@ddtcorex/dsh-maestro-review 0.5.1 → 0.6.1

package/profiles/reviewer-ci/pnpm-workspace.yaml

@@ -7,6 +7,17 @@
 # printed "Scope: all 2 workspace projects" and resolved relative to `../..`
 # without this file present).
 packages: []
+# Postinstall scripts required at runtime (node-pty/subprocess-local spawn
+# agents, koffi/protobufjs/genai serve model IO). Exact versions pinned in
+# pnpm-lock.yaml; review on every profile dep bump.
+allowBuilds:
+  '@deepseek-ai/dsh-subprocess-local': true
+  '@google/genai': true
+  koffi: true
+  node-pty: true
+  protobufjs: true
 minimumReleaseAgeExclude:
   - '@ddtcorex/dsh-maestro-review@0.3.1'
   - '@ddtcorex/maestro-skills@2.11.0'
+  - '@ddtcorex/dsh-maestro-review@0.5.1'
+  - '@ddtcorex/maestro-skills@2.11.1'

package/src/host/orchestrator.ts

@@ -234,6 +234,41 @@ export function getTurnErrorMessage(handle: unknown): string | undefined {
   }
 }
 
+/**
+ * A turn can go idle without ever calling a tool when the model provider
+ * itself rejects the request (auth/billing/rate-limit) — `whenIdleWithTimeout`
+ * only guards against a hang, not this. Left unchecked, the reviewer's
+ * missing-skill-profile check and the auditor's empty-output path both treat
+ * this the same as "the agent just didn't call anything", misreporting a
+ * provider outage as a maestro-skills installation problem (or, for the
+ * auditor, as a silent clean pass). Surface the real turn error immediately.
+ */
+export function assertTurnSucceeded(handle: unknown): void {
+  const turnMsg = getTurnErrorMessage(handle)
+  if (turnMsg !== undefined) {
+    throw new Error(`Review turn failed before completing: ${turnMsg}`)
+  }
+}
+
+/**
+ * Like assertTurnSucceeded, but only throws when there is nothing left to
+ * salvage. A turn can error AFTER already producing real output — findings
+ * reported via the tool, or audit text written — when only the turn's own
+ * closing step fails afterward (a trailing rate-limit/auth hiccup). Throwing
+ * unconditionally there discarded already-produced, real work for no
+ * benefit; this only fails closed when the turn errored AND there is
+ * nothing usable to fall back on. Either way the turn error is never
+ * silent: logged as a warning when salvaging, thrown when not.
+ */
+export function assertTurnSucceededOrSalvage(handle: unknown, hasSalvageableOutput: boolean, label: string): void {
+  const turnMsg = getTurnErrorMessage(handle)
+  if (turnMsg === undefined) return
+  if (!hasSalvageableOutput) {
+    throw new Error(`Review turn failed before completing: ${turnMsg}`)
+  }
+  console.warn(`maestro-orchestrator: ${label} turn ended with an error after already producing usable output — using it anyway: ${turnMsg}`)
+}
+
 /**
  * Resolve the model to use for an automated review. Priority: per-project
  * override > global reviewModel (Maestro Settings) > row-config reviewModel
@@ -1081,6 +1116,7 @@ export function apply(ctx: Context, config: Config): void {
           source: { kind: 'user' },
         }))
         await whenIdleWithTimeout(handle, effectiveAgentTimeoutMs)
+        assertTurnSucceededOrSalvage(handle, capturedFindings.length > 0, 'reviewer')
         if (reviewProfile !== undefined && (reviewerContext === undefined || loadedReviewProfile(reviewerContext) !== reviewProfile)) {
           throw new Error(`reviewer did not successfully load the required ${reviewProfile} review skill profile; no findings were posted`)
         }
@@ -1180,6 +1216,7 @@ export function apply(ctx: Context, config: Config): void {
       await whenIdleWithTimeout(handle, effectiveAgentTimeoutMs)
       const output = auditorOutputFromSession(handle.agent.session)
       const text = output.map(block => ('text' in block ? block.text : '')).join('')
+      assertTurnSucceededOrSalvage(handle, text.trim() !== '', 'auditor')
       return `## Maestro Performance Audit\n\n${text}`
     } finally {
       await handle.dispose()

package/src/host/review-signals.ts

@@ -13,11 +13,15 @@ export interface ReviewSignals {
 }
 
 async function award(baseUrl: string, token: string, projectId: number, mrIid: number, name: string): Promise<void> {
-  await fetchWithTimeout(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji`, {
+  const response = await fetchWithTimeout(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji`, {
     method: 'POST',
     headers: { ...gitlabAuthHeaders(token), 'Content-Type': 'application/json' },
     body: JSON.stringify({ name }),
   })
+  // fetchWithTimeout only throws on a network/abort failure; a non-2xx status
+  // (expired token, missing scope, rate-limited) resolves normally and must
+  // be checked explicitly, or the caller's failure logging never fires.
+  if (!response.ok) throw new Error(`GitLab API error ${response.status} awarding "${name}": ${await response.text()}`)
 }
 
 /** Remove only this bot's stale running markers; other users' awards stay untouched. */
@@ -25,14 +29,20 @@ async function unawardOwn(baseUrl: string, token: string, projectId: number, mrI
   const response = await fetchWithTimeout(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji`, {
     headers: gitlabAuthHeaders(token),
   })
-  if (!response.ok) return
+  if (!response.ok) throw new Error(`GitLab API error ${response.status} listing award emoji: ${await response.text()}`)
   const awards = (await response.json()) as Array<{ id?: number; name?: string; user?: { username?: string } }>
   for (const awardItem of Array.isArray(awards) ? awards : []) {
     if (awardItem.name !== 'eyes' || awardItem.user?.username !== botUsername || typeof awardItem.id !== 'number') continue
-    await fetchWithTimeout(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji/${awardItem.id}`, {
+    const deleteResponse = await fetchWithTimeout(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji/${awardItem.id}`, {
       method: 'DELETE',
       headers: gitlabAuthHeaders(token),
-    }).catch(() => {})
+    }).catch((err: unknown) => {
+      console.error(`review-signals: failed to delete stale eyes marker ${awardItem.id} on MR !${mrIid}`, err)
+      return undefined
+    })
+    if (deleteResponse !== undefined && !deleteResponse.ok) {
+      console.error(`review-signals: GitLab API error ${deleteResponse.status} deleting stale eyes marker ${awardItem.id} on MR !${mrIid}`)
+    }
   }
 }
 
@@ -43,13 +53,21 @@ export function createReviewSignals(options: { baseUrl: string; token: string; p
       try {
         await unawardOwn(baseUrl, token, projectId, mrIid, botUsername)
         await award(baseUrl, token, projectId, mrIid, 'eyes')
-      } catch { /* signalling must never break the review */ }
+      } catch (err) {
+        // Signalling must never break the review, but a swallowed failure
+        // here is exactly what leaves a stale "eyes" marker stuck on the MR
+        // forever (blocking the push-gate's 👀-running check for both the
+        // webhook and CI flows) with zero trace of why — log it.
+        console.error(`review-signals: failed to set the running marker on MR !${mrIid}`, err)
+      }
     },
     async finish(outcome) {
       try {
         await unawardOwn(baseUrl, token, projectId, mrIid, botUsername)
         await award(baseUrl, token, projectId, mrIid, outcome === 'completed' ? 'white_check_mark' : 'warning')
-      } catch { /* signalling must never break the review */ }
+      } catch (err) {
+        console.error(`review-signals: failed to clear the running marker / award the final marker on MR !${mrIid}`, err)
+      }
     },
   }
 }

package/templates/reviewer-project.gitlab-ci.yml

@@ -3,7 +3,7 @@ stages: [review]
 
 variables:
   # Image registry — pin the SHA for reproducibility
-  REVIEWER_IMAGE: "ddtcorex/maestro-reviewer:latest"
+  REVIEWER_IMAGE: "ddtcorex/maestro-reviewer:0.6.1"
   # Or use $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA when building the image in the same project
 
 review:
@@ -42,18 +42,21 @@ review:
   # the run would "complete" without ever posting. A human-tied PAT needs yearly
   # rotation; prefer a bot/group token where the instance allows creating one.
   # MAESTRO_GITLAB_TOKEN (api scope) — required
-  # Route selection is key-based (entrypoint.sh swaps the baked settings variant):
-  # OPENCODE_GO_API_KEY → opencode profile (default, host mirror; serves opencode-go
-  #   AND deepseek-official-via-zen). Set alone, or with DEEPSEEK_API_KEY (opencode wins).
-  # DEEPSEEK_API_KEY → deepseek profile ONLY when OPENCODE_GO_API_KEY is absent
-  #   (deepseek-official straight from api.deepseek.com — needs a LIVE deepseek.com key).
+  # Model route selection — deepseek is the sole baked default; set
+  # REVIEW_LLM_API_KEY to overlay any OpenAI-compatible endpoint instead:
+  # DEEPSEEK_API_KEY (required unless using the route below) — deepseek-official
+  #   straight from api.deepseek.com.
+  # REVIEW_LLM_API_KEY / REVIEW_LLM_BASE_URL / REVIEW_LLM_MODEL — bring-your-own
+  #   OpenAI-compatible endpoint (self-hosted, Azure OpenAI, OpenRouter, a
+  #   private gateway, ...). All three required together; the job fails closed
+  #   if REVIEW_LLM_API_KEY is set without the other two. Optional
+  #   REVIEW_LLM_API selects the wire protocol (openai-completions [default]
+  #   or openai-responses).
   # TELEGRAM_BOT_TOKEN / TELEGRAM_CHAT_ID (optional)
-  # Opencode model (optional, one variable — default muse-spark-1.3-contributor):
-  # OPENCODE_MODEL: "muse-spark-1.3-contributor"
-  # Model pin (optional, as a pair — unset both for the host-mirrored default
-  #   = opencode-go/muse-spark-1.3-contributor, baked in docker/ci-settings.yaml):
-  # REVIEW_MODEL_PROVIDER: "opencode-go"             # or "deepseek-official"
-  # REVIEW_MODEL: "muse-spark-1.3-contributor"       # e.g. deepseek-v4-flash (deepseek-official via zen)
+  # Model pin (optional, as a pair — unset both for the active route's default
+  #   model, baked in docker/ci-settings.*.yaml):
+  # REVIEW_MODEL_PROVIDER: "deepseek-official"       # or "custom-openai"
+  # REVIEW_MODEL: "deepseek-v4-flash"                # the active route's model id
   #   Only the provider's key is needed — no settings mount required. ID without
   #   provider fails the review with a provider error (not silently the wrong
   #   model); provider without ID is ignored.