@ddtcorex/dsh-maestro-review 0.8.0 → 0.9.0

package/profiles/reviewer-ci/pnpm-workspace.yaml

@@ -7,46 +7,17 @@
 # printed "Scope: all 2 workspace projects" and resolved relative to `../..`
 # without this file present).
 packages: []
-# Force the whole @deepseek-ai/dsh-* core dependency graph to one coherent
-# 0.1.5-rc.2 line. Bumping only dsh/dsh-base/dsh-agent-presets (the packages
-# this profile declares directly) left ~23 of THEIR transitive deps resolved
-# at the older 0.1.2-rc.1 they used to be pinned to, because nothing in the
-# graph forced them past whatever loose range their other consumers still
-# declared. The mismatch is silent at install time (a peer warning only) but
-# fatal at boot: a newer consumer ESM-imports a symbol the older peer's build
-# never exported (e.g. dsh-session-persistence-jsonl@0.1.5-rc.2 importing
-# SessionAlreadyExistsError from dsh-session-persistence@0.1.2-rc.1, which
-# doesn't have it), crashing the whole plugin tree with exit 1 — root-caused
-# 2026-09-14 by reproducing the crash locally (`docker run --entrypoint
-# /entrypoint.sh` with real credentials; GITLAB_HOST must be the bare
-# hostname, no `https://` prefix — ci-trigger.ts prepends the scheme itself).
-# pnpm reads `overrides:` here, NOT from package.json, on pnpm 11 (see the
-# dsh-invariants override above/below for the same gotcha in the sibling
-# workspace). Every package below is confirmed to publish a 0.1.5-rc.2.
-overrides:
-  '@deepseek-ai/dsh-attachment': 0.1.5-rc.2
-  '@deepseek-ai/dsh-session-persistence': 0.1.5-rc.2
-  '@deepseek-ai/dsh-fs': 0.1.5-rc.2
-  '@deepseek-ai/dsh-code-runtime': 0.1.5-rc.2
-  '@deepseek-ai/dsh-compaction': 0.1.5-rc.2
-  '@deepseek-ai/dsh-settings': 0.1.5-rc.2
-  '@deepseek-ai/dsh-hook-protocol': 0.1.5-rc.2
-  '@deepseek-ai/dsh-jobs': 0.1.5-rc.2
-  '@deepseek-ai/dsh-sandbox': 0.1.5-rc.2
-  '@deepseek-ai/dsh-session-query': 0.1.5-rc.2
-  '@deepseek-ai/dsh-util-time': 0.1.5-rc.2
-  '@deepseek-ai/dsh-shell': 0.1.5-rc.2
-  '@deepseek-ai/dsh-sdk-protocol': 0.1.5-rc.2
-  '@deepseek-ai/dsh-anonymous-user-id': 0.1.5-rc.2
-  '@deepseek-ai/dsh-output-retention': 0.1.5-rc.2
-  '@deepseek-ai/dsh-spill': 0.1.5-rc.2
-  '@deepseek-ai/dsh-workflow': 0.1.5-rc.2
-  '@deepseek-ai/dsh-util-workspace-path': 0.1.5-rc.2
-  '@deepseek-ai/dsh-bash-local': 0.1.5-rc.2
-  '@deepseek-ai/dsh-authorization': 0.1.5-rc.2
-  '@deepseek-ai/dsh-session-telemetry': 0.1.5-rc.2
-  '@deepseek-ai/dsh-session-title-llm': 0.1.5-rc.2
-  '@deepseek-ai/dsh-subagent-in-process-driver': 0.1.5-rc.2
+# No `overrides:` block on the 0.1.7-rc.1 line, deliberately. The 0.1.5-rc.2
+# profile needed one because those packages declared loose ranges, so ~23 of
+# their transitive deps resolved back to the older 0.1.2-rc.1 — silent at
+# install time (a peer warning only), fatal at boot: a newer consumer
+# ESM-imported a symbol the older peer's build never exported (e.g.
+# dsh-session-persistence-jsonl@0.1.5-rc.2 importing SessionAlreadyExistsError
+# from dsh-session-persistence@0.1.2-rc.1), crashing the whole plugin tree with
+# exit 1. Every `@deepseek-ai/dsh-*` package on the alpha.2 line pins its own
+# graph exactly, so the same install needs no forcing (verified 2026-09-23:
+# 281 @deepseek-ai packages installed, zero duplicate package names, one
+# cordis@4.0.4 that satisfies the plugin's `~4.0.4` peer).
 # Postinstall scripts required at runtime (node-pty/subprocess-local spawn
 # agents, koffi/protobufjs/genai serve model IO). Exact versions pinned in
 # pnpm-lock.yaml; review on every profile dep bump.
@@ -56,8 +27,10 @@ allowBuilds:
   koffi: true
   node-pty: true
   protobufjs: true
+# pnpm keeps only the FIRST entry per package name, so bumping our own
+# release means REPLACING its entry — appending the newer version leaves it
+# shadowed by the stale one and the 24h age gate keeps rejecting it (observed
+# 2026-09-18). The Docker build additionally passes
+# --config.minimumReleaseAge=0.
 minimumReleaseAgeExclude:
-  - '@ddtcorex/dsh-maestro-review@0.3.1'
-  - '@ddtcorex/maestro-skills@2.11.0'
-  - '@ddtcorex/dsh-maestro-review@0.5.1'
-  - '@ddtcorex/maestro-skills@2.11.1'
+  - '@ddtcorex/dsh-maestro-review@0.8.1'

package/skills/dsh-native-tools/SKILL.md

@@ -35,7 +35,7 @@ harness-neutral words — announce, dispatch a subagent, ask your partner. On DS
 | Write / edit files | `write`, `edit` (read before edit) |
 | Run shell commands, tests, git | `bash`; background via `run_in_background: true`, collect with `job_output`, stop with `job_kill` |
 | Search the web | `web_search` |
-| Look at an image file | `read_image` (text-only model: `modlens_read_image`) |
+| Look at an image file | `read_image` |
 | Ensure an isolated workspace | `git_worktree {op:'inspect', worktreePath}` → {exists,branch,headSha,isClean,isWorktree} (`worktreePath` is required on every op) |
 | Create a worktree | `git_worktree {op:'create', worktreePath, branch, base?}` → {created,headSha} |
 | Clean up a worktree | `git_worktree {op:'remove', worktreePath}` → {removed,dirtyFiles} |

package/src/host/augment.d.ts

@@ -16,7 +16,10 @@ import '@deepseek-ai/cordis'
 declare module '@deepseek-ai/cordis' {
   interface Context {
     webServer: { port: number; register: any }
-    connection: { rpc: { handle: (channel: string, handler: any, opts?: any) => () => void; call: any } }
+    // `handle` takes exactly (channel, handler): the Host never read an
+    // `{ authority: 'loopback' }` third argument, so this shape must not
+    // advertise one (dropped at the call site in #129).
+    connection: { rpc: { handle: (channel: string, handler: any) => () => void; call: any } }
     maestroTunnel: {
       status(): any
       start(): Promise<any>
@@ -42,7 +45,6 @@ declare module '@deepseek-ai/cordis' {
     agentDefaultModel: {
       currentSelection(): ModelSelection
     }
-    agentPresets: { mount(agentCtx: Context, id: string): Promise<unknown> | unknown }
     sessionTitle: { rename(session: unknown, title: string): Promise<unknown> | unknown }
     /** Current agent identity inside an agent-scoped context (WeakMap key). */
     agent?: object

package/src/host/orchestrator.ts

@@ -13,7 +13,7 @@ import { finalAssistantOutput } from '@deepseek-ai/dsh-subagent'
 import type { AgentHandle } from '@deepseek-ai/dsh-agent'
 import { installModelSelection } from '@deepseek-ai/dsh-agent'
 import type { ModelSelection } from '@deepseek-ai/dsh-agent'
-import type {} from '@deepseek-ai/dsh-agent-presets'
+import type {} from '@deepseek-ai/dsh-agent-preset-registry'
 import type {} from '@deepseek-ai/dsh-agent-default-model'
 import type {} from '@deepseek-ai/dsh-session-title'
 import * as GovardTool from './govard-tool.js'
@@ -1394,6 +1394,13 @@ export function apply(ctx: Context, config: Config): void {
           if (!result.sent && result.reason === 'request-failed') {
             console.error(`maestro-orchestrator: Telegram review notification for MR !${String(payload.mrIid)} failed to deliver`)
           }
+        }).catch((err) => {
+          // Delivery is fire-and-forget: a rejection must not escape into the
+          // host's unhandled-rejection path, which exits the whole process.
+          console.error(
+            `maestro-orchestrator: Telegram review notification for MR !${String(payload.mrIid)} threw:`,
+            err instanceof Error ? err.message : err,
+          )
         })
       }
       /** First line + bounded excerpt of a posted report, for the history log.

package/src/host/providers/gitlab.ts

@@ -146,6 +146,12 @@ export function apply(ctx: Context, config: Config): void {
           ctx.emit('maestro/review-request', request)
         }
         res.writeHead(200).end()
+      }).catch((err) => {
+        // The handler runs detached from the server's request callback: an
+        // escaping rejection reaches the host's unhandled-rejection path and
+        // exits the process, so answer 500 and keep the webhook alive.
+        console.error('maestro-review-webhook: handler failed:', err instanceof Error ? err.message : err)
+        try { res.writeHead(500).end() } catch { /* the response was already sent */ }
       })
     }
   }

package/src/host/settings-rpc.ts

@@ -288,7 +288,7 @@ export function apply(ctx: Context): void {
     }
     return fail(`Unknown endpoint: ${endpoint}`)
   }
-  const disposeRpc = ctx.connection.rpc.handle(MAESTRO_RPC_CHANNEL, handler, { authority: 'loopback' })
+  const disposeRpc = ctx.connection.rpc.handle(MAESTRO_RPC_CHANNEL, handler)
 
   ctx.effect(() => () => { disposeRpc(); }, 'maestro-settings-rpc teardown')
 }

package/templates/reviewer-project.gitlab-ci.yml

@@ -3,7 +3,7 @@ stages: [review]
 
 variables:
   # Image registry — pin the SHA for reproducibility
-  REVIEWER_IMAGE: "ddtcorex/maestro-reviewer:0.8.0"
+  REVIEWER_IMAGE: "ddtcorex/maestro-reviewer:0.9.0"
   # Or use $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA when building the image in the same project
 
 review:

package/presets/maestro-auditor/agent.cordis.yml

@@ -1,35 +0,0 @@
-- id: persona
-  name: '@deepseek-ai/dsh-persona'
-  config:
-    # The working directory varies per session, so it belongs in the suffix: the
-    # prefix is the model-stable part of the prompt that stays cacheable. The row
-    # must restate the suffix because an empty one shadows the deployment's away.
-    suffix: Your working directory is {{cwd}}.
-    prefix: |
-      You are Maestro Auditor, a Performance Architect. Workflow:
-      1. Call govard_env_up to bring up the merge request's Magento 2 environment.
-      2. Call govard_shell to run the test suite (e.g. "vendor/bin/phpunit") and any profiling commands.
-      3. Analyze the output for regressions, N+1 queries, or memory issues.
-      4. Call govard_env_down to tear the environment down.
-      5. Output a Markdown report. Do not call gitlab_post_mr_comment yourself — the orchestrator posts the combined report.
-
-# Delegation tools: the providers live in the Profile
-# (`subagent-codex` + `subagent-claude-code` rows), so a deployment without
-# those bundles gets inert rows — `tool-subagent` registers no tool until its
-# provider appears — rather than a failed mount. One-shot rows: a review
-# delegates a bounded task and collects the result.
-- id: tool-subagent-codex
-  name: '@deepseek-ai/dsh-tool-subagent'
-  config:
-    provider: codex
-    toolName: subagent_codex
-    backgroundMode: one-shot
-    maxDepth: provider-managed
-
-- id: tool-subagent-claude-code
-  name: '@deepseek-ai/dsh-tool-subagent'
-  config:
-    provider: claude-code
-    toolName: subagent_claude_code
-    backgroundMode: one-shot
-    maxDepth: provider-managed

package/presets/maestro-auditor/preset.yml

@@ -1,2 +0,0 @@
-name: Maestro Auditor
-description: Automated Performance Architect that profiles a GitLab merge request's Magento 2 environment via Govard. Invoked programmatically by dsh-maestro-review's orchestrator — not meant for manual selection.

package/presets/maestro-reviewer/agent.cordis.yml

@@ -1,39 +0,0 @@
-- id: persona
-  name: '@deepseek-ai/dsh-persona'
-  config:
-    # The working directory varies per session, so it belongs in the suffix: the
-    # prefix is the model-stable part of the prompt that stays cacheable. The row
-    # must restate the suffix because an empty one shadows the deployment's away.
-    suffix: Your working directory is {{cwd}}.
-    prefix: |
-      You are Maestro Reviewer, an AI Tech Lead. Workflow:
-      1. If the review request names a profile, call maestro_load_review_profile with that profile before inspecting code — it fails closed if the required skill set is incomplete. For a diff-only review with no local checkout or Magento environment, skip this step: there is no profile to load, and the diff is all the context you need.
-      2. Call gitlab_list_own_review_threads to see which findings you already raised on this merge request.
-      3. Call gitlab_get_mr_diff to read the current diff.
-      4. For each existing thread whose file/line was touched by the new commits, decide whether it still applies, looks fixed, or needs a different comment — reply to it (status: "reply"). Never resolve a thread yourself.
-      5. For genuinely new issues with no existing thread, prepare a new inline comment (status: "new").
-      6. Call report_review_findings exactly once with your complete list of findings, then stop. Do not call gitlab_post_mr_comment, gitlab_post_inline_comment, or gitlab_reply_to_thread yourself — the orchestrator posts them from your report_review_findings call.
-
-- id: skills-tool
-  name: '@ddtcorex/dsh-maestro-review/lib/skills-tool.js'
-
-# Delegation tools: the providers live in the Profile
-# (`subagent-codex` + `subagent-claude-code` rows), so a deployment without
-# those bundles gets inert rows — `tool-subagent` registers no tool until its
-# provider appears — rather than a failed mount. One-shot rows: a review
-# delegates a bounded task and collects the result.
-- id: tool-subagent-codex
-  name: '@deepseek-ai/dsh-tool-subagent'
-  config:
-    provider: codex
-    toolName: subagent_codex
-    backgroundMode: one-shot
-    maxDepth: provider-managed
-
-- id: tool-subagent-claude-code
-  name: '@deepseek-ai/dsh-tool-subagent'
-  config:
-    provider: claude-code
-    toolName: subagent_claude_code
-    backgroundMode: one-shot
-    maxDepth: provider-managed

package/presets/maestro-reviewer/preset.yml

@@ -1,2 +0,0 @@
-name: Maestro Reviewer
-description: Automated AI Tech Lead that reviews a GitLab merge request's diff against project coding standards. Invoked programmatically by dsh-maestro-review's orchestrator — not meant for manual selection.