@ddtcorex/dsh-maestro-review 0.8.1 → 0.10.0

package/profiles/reviewer-ci/pnpm-workspace.yaml

@@ -7,46 +7,17 @@
 # printed "Scope: all 2 workspace projects" and resolved relative to `../..`
 # without this file present).
 packages: []
-# Force the whole @deepseek-ai/dsh-* core dependency graph to one coherent
-# 0.1.5-rc.2 line. Bumping only dsh/dsh-base/dsh-agent-presets (the packages
-# this profile declares directly) left ~23 of THEIR transitive deps resolved
-# at the older 0.1.2-rc.1 they used to be pinned to, because nothing in the
-# graph forced them past whatever loose range their other consumers still
-# declared. The mismatch is silent at install time (a peer warning only) but
-# fatal at boot: a newer consumer ESM-imports a symbol the older peer's build
-# never exported (e.g. dsh-session-persistence-jsonl@0.1.5-rc.2 importing
-# SessionAlreadyExistsError from dsh-session-persistence@0.1.2-rc.1, which
-# doesn't have it), crashing the whole plugin tree with exit 1 — root-caused
-# 2026-09-14 by reproducing the crash locally (`docker run --entrypoint
-# /entrypoint.sh` with real credentials; GITLAB_HOST must be the bare
-# hostname, no `https://` prefix — ci-trigger.ts prepends the scheme itself).
-# pnpm reads `overrides:` here, NOT from package.json, on pnpm 11 (see the
-# dsh-invariants override above/below for the same gotcha in the sibling
-# workspace). Every package below is confirmed to publish a 0.1.5-rc.2.
-overrides:
-  '@deepseek-ai/dsh-attachment': 0.1.5-rc.2
-  '@deepseek-ai/dsh-session-persistence': 0.1.5-rc.2
-  '@deepseek-ai/dsh-fs': 0.1.5-rc.2
-  '@deepseek-ai/dsh-code-runtime': 0.1.5-rc.2
-  '@deepseek-ai/dsh-compaction': 0.1.5-rc.2
-  '@deepseek-ai/dsh-settings': 0.1.5-rc.2
-  '@deepseek-ai/dsh-hook-protocol': 0.1.5-rc.2
-  '@deepseek-ai/dsh-jobs': 0.1.5-rc.2
-  '@deepseek-ai/dsh-sandbox': 0.1.5-rc.2
-  '@deepseek-ai/dsh-session-query': 0.1.5-rc.2
-  '@deepseek-ai/dsh-util-time': 0.1.5-rc.2
-  '@deepseek-ai/dsh-shell': 0.1.5-rc.2
-  '@deepseek-ai/dsh-sdk-protocol': 0.1.5-rc.2
-  '@deepseek-ai/dsh-anonymous-user-id': 0.1.5-rc.2
-  '@deepseek-ai/dsh-output-retention': 0.1.5-rc.2
-  '@deepseek-ai/dsh-spill': 0.1.5-rc.2
-  '@deepseek-ai/dsh-workflow': 0.1.5-rc.2
-  '@deepseek-ai/dsh-util-workspace-path': 0.1.5-rc.2
-  '@deepseek-ai/dsh-bash-local': 0.1.5-rc.2
-  '@deepseek-ai/dsh-authorization': 0.1.5-rc.2
-  '@deepseek-ai/dsh-session-telemetry': 0.1.5-rc.2
-  '@deepseek-ai/dsh-session-title-llm': 0.1.5-rc.2
-  '@deepseek-ai/dsh-subagent-in-process-driver': 0.1.5-rc.2
+# No `overrides:` block on the 0.1.7-rc.1 line, deliberately. The 0.1.5-rc.2
+# profile needed one because those packages declared loose ranges, so ~23 of
+# their transitive deps resolved back to the older 0.1.2-rc.1 — silent at
+# install time (a peer warning only), fatal at boot: a newer consumer
+# ESM-imported a symbol the older peer's build never exported (e.g.
+# dsh-session-persistence-jsonl@0.1.5-rc.2 importing SessionAlreadyExistsError
+# from dsh-session-persistence@0.1.2-rc.1), crashing the whole plugin tree with
+# exit 1. Every `@deepseek-ai/dsh-*` package on the alpha.2 line pins its own
+# graph exactly, so the same install needs no forcing (verified 2026-09-23:
+# 281 @deepseek-ai packages installed, zero duplicate package names, one
+# cordis@4.0.4 that satisfies the plugin's `~4.0.4` peer).
 # Postinstall scripts required at runtime (node-pty/subprocess-local spawn
 # agents, koffi/protobufjs/genai serve model IO). Exact versions pinned in
 # pnpm-lock.yaml; review on every profile dep bump.
@@ -56,8 +27,10 @@ allowBuilds:
   koffi: true
   node-pty: true
   protobufjs: true
+# pnpm keeps only the FIRST entry per package name, so bumping our own
+# release means REPLACING its entry — appending the newer version leaves it
+# shadowed by the stale one and the 24h age gate keeps rejecting it (observed
+# 2026-09-18). The Docker build additionally passes
+# --config.minimumReleaseAge=0.
 minimumReleaseAgeExclude:
-  - '@ddtcorex/dsh-maestro-review@0.3.1'
-  - '@ddtcorex/maestro-skills@2.11.0'
-  - '@ddtcorex/dsh-maestro-review@0.5.1'
-  - '@ddtcorex/maestro-skills@2.11.1'
+  - '@ddtcorex/dsh-maestro-review@0.9.0'

package/skills/dsh-native-tools/SKILL.md

@@ -35,7 +35,7 @@ harness-neutral words — announce, dispatch a subagent, ask your partner. On DS
 | Write / edit files | `write`, `edit` (read before edit) |
 | Run shell commands, tests, git | `bash`; background via `run_in_background: true`, collect with `job_output`, stop with `job_kill` |
 | Search the web | `web_search` |
-| Look at an image file | `read_image` (text-only model: `modlens_read_image`) |
+| Look at an image file | `read_image` |
 | Ensure an isolated workspace | `git_worktree {op:'inspect', worktreePath}` → {exists,branch,headSha,isClean,isWorktree} (`worktreePath` is required on every op) |
 | Create a worktree | `git_worktree {op:'create', worktreePath, branch, base?}` → {created,headSha} |
 | Clean up a worktree | `git_worktree {op:'remove', worktreePath}` → {removed,dirtyFiles} |

package/src/host/augment.d.ts

@@ -16,7 +16,10 @@ import '@deepseek-ai/cordis'
 declare module '@deepseek-ai/cordis' {
   interface Context {
     webServer: { port: number; register: any }
-    connection: { rpc: { handle: (channel: string, handler: any, opts?: any) => () => void; call: any } }
+    // `handle` takes exactly (channel, handler): the Host never read an
+    // `{ authority: 'loopback' }` third argument, so this shape must not
+    // advertise one (dropped at the call site in #129).
+    connection: { rpc: { handle: (channel: string, handler: any) => () => void; call: any } }
     maestroTunnel: {
       status(): any
       start(): Promise<any>
@@ -42,7 +45,6 @@ declare module '@deepseek-ai/cordis' {
     agentDefaultModel: {
       currentSelection(): ModelSelection
     }
-    agentPresets: { mount(agentCtx: Context, id: string): Promise<unknown> | unknown }
     sessionTitle: { rename(session: unknown, title: string): Promise<unknown> | unknown }
     /** Current agent identity inside an agent-scoped context (WeakMap key). */
     agent?: object

package/src/host/orchestrator.ts

@@ -13,7 +13,7 @@ import { finalAssistantOutput } from '@deepseek-ai/dsh-subagent'
 import type { AgentHandle } from '@deepseek-ai/dsh-agent'
 import { installModelSelection } from '@deepseek-ai/dsh-agent'
 import type { ModelSelection } from '@deepseek-ai/dsh-agent'
-import type {} from '@deepseek-ai/dsh-agent-presets'
+import type {} from '@deepseek-ai/dsh-agent-preset-registry'
 import type {} from '@deepseek-ai/dsh-agent-default-model'
 import type {} from '@deepseek-ai/dsh-session-title'
 import * as GovardTool from './govard-tool.js'
@@ -39,6 +39,7 @@ import { reviewDigestText, type NotifierLike } from './notify.js'
 import { loadedReviewProfile, type ReviewSkillProfile } from './skills-tool.js'
 import type { ReviewProvider } from './providers/interface.js'
 import { gitlabProvider } from './providers/gitlab.js'
+import { REVIEW_SOURCE_KIND } from './source.js'
 import './events.js'
 import { gitlabAuthHeaders } from './gitlab-auth.js'
 import { reviewMarker, resolveFlow, type ReviewFlow } from './review-marker.js'
@@ -1167,7 +1168,7 @@ export function apply(ctx: Context, config: Config): void {
         if (incrementalBlock !== undefined) scopePrompt = `${incrementalBlock}\n\n${scopePrompt}`
         handle.agent.followup(createUserMessage({
           content: [{ type: 'text', text: scopePrompt }],
-          source: { kind: 'user' },
+          source: { kind: REVIEW_SOURCE_KIND },
         }))
         await whenIdleWithTimeout(handle, effectiveAgentTimeoutMs)
         assertTurnSucceededOrSalvage(handle, capturedFindings.length > 0, 'reviewer')
@@ -1266,7 +1267,7 @@ export function apply(ctx: Context, config: Config): void {
     ctx.sessionTitle.rename(handle.agent.session, `Maestro Auditor — MR !${payload.mrIid} (${payload.projectPath})`)
     try {
       const prompt = buildAuditorPrompt({ staticOnly: opts?.staticOnly === true })
-      handle.agent.followup(createUserMessage({ content: [{ type: 'text', text: prompt }], source: { kind: 'user' } }))
+      handle.agent.followup(createUserMessage({ content: [{ type: 'text', text: prompt }], source: { kind: REVIEW_SOURCE_KIND } }))
       await whenIdleWithTimeout(handle, effectiveAgentTimeoutMs)
       const output = auditorOutputFromSession(handle.agent.session)
       const text = output.map(block => ('text' in block ? block.text : '')).join('')

package/src/host/settings-rpc.ts

@@ -288,7 +288,7 @@ export function apply(ctx: Context): void {
     }
     return fail(`Unknown endpoint: ${endpoint}`)
   }
-  const disposeRpc = ctx.connection.rpc.handle(MAESTRO_RPC_CHANNEL, handler, { authority: 'loopback' })
+  const disposeRpc = ctx.connection.rpc.handle(MAESTRO_RPC_CHANNEL, handler)
 
   ctx.effect(() => () => { disposeRpc(); }, 'maestro-settings-rpc teardown')
 }

package/src/host/skill-provider.ts

@@ -26,9 +26,12 @@ export function resolveSkillsDir(fromDir: string): string {
 
 /** Minimal frontmatter reader for our own SKILL.md — enough for the provider contract. */
 function parseFrontmatter(raw: string): { name: string; description: string; body: string } {
-  const m = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/)
+  // `\r?\n` on both delimiters and on the line split: a SKILL.md checked out
+  // with CRLF (git core.autocrlf, a Windows editor) otherwise parses to an
+  // empty description with no error at all.
+  const m = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/)
   if (!m) return { name: SKILL_NAME, description: '', body: raw }
-  const fm = m[1].split('\n').reduce<Record<string, string>>((acc, line) => {
+  const fm = m[1].split(/\r?\n/).reduce<Record<string, string>>((acc, line) => {
     const kv = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/)
     if (kv) acc[kv[1]] = kv[2].replace(/^["']|["']$/g, '')
     return acc

package/src/host/source.ts

@@ -0,0 +1,26 @@
+/**
+ * The producer-owned source kind this plugin stamps on every message it injects
+ * into a review session.
+ *
+ * Session format v4 requires the producer to name itself (`plugin:<package>`)
+ * and rejects the retired bare `kind: 'plugin'`. `kind: 'user'` is admissible
+ * but false: these prompts are machine-initiated, and consumers classify a turn
+ * by this kind — dsh-maestro-memory's write guard documents that
+ * plugin-initiated turns carry no per-turn write duty.
+ *
+ * The reviewer and auditor sessions keep their own explicit
+ * `sessionTitle.rename(...)`: the harness only auto-titles a `kind: 'user'`
+ * message, so a plugin-attributed prompt feeds no title.
+ */
+export const REVIEW_SOURCE_KIND = 'plugin:@ddtcorex/dsh-maestro-review'
+
+// `MessageSourceMap` is the harness's merge-extensible sum type: each producer
+// declares its own kind in its own module (see `goal-round-driver` and
+// `schedule`), and there is deliberately no shared catch-all kind to reuse.
+import type {} from '@deepseek-ai/dsh-llm'
+
+declare module '@deepseek-ai/dsh-llm' {
+  interface MessageSourceMap {
+    'plugin:@ddtcorex/dsh-maestro-review': { readonly kind: 'plugin:@ddtcorex/dsh-maestro-review' }
+  }
+}

package/templates/reviewer-project.gitlab-ci.yml

@@ -3,7 +3,7 @@ stages: [review]
 
 variables:
   # Image registry — pin the SHA for reproducibility
-  REVIEWER_IMAGE: "ddtcorex/maestro-reviewer:0.8.1"
+  REVIEWER_IMAGE: "ddtcorex/maestro-reviewer:0.10.0"
   # Or use $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA when building the image in the same project
 
 review:

package/presets/maestro-auditor/agent.cordis.yml

@@ -1,35 +0,0 @@
-- id: persona
-  name: '@deepseek-ai/dsh-persona'
-  config:
-    # The working directory varies per session, so it belongs in the suffix: the
-    # prefix is the model-stable part of the prompt that stays cacheable. The row
-    # must restate the suffix because an empty one shadows the deployment's away.
-    suffix: Your working directory is {{cwd}}.
-    prefix: |
-      You are Maestro Auditor, a Performance Architect. Workflow:
-      1. Call govard_env_up to bring up the merge request's Magento 2 environment.
-      2. Call govard_shell to run the test suite (e.g. "vendor/bin/phpunit") and any profiling commands.
-      3. Analyze the output for regressions, N+1 queries, or memory issues.
-      4. Call govard_env_down to tear the environment down.
-      5. Output a Markdown report. Do not call gitlab_post_mr_comment yourself — the orchestrator posts the combined report.
-
-# Delegation tools: the providers live in the Profile
-# (`subagent-codex` + `subagent-claude-code` rows), so a deployment without
-# those bundles gets inert rows — `tool-subagent` registers no tool until its
-# provider appears — rather than a failed mount. One-shot rows: a review
-# delegates a bounded task and collects the result.
-- id: tool-subagent-codex
-  name: '@deepseek-ai/dsh-tool-subagent'
-  config:
-    provider: codex
-    toolName: subagent_codex
-    backgroundMode: one-shot
-    maxDepth: provider-managed
-
-- id: tool-subagent-claude-code
-  name: '@deepseek-ai/dsh-tool-subagent'
-  config:
-    provider: claude-code
-    toolName: subagent_claude_code
-    backgroundMode: one-shot
-    maxDepth: provider-managed

package/presets/maestro-auditor/preset.yml

@@ -1,2 +0,0 @@
-name: Maestro Auditor
-description: Automated Performance Architect that profiles a GitLab merge request's Magento 2 environment via Govard. Invoked programmatically by dsh-maestro-review's orchestrator — not meant for manual selection.

package/presets/maestro-reviewer/agent.cordis.yml

@@ -1,39 +0,0 @@
-- id: persona
-  name: '@deepseek-ai/dsh-persona'
-  config:
-    # The working directory varies per session, so it belongs in the suffix: the
-    # prefix is the model-stable part of the prompt that stays cacheable. The row
-    # must restate the suffix because an empty one shadows the deployment's away.
-    suffix: Your working directory is {{cwd}}.
-    prefix: |
-      You are Maestro Reviewer, an AI Tech Lead. Workflow:
-      1. If the review request names a profile, call maestro_load_review_profile with that profile before inspecting code — it fails closed if the required skill set is incomplete. For a diff-only review with no local checkout or Magento environment, skip this step: there is no profile to load, and the diff is all the context you need.
-      2. Call gitlab_list_own_review_threads to see which findings you already raised on this merge request.
-      3. Call gitlab_get_mr_diff to read the current diff.
-      4. For each existing thread whose file/line was touched by the new commits, decide whether it still applies, looks fixed, or needs a different comment — reply to it (status: "reply"). Never resolve a thread yourself.
-      5. For genuinely new issues with no existing thread, prepare a new inline comment (status: "new").
-      6. Call report_review_findings exactly once with your complete list of findings, then stop. Do not call gitlab_post_mr_comment, gitlab_post_inline_comment, or gitlab_reply_to_thread yourself — the orchestrator posts them from your report_review_findings call.
-
-- id: skills-tool
-  name: '@ddtcorex/dsh-maestro-review/lib/skills-tool.js'
-
-# Delegation tools: the providers live in the Profile
-# (`subagent-codex` + `subagent-claude-code` rows), so a deployment without
-# those bundles gets inert rows — `tool-subagent` registers no tool until its
-# provider appears — rather than a failed mount. One-shot rows: a review
-# delegates a bounded task and collects the result.
-- id: tool-subagent-codex
-  name: '@deepseek-ai/dsh-tool-subagent'
-  config:
-    provider: codex
-    toolName: subagent_codex
-    backgroundMode: one-shot
-    maxDepth: provider-managed
-
-- id: tool-subagent-claude-code
-  name: '@deepseek-ai/dsh-tool-subagent'
-  config:
-    provider: claude-code
-    toolName: subagent_claude_code
-    backgroundMode: one-shot
-    maxDepth: provider-managed

package/presets/maestro-reviewer/preset.yml

@@ -1,2 +0,0 @@
-name: Maestro Reviewer
-description: Automated AI Tech Lead that reviews a GitLab merge request's diff against project coding standards. Invoked programmatically by dsh-maestro-review's orchestrator — not meant for manual selection.