+  # Review mode (default quick; deep runs on demand — no new variables):
+  # REVIEW_MODE: "deep"                              # manual downstream run with the same
+  #   bridge variables (SOURCE_PROJECT_ID, MR_IID, GITLAB_HOST) + REVIEW_ON_PUSH=1
+  #   to re-review pushes. The job clones the source at the MR head SHA with
+  #   MAESTRO_GITLAB_TOKEN (api scope, oauth2) and runs reviewer (+auditor
+  #   degraded to reviewer-only without a runtime). No govard in the container.
+  #   CI yields to webhook: if the head SHA already has a completed review
+  #   comment (either flow), the run skips instead of double-posting.
+  # Re-review pushes (optional — mirrors Settings UI autoRereviewOnPush, default off):
+  # REVIEW_ON_PUSH: "1"                              # re-review new pushes with incremental context;
+  #   unset = only the first (opened) review runs; same head SHA always skips.
+
+# Build the image inside the same reviewer project (optional):
+#
+# build:image:
+#   stage: .pre
+#   image: docker:27
+#   services: [docker:27-dind]
+#   rules:
+#     - if: $CI_COMMIT_BRANCH == "main"
+#   script:
+#     - docker build -f packages/dsh-maestro-review/docker/Dockerfile -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -t $CI_REGISTRY_IMAGE:latest .
+#     - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
+#     - docker push $CI_REGISTRY_IMAGE:latest
+#   # Build context must be the maestro-harness workspace root (contains deepseek-harness/) —
+#   # the trailing "." above assumes this job checks out maestro-harness, not this repo alone.

package/templates/source-project.gitlab-ci.yml

@@ -0,0 +1,41 @@
+# example-group/example-project — source project (copy this template into YOUR source project)
+stages: [review]
+
+# Only runs when there is an MR (fork MRs run fine too — this job has no secrets)
+maestro:trigger-review:
+  stage: review
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  # No image needed, no secrets needed
+  trigger:
+    project: ddtcorex/maestro-reviewer   # ← reviewer project path
+    branch: main                          # ← the reviewer project's default branch (master on some instances)
+    strategy: depend                      # optional: wait for the reviewer pipeline, surface its status on the MR
+  variables:
+    SOURCE_PROJECT_ID: $CI_PROJECT_ID
+    MR_IID: $CI_MERGE_REQUEST_IID
+    GITLAB_HOST: $CI_SERVER_HOST
+    REVIEW_MODE: "quick"                 # or "deep" for a static-only audit (no govard runtime in CI)
+    REVIEW_PROFILE: "generic"            # per-project skill profile: magento2 | laravel | symfony | wordpress | generic
+    # REVIEW_ON_PUSH: "1"               # uncomment to re-review every push (default: only the opened review runs)
+
+# Trigger Token fallback (when not using `trigger: project:`):
+#
+# maestro:trigger-review:token:
+#   stage: review
+#   rules:
+#     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+#   image: curlimages/curl:8
+#   variables:
+#     REVIEWER_PROJECT_ID: "123"  # id of the maestro-reviewer project
+#   script:
+#     - |
+#       curl --fail --request POST \
+#         --form token=$MAESTRO_TRIGGER_TOKEN \
+#         --form ref=main \
+#         --form variables[SOURCE_PROJECT_ID]=$CI_PROJECT_ID \
+#         --form variables[MR_IID]=$CI_MERGE_REQUEST_IID \
+#         --form variables[GITLAB_HOST]=$CI_SERVER_HOST \
+#         "https://${CI_SERVER_HOST}/api/v4/projects/${REVIEWER_PROJECT_ID}/trigger/pipeline"
+#   # MAESTRO_TRIGGER_TOKEN is the reviewer project's Trigger Token, stored in the source project
+#   # (can only trigger, never read/write code — safer than GITLAB_TOKEN)