@ddtcorex/dsh-maestro-review 0.6.0 → 0.6.2

package/src/host/orchestrator.ts

@@ -114,7 +114,8 @@ export function buildReviewerScopePrompt(opts: ReviewerScopePromptOpts): string
   if (opts.scopeKind === 'discussion') {
     return `${opts.profileInstruction}Review only the requested inline discussion ${opts.discussionId} at ${opts.path}:${opts.line}. Do not review unrelated files or start a broad audit. Call gitlab_get_mr_diff, then gitlab_get_file_diff for the file under review, then call report_review_findings exactly once when done. ${lintRule}`
   }
-  return `${opts.profileInstruction}Review this merge request (${opts.mode} mode). Call gitlab_list_own_review_threads and gitlab_get_mr_diff first, then gitlab_get_file_diff per file you inspect (inline results never spill), then call report_review_findings exactly once when done. ${lintRule} DEDUP RULE: when a finding matches the substance of an existing own thread (same file and same underlying issue, even if worded differently — including resolved threads, whose reply reopens them), report it as {status: "reply", discussionId} instead of posting a new thread. Use status "new" only for issues with no matching thread.`
+  const deletedFilesRule = 'DELETED FILES: a deleted file\'s diff only tells you what logic is gone — never file a finding positioned on a deleted file (there is no line left to fix). If removing it drops behavior that is not replicated elsewhere, report that as a finding against the file that should carry the replacement logic (or the closest call site), not the deleted file itself.'
+  return `${opts.profileInstruction}Review this merge request (${opts.mode} mode). Call gitlab_list_own_review_threads and gitlab_get_mr_diff first, then gitlab_get_file_diff per file you inspect (inline results never spill), then call report_review_findings exactly once when done. ${lintRule} DEDUP RULE: when a finding matches the substance of an existing own thread (same file and same underlying issue, even if worded differently — including resolved threads, whose reply reopens them), report it as {status: "reply", discussionId} instead of posting a new thread. Use status "new" only for issues with no matching thread. ${deletedFilesRule}`
 }
 
 /**
@@ -213,10 +214,43 @@ export function isUnsupportedReasoningError(err: unknown): boolean {
     || text.includes('UNSUPPORTED_REASONING_EFFORT')
 }
 
+/**
+ * Read an agent session's event log across host/session API skew: hosts
+ * built from the harness checkout expose `ownEvents()`/`snapshotEvents()`
+ * with no `.events` getter, while older packaged `@deepseek-ai/dsh-session`
+ * builds expose only the `.events` getter. `ownEvents()` (child-owned
+ * suffix, no fork prefix) wins when present — it matches what most callers
+ * want (this session's own turns, not an inherited fork prefix).
+ *
+ * Live-verified 2026-09-05: a real `AgentHandle`'s `agent.session.events` is
+ * `undefined` (the property does not exist on the current pinned
+ * `@deepseek-ai/dsh-session`), which previously made `getTurnErrorMessage()`
+ * silently return `undefined` for every real turn — the exact
+ * auth/billing-failure detection PR #81/#90 exist to provide never actually
+ * ran outside of unit tests that happened to mock the same wrong shape.
+ * Returns `[]` — never throws — when no event source exists.
+ */
+function readSessionEvents(session: unknown): unknown[] {
+  const candidate = session as {
+    ownEvents?: unknown
+    snapshotEvents?: unknown
+    events?: unknown
+  } | null | undefined
+  let events: unknown
+  if (typeof candidate?.ownEvents === 'function') {
+    events = (candidate.ownEvents as () => unknown)()
+  } else if (typeof candidate?.snapshotEvents === 'function') {
+    events = (candidate.snapshotEvents as () => unknown)()
+  } else {
+    events = candidate?.events
+  }
+  return Array.isArray(events) ? events : []
+}
+
 export function getTurnErrorMessage(handle: unknown): string | undefined {
   try {
-    const events = (handle as { agent?: { session?: { events?: unknown[] } } })?.agent?.session?.events
-    if (!Array.isArray(events)) return undefined
+    const events = readSessionEvents((handle as { agent?: { session?: unknown } })?.agent?.session)
+    if (events.length === 0) return undefined
     for (let i = events.length - 1; i >= 0; i--) {
       const ev = events[i] as { type?: unknown; data?: { reason?: { kind?: unknown; error?: { message?: unknown; code?: unknown } } } }
       if (ev?.type === 'turn/end' && ev?.data?.reason?.kind === 'error') {
@@ -250,6 +284,25 @@ export function assertTurnSucceeded(handle: unknown): void {
   }
 }
 
+/**
+ * Like assertTurnSucceeded, but only throws when there is nothing left to
+ * salvage. A turn can error AFTER already producing real output — findings
+ * reported via the tool, or audit text written — when only the turn's own
+ * closing step fails afterward (a trailing rate-limit/auth hiccup). Throwing
+ * unconditionally there discarded already-produced, real work for no
+ * benefit; this only fails closed when the turn errored AND there is
+ * nothing usable to fall back on. Either way the turn error is never
+ * silent: logged as a warning when salvaging, thrown when not.
+ */
+export function assertTurnSucceededOrSalvage(handle: unknown, hasSalvageableOutput: boolean, label: string): void {
+  const turnMsg = getTurnErrorMessage(handle)
+  if (turnMsg === undefined) return
+  if (!hasSalvageableOutput) {
+    throw new Error(`Review turn failed before completing: ${turnMsg}`)
+  }
+  console.warn(`maestro-orchestrator: ${label} turn ended with an error after already producing usable output — using it anyway: ${turnMsg}`)
+}
+
 /**
  * Resolve the model to use for an automated review. Priority: per-project
  * override > global reviewModel (Maestro Settings) > row-config reviewModel
@@ -400,6 +453,7 @@ interface GitlabMrChange {
   diff: string
   collapsed?: boolean
   too_large?: boolean
+  deleted_file?: boolean
 }
 
 interface GitlabDiffPosition {
@@ -504,6 +558,18 @@ export async function postReviewFindings(findings: ReviewFinding[], config: Gitl
       if (change.collapsed === true || change.too_large === true || change.diff === '') {
         throw new Error(`cannot post inline finding at ${finding.path}:${finding.line}: GitLab did not return this file's complete diff`)
       }
+      // A deleted file has no "new" side to attach an inline comment to — post as a
+      // top-level note instead of relying on diffPositionForNewLine() incidentally
+      // returning undefined (true today since a full deletion has no +/context rows,
+      // but that's a byproduct of diff-hunk mechanics, not a designed guard).
+      if (change.deleted_file === true) {
+        response = await fetcher(`${apiBase}/notes`, {
+          method: 'POST', headers,
+          body: JSON.stringify({ body: `**Inline fallback — \`${finding.path}\` was deleted in this MR (no line ${finding.line} to attach a comment to)**\n\n${body}` }),
+        })
+        if (!response.ok) throw new Error(`GitLab API error ${response.status}: ${await response.text()}`)
+        continue
+      }
       const linePosition = diffPositionForNewLine(change.diff, finding.line)
       if (linePosition === undefined) {
         // Line not in diff — fallback to MR note so finding is not silently lost.
@@ -569,29 +635,15 @@ function assertSafeId(value: number, label: string): void {
 }
 
 /**
- * Read an agent session's transcript for the auditor's final output across
- * host/session API skew: hosts built from the harness checkout expose
- * `ownEvents()`/`snapshotEvents()` with no `.events` getter, while older
- * packaged `@deepseek-ai/dsh-session` builds expose only the `.events`
- * getter. `ownEvents()` (child-owned suffix, no fork prefix) matches
- * `finalAssistantOutput`'s documented input best, so it wins when present.
+ * Read an agent session's transcript for the auditor's final output.
+ * `ownEvents()` (child-owned suffix, no fork prefix) matches
+ * `finalAssistantOutput`'s documented input best, so `readSessionEvents`
+ * preferring it over `snapshotEvents()`/`.events` suits this caller too.
  * Returns `[]` — never throws — when no event source exists.
  */
 export function auditorOutputFromSession(session: unknown) {
-  const candidate = session as {
-    ownEvents?: unknown
-    snapshotEvents?: unknown
-    events?: unknown
-  } | null | undefined
-  let events: unknown
-  if (typeof candidate?.ownEvents === 'function') {
-    events = (candidate.ownEvents as () => unknown)()
-  } else if (typeof candidate?.snapshotEvents === 'function') {
-    events = (candidate.snapshotEvents as () => unknown)()
-  } else {
-    events = candidate?.events
-  }
-  if (!Array.isArray(events)) return []
+  const events = readSessionEvents(session)
+  if (events.length === 0) return []
   return finalAssistantOutput(events as Parameters<typeof finalAssistantOutput>[0]) ?? []
 }
 
@@ -1097,7 +1149,7 @@ export function apply(ctx: Context, config: Config): void {
           source: { kind: 'user' },
         }))
         await whenIdleWithTimeout(handle, effectiveAgentTimeoutMs)
-        assertTurnSucceeded(handle)
+        assertTurnSucceededOrSalvage(handle, capturedFindings.length > 0, 'reviewer')
         if (reviewProfile !== undefined && (reviewerContext === undefined || loadedReviewProfile(reviewerContext) !== reviewProfile)) {
           throw new Error(`reviewer did not successfully load the required ${reviewProfile} review skill profile; no findings were posted`)
         }
@@ -1195,9 +1247,9 @@ export function apply(ctx: Context, config: Config): void {
       const prompt = buildAuditorPrompt({ staticOnly: opts?.staticOnly === true })
       handle.agent.followup(createUserMessage({ content: [{ type: 'text', text: prompt }], source: { kind: 'user' } }))
       await whenIdleWithTimeout(handle, effectiveAgentTimeoutMs)
-      assertTurnSucceeded(handle)
       const output = auditorOutputFromSession(handle.agent.session)
       const text = output.map(block => ('text' in block ? block.text : '')).join('')
+      assertTurnSucceededOrSalvage(handle, text.trim() !== '', 'auditor')
       return `## Maestro Performance Audit\n\n${text}`
     } finally {
       await handle.dispose()

package/src/host/review-signals.ts

@@ -13,26 +13,46 @@ export interface ReviewSignals {
 }
 
 async function award(baseUrl: string, token: string, projectId: number, mrIid: number, name: string): Promise<void> {
-  await fetchWithTimeout(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji`, {
+  const response = await fetchWithTimeout(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji`, {
     method: 'POST',
     headers: { ...gitlabAuthHeaders(token), 'Content-Type': 'application/json' },
     body: JSON.stringify({ name }),
   })
+  // fetchWithTimeout only throws on a network/abort failure; a non-2xx status
+  // (expired token, missing scope, rate-limited) resolves normally and must
+  // be checked explicitly, or the caller's failure logging never fires.
+  if (!response.ok) throw new Error(`GitLab API error ${response.status} awarding "${name}": ${await response.text()}`)
 }
 
-/** Remove only this bot's stale running markers; other users' awards stay untouched. */
-async function unawardOwn(baseUrl: string, token: string, projectId: number, mrIid: number, botUsername: string): Promise<void> {
+/** Every marker name this bot ever awards — kept in one place so `unawardOwn` can always clear all of them, leaving at most one visible at a time. */
+const MARKER_NAMES = ['eyes', 'white_check_mark', 'warning'] as const
+
+/**
+ * Remove this bot's own markers among `names`; other users' awards stay untouched.
+ * Callers pass `MARKER_NAMES` (not just "eyes") so a stale terminal marker from a
+ * prior run (e.g. `white_check_mark`) is cleared before re-awarding the same name —
+ * GitLab rejects a duplicate award of the same name by the same user with a 404
+ * ("Award Emoji Name has already been taken"), which otherwise surfaces as a
+ * confusing failure on the second consecutive completed/failed review of one MR.
+ */
+async function unawardOwn(baseUrl: string, token: string, projectId: number, mrIid: number, botUsername: string, names: readonly string[]): Promise<void> {
   const response = await fetchWithTimeout(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji`, {
     headers: gitlabAuthHeaders(token),
   })
-  if (!response.ok) return
+  if (!response.ok) throw new Error(`GitLab API error ${response.status} listing award emoji: ${await response.text()}`)
   const awards = (await response.json()) as Array<{ id?: number; name?: string; user?: { username?: string } }>
   for (const awardItem of Array.isArray(awards) ? awards : []) {
-    if (awardItem.name !== 'eyes' || awardItem.user?.username !== botUsername || typeof awardItem.id !== 'number') continue
-    await fetchWithTimeout(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji/${awardItem.id}`, {
+    if (awardItem.name === undefined || !names.includes(awardItem.name) || awardItem.user?.username !== botUsername || typeof awardItem.id !== 'number') continue
+    const deleteResponse = await fetchWithTimeout(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}/award_emoji/${awardItem.id}`, {
       method: 'DELETE',
       headers: gitlabAuthHeaders(token),
-    }).catch(() => {})
+    }).catch((err: unknown) => {
+      console.error(`review-signals: failed to delete stale ${awardItem.name} marker ${awardItem.id} on MR !${mrIid}`, err)
+      return undefined
+    })
+    if (deleteResponse !== undefined && !deleteResponse.ok) {
+      console.error(`review-signals: GitLab API error ${deleteResponse.status} deleting stale ${awardItem.name} marker ${awardItem.id} on MR !${mrIid}`)
+    }
   }
 }
 
@@ -41,15 +61,23 @@ export function createReviewSignals(options: { baseUrl: string; token: string; p
   return {
     async start() {
       try {
-        await unawardOwn(baseUrl, token, projectId, mrIid, botUsername)
+        await unawardOwn(baseUrl, token, projectId, mrIid, botUsername, MARKER_NAMES)
         await award(baseUrl, token, projectId, mrIid, 'eyes')
-      } catch { /* signalling must never break the review */ }
+      } catch (err) {
+        // Signalling must never break the review, but a swallowed failure
+        // here is exactly what leaves a stale "eyes" marker stuck on the MR
+        // forever (blocking the push-gate's 👀-running check for both the
+        // webhook and CI flows) with zero trace of why — log it.
+        console.error(`review-signals: failed to set the running marker on MR !${mrIid}`, err)
+      }
     },
     async finish(outcome) {
       try {
-        await unawardOwn(baseUrl, token, projectId, mrIid, botUsername)
+        await unawardOwn(baseUrl, token, projectId, mrIid, botUsername, MARKER_NAMES)
         await award(baseUrl, token, projectId, mrIid, outcome === 'completed' ? 'white_check_mark' : 'warning')
-      } catch { /* signalling must never break the review */ }
+      } catch (err) {
+        console.error(`review-signals: failed to clear the running marker / award the final marker on MR !${mrIid}`, err)
+      }
     },
   }
 }

package/templates/reviewer-project.gitlab-ci.yml

@@ -3,7 +3,7 @@ stages: [review]
 
 variables:
   # Image registry — pin the SHA for reproducibility
-  REVIEWER_IMAGE: "ddtcorex/maestro-reviewer:0.1.0"
+  REVIEWER_IMAGE: "ddtcorex/maestro-reviewer:0.6.2"
   # Or use $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA when building the image in the same project
 
 review:

package/templates/source-project.gitlab-ci.yml

@@ -4,6 +4,13 @@ stages: [review]
 # Only runs when there is an MR (fork MRs run fine too — this job has no secrets)
 maestro:trigger-review:
   stage: review
+  # The job only fails on a reviewer-infra problem (LLM/API error, timeout,
+  # failed comment post) — it never fails because findings were reported.
+  # Non-blocking so an outage of the shared reviewer project (serving many
+  # source projects) can't block this project's merge/deploy; check the MR
+  # comment for the actual review result. Drop this line to hard-block merge
+  # on any reviewer-infra failure instead.
+  allow_failure: true
   rules:
     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
   # No image needed, no secrets needed