@ddtcorex/dsh-maestro-review 0.9.0 → 0.11.0

package/lib/workspace-tool.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"workspace-tool.js","sourceRoot":"","sources":["../src/host/workspace-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEvE,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAEnD,MAAM,CAAC,MAAM,IAAI,GAAG,wBAAwB,CAAA;AAC5C,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;AAM/B,MAAM,CAAC,MAAM,MAAM,GAAc,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAA;AAEF,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,aAAqB;IAClE,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;IACnD,IAAI,MAAM,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAEvF,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,QAAQ,GAAG,MAAM,CAAA;IACrB,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAA;YACtE,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;YAChC,IAAI,MAAM,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAA;YACzC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;YACnC,QAAQ,GAAG,MAAM,CAAA;YACjB,SAAQ;QACV,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACxE,IAAI,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC;YAAE,OAAO,SAAS,CAAA;QACvF,OAAO,MAAM,CAAA;IACf,CAAC;AACH,CAAC;AAcD,SAAS,gBAAgB,CAAC,cAAkC,EAAE,IAAa;IACzE,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,cAAc,CAAA;IACvD,MAAM,GAAG,GAAI,IAAqC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAA;IAC/E,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAAiB,EAAE;IACrD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAA;IAEtC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC7C,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,0DAA0D;QACvE,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE;SAC9F;QACD,MAAM,EAAE;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;YACjH,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SAC/D;QACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI;YACtB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YACrF,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,+BAA+B,EAAW,CAAA;YACpH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAC5C,OAAO,EAAE,IAAI,EAAE,CAAA;QACjB,CAAC;KACF,CAAC,CAAC,CAAC,CAAA;IAEJ,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC7C,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,kGAAkG;QAC/G,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE;YAC7F,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wBAAwB,EAAE;SACnF;QACD,MAAM,EAAE;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;YACrH,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;SACjE;QACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI;YACtB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YACrF,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,+BAA+B,EAAW,CAAA;YACpH,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACjD,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAC1B,CAAC;KACF,CAAC,CAAC,CAAC,CAAA;AACN,CAAC"}

package/src/host/govard-audit-lint-tool.ts

@@ -1,286 +0,0 @@
-import { spawn } from 'node:child_process'
-import { basename, dirname, resolve, sep } from 'node:path'
-import { realpath } from 'node:fs/promises'
-import type { Context } from '@deepseek-ai/cordis'
-import z from '@deepseek-ai/schemastery'
-import { defineTool } from '@deepseek-ai/dsh-tools'
-
-export const name='maestro-govard-audit-lint-tool'
-export const inject=['tools']
-export const Config:z<{rootPath?:string, timeoutMs?:number, defaultBase?:string, allowXdebug?:boolean}> = z.object({rootPath:z.string(), timeoutMs:z.number(), defaultBase:z.string(), allowXdebug:z.boolean()})
-
-export interface AuditLintOptions {
-  checks?: string[]
-  mode?: string
-  scope?: string
-  base?: string
-  phpVersions?: string[]
-  noLintResultCache?: boolean
-  timeout?: string
-  lintProvider?: string
-  allowXdebug?: boolean
-}
-
-/** Explicit call base wins, then the review-wired default (MR base_sha). */
-export function resolveLintBase(argsBase: string | undefined, defaultBase: string | undefined): string | undefined {
-  return argsBase ?? defaultBase
-}
-
-export function buildAuditCliArgs(a: AuditLintOptions): string[] {
-  const checks = a.checks && a.checks.length ? a.checks.join(',') : 'lint'
-  const mode = a.mode ?? 'auto'
-  const timeout = a.timeout ?? 'auto'
-  const lintProvider = a.lintProvider ?? 'govard'
-  const cliArgs=['audit','run','--checks',checks,'--format','json','--mode',mode,'--timeout',timeout,'--lint-provider',lintProvider]
-  if(a.scope) cliArgs.push('--scope', a.scope)
-  const base = resolveLintBase(a.base, undefined)
-  if(base) cliArgs.push('--base', base)
-  if(a.phpVersions && a.phpVersions.length) cliArgs.push('--php', a.phpVersions.join(','))
-  if(a.noLintResultCache) cliArgs.push('--no-lint-result-cache')
-  if(a.allowXdebug) cliArgs.push('--allow-xdebug')
-  return cliArgs
-}
-
-interface SC{agent?:{session?:{header?:{cwd?:string}}}}
-function workspaceRootFor(c:string|undefined, e:unknown):string{
-  if(c!==undefined) return c
-  const cwd=(e as SC|undefined)?.agent?.session?.header?.cwd
-  return typeof cwd==='string'&&cwd!==''?cwd:process.cwd()
-}
-async function isInsideRoot(r:string,t:string):Promise<boolean>{
-  const ar=resolve(r); const rs=resolve(ar,t)
-  if(rs!==ar && !rs.startsWith(ar+sep)) return false
-  let realRoot:string
-  try{ realRoot=await realpath(ar)}catch{ return true }
-  let existing=rs
-  const pending:string[]=[]
-  while(true){
-    let real:string
-    try{ real=await realpath(existing)}catch(err){
-      if((err as NodeJS.ErrnoException).code!=='ENOENT') return false
-      const parent=dirname(existing)
-      if(parent===existing) return false
-      pending.unshift(basename(existing))
-      existing=parent
-      continue
-    }
-    const realTarget=pending.length>0? resolve(real,...pending):real
-    if(realTarget!==realRoot && !realTarget.startsWith(realRoot+sep)) return false
-    return true
-  }
-}
-export function cleanJson(raw:string):string{
-  // pterm pads the level name: "  ERROR   audit run ..." (multi-space).
-  return raw.replace(/\n\s*ERROR\s+audit run.*$/s, '').replace(/\s{2,}ERROR\s+audit run.*$/s, '').trimEnd()
-}
-
-interface LintViolationLike { path?: string; line?: number; rule?: string; message?: string }
-
-interface LintResultLike {
-  ok: boolean
-  exitCode?: number
-  lint?: {
-    phpcs?: { violations?: LintViolationLike[] }
-    phpstan?: { errors?: LintViolationLike[] }
-    pubMediaGuard?: { violations?: LintViolationLike[] }
-  }
-  summary?: { findingCount?: number }
-  diagnostics?: string
-}
-
-/**
- * One-line-plus render for the agent: a bare "audit lint failed" hides the
- * violations the reviewer needs, so carry counts plus the top findings.
- */
-export interface CollectedLintFindings {
-  phpcsViolations: Array<{ path?: string; line?: number; column?: number; rule?: string; message?: string; severity?: string }>
-  phpstanErrors: Array<{ path?: string; line?: number; message?: string }>
-  pubMediaViolations: unknown[]
-  compat: Array<{ tool?: string; path?: string; line?: number; rule?: string; message?: string }>
-  total: number
-}
-
-/**
- * Collect findings across govard audit JSON shapes. The live envelope nests
- * them at results[].evidence.php_results[].findings (older callers used a
- * top-level findings array or evidence.php_results) — and non-phpcs/phpstan
- * tools (e.g. M2-LINT-COMPAT internal errors) go to the compat bucket
- * instead of being silently dropped from counts.
- */
-export function collectLintFindings(parsed: unknown): CollectedLintFindings {
-  const p = (parsed ?? {}) as Record<string, any>
-  const lists: unknown[][] = []
-  if (Array.isArray(p.findings)) lists.push(p.findings)
-  const ev = p.evidence as Record<string, any> | undefined
-  if (Array.isArray(ev?.php_results)) lists.push(...ev.php_results.map((r: any) => r?.findings).filter(Array.isArray))
-  if (Array.isArray(p.php_results)) lists.push(...p.php_results.map((r: any) => r?.findings).filter(Array.isArray))
-  // Live shape (govard audit run): jobs[].evidence.php_results[].findings.
-  // Older shapes (results[], bare evidence) kept for backward compatibility.
-  for (const key of ['jobs', 'results'] as const) {
-    if (!Array.isArray(p[key])) continue
-    for (const r of p[key] as Array<Record<string, any>>) {
-      const e = r?.evidence as Record<string, any> | undefined
-      const pr = e?.php_results ?? r?.php_results
-      if (Array.isArray(pr)) lists.push(...pr.map((x: any) => x?.findings).filter(Array.isArray))
-      if (Array.isArray(r?.findings)) lists.push(r.findings)
-    }
-  }
-  const out: CollectedLintFindings = { phpcsViolations: [], phpstanErrors: [], pubMediaViolations: [], compat: [], total: 0 }
-  // DSH tool output must be lossless JSON: drop undefined fields, the
-  // runtime rejects values that do not survive a JSON round-trip.
-  const compact = (entry: Record<string, unknown>): Record<string, unknown> => {
-    const kept: Record<string, unknown> = {}
-    for (const [k, v] of Object.entries(entry)) if (v !== undefined) kept[k] = v
-    return kept
-  }
-  for (const list of lists) {
-    for (const f of list as Array<Record<string, any>>) {
-      if (f?.tool === 'phpstan') out.phpstanErrors.push(compact({ path: f.path, line: f.line, message: f.message }) as CollectedLintFindings['phpstanErrors'][number])
-      else if (f?.tool === 'phpcs') {
-        if (f.path?.includes('pub/media') || f.rule?.includes('PubMedia')) out.pubMediaViolations.push(f)
-        else out.phpcsViolations.push(compact({ path: f.path, line: f.line, column: f.column, rule: f.rule, message: f.message, severity: f.severity }) as CollectedLintFindings['phpcsViolations'][number])
-      } else if (f && typeof f === 'object') {
-        out.compat.push(compact({ tool: f.tool, path: f.path, line: f.line, rule: f.rule, message: f.message }) as CollectedLintFindings['compat'][number])
-      }
-    }
-  }
-  out.total = out.phpcsViolations.length + out.phpstanErrors.length + out.pubMediaViolations.length + out.compat.length
-  return out
-}
-
-export function lintResultText(v: LintResultLike): string {
-  if (v.ok) return 'audit lint passed'
-  const phpcs = v.lint?.phpcs?.violations ?? []
-  const phpstan = v.lint?.phpstan?.errors ?? []
-  const pubMedia = v.lint?.pubMediaGuard?.violations ?? []
-  const compat = (v.lint as Record<string, any> | undefined)?.compat?.findings ?? []
-  const total = v.summary?.findingCount ?? phpcs.length + phpstan.length + pubMedia.length + compat.length
-  const bits: string[] = [`audit lint failed — ${total} finding(s) (phpcs ${phpcs.length}, phpstan ${phpstan.length}, pubMedia ${pubMedia.length}, compat ${compat.length})`]
-  const top = [...phpcs.map(x => ({ ...x, tool: 'phpcs' })), ...phpstan.map(x => ({ ...x, tool: 'phpstan' })), ...pubMedia.map(x => ({ ...x, tool: 'pubMedia' })), ...compat.map((x: Record<string, any>) => ({ ...x, tool: x.tool ?? 'compat' }))].slice(0, 5)
-  for (const f of top) bits.push(`- [${f.tool}] ${f.path ?? (f.message ?? '?').toString().slice(0, 120)}${f.path !== undefined ? `:${f.line ?? '?'}` : ''}${f.rule !== undefined ? ` ${f.rule}` : ''}`)
-  if (v.exitCode !== undefined) bits.push(`exit ${v.exitCode}`)
-  const diag = (v.diagnostics ?? '').split('\n')[0]?.trim()
-  if (total === 0 && diag !== '' && diag !== undefined) bits.push(diag.slice(0, 200))
-  return bits.join('\n')
-}
-// Govard 1.67 auto timeout: 90s-30m framework-aware (15m floor for wordpress/magento2 → 22.5m auto)
-// Keep kill timeout above the largest auto value so the outer watchdog doesn't cancel a valid auto run.
-const DEFAULT_TIMEOUT=900_000
-
-function run(cmd:string, args:string[], cwd:string, timeoutMs:number):Promise<{code:number|null, stdout:string, stderr:string, timedOut:boolean}>{
-  return new Promise((resolvePromise)=>{
-    const child=spawn(cmd, args, {cwd})
-    let stdout='', stderr=''
-    let timedOut=false
-    const timer=setTimeout(()=>{ timedOut=true; child.kill('SIGKILL') }, timeoutMs)
-    child.stdout?.on('data',(c:Buffer)=> stdout+=c.toString())
-    child.stderr?.on('data',(c:Buffer)=> stderr+=c.toString())
-    child.on('error',(err:Error)=>{ clearTimeout(timer); resolvePromise({code:null, stdout, stderr: err.message, timedOut:false}) })
-    child.on('close',(code)=>{ clearTimeout(timer); resolvePromise({code, stdout, stderr, timedOut}) })
-  })
-}
-
-export function apply(ctx:Context, config:{rootPath?:string, timeoutMs?:number, defaultBase?:string, allowXdebug?:boolean}={}):void{
-  const configuredRoot=config.rootPath
-  const defaultTimeout=config.timeoutMs ?? DEFAULT_TIMEOUT
-  const defaultBase=config.defaultBase
-  // Review worktrees disable xdebug via .govard.local.yml, but govard's lint
-  // guard probes the base .govard.yml only — so the mount opts out explicitly.
-  const allowXdebug=config.allowXdebug ?? false
-  ctx.effect(()=>ctx.tools.register(defineTool({
-    name:'govard_audit_lint',
-    description:'Run govard audit --checks lint --format json and return structured phpcs/phpstan results. Use before hand-parsing text. Govard 1.67+ uses --timeout auto (framework-aware 90s-30m, 22.5m for wordpress/magento2) by default. scope "diff" requires a base ref: pass base, or rely on the wired defaultBase (MR base_sha) when present.',
-    parameters:{
-      worktreePath:{type:'string'},
-      checks:{type:'array', items:{type:'string'}},
-      mode:{type:'string', enum:['auto','project','module_in_project','standalone']},
-      phpVersions:{type:'array', items:{type:'string'}},
-      noLintResultCache:{type:'boolean'},
-      timeoutMs:{type:'number'},
-      // New in 1.67/2.7: framework-aware timeout and native lint provider
-      timeout:{type:'string', description:'Govard --timeout (e.g. auto, 300s, 15m, 0 for no timeout). Default auto.'},
-      lintProvider:{type:'string', description:'--lint-provider (govard or external). Default govard.'},
-      scope:{type:'string', enum:['project','diff']},
-      base:{type:'string', description:'--base ref for diff scope'},
-    },
-    output:{
-      schema:{
-        type:'object', additionalProperties:false,
-        properties:{
-          ok:{type:'boolean', required:true},
-          exitCode:{type:'number', required:true},
-          timedOut:{type:'boolean', required:true},
-          worktreePath:{type:'string', required:true},
-          lint:{type:'object', required:true, additionalProperties:true},
-          summary:{type:'object', required:true, additionalProperties:true},
-          rawJson:{type:'object', required:true, additionalProperties:true},
-          errors:{type:'array', items:{type:'object', additionalProperties:true}},
-          diagnostics:{type:'string'},
-          sessionId:{type:'string'},
-          runId:{type:'string'},
-        }
-      },
-      render:(_a,v:LintResultLike)=>[{type:'text', text: lintResultText(v)}],
-    },
-    async execute(args, exec){
-      const rawPath=(args as {worktreePath?:string}).worktreePath
-      const root=workspaceRootFor(configuredRoot, exec)
-      const worktreePath= rawPath ? resolve(root, rawPath) : root
-      const checkPath= rawPath ?? ''
-      if(checkPath!=='' && !(await isInsideRoot(root, checkPath))) return {text:`Path "${checkPath}" escapes the workspace root.`, truncated:false} as never
-      const timeoutMs=(args as {timeoutMs?:number}).timeoutMs ?? defaultTimeout
-      if(timeoutMs<5000 || timeoutMs>1_800_000) return {text:'timeoutMs out of range 5000-1800000 (5s-30m). Use --timeout auto for framework-aware estimation.', truncated:false} as never
-
-      const a = args as {checks?:string[]; mode?:string; scope?:string; base?:string; phpVersions?:string[]; noLintResultCache?:boolean; timeout?:string; lintProvider?:string; allowXdebug?:boolean}
-      const scope = a.scope
-      const base = resolveLintBase(a.base, defaultBase)
-      if (scope === 'diff' && base === undefined) {
-        return {text:'scope "diff" requires a base ref (govard --base): pass base explicitly (e.g. origin/master or the MR base_sha) or mount this tool with defaultBase.', truncated:false} as never
-      }
-      const cliArgs = buildAuditCliArgs({ ...a, base, allowXdebug: a.allowXdebug ?? allowXdebug })
-      const result=await run('govard', cliArgs, worktreePath, timeoutMs)
-      if(result.timedOut){
-        return {ok:false, exitCode: result.code ?? 124, timedOut:true, worktreePath, lint:{phpcs:{violations:[]}, phpstan:{errors:[]}, pubMediaGuard:{violations:[]}}, summary:{status:null, phpVersions:[], matrixComplete:false, findingCount:0, truncated:false}, rawJson:{}, errors:[{code:'timeout', message:`timed out after ${timeoutMs}ms` }], diagnostics:result.stderr.slice(0,4000)} as never
-      }
-      if(result.code===null && result.stderr.includes('ENOENT')){
-        return {ok:false, exitCode:127, timedOut:false, worktreePath, lint:{phpcs:{violations:[]}, phpstan:{errors:[]}, pubMediaGuard:{violations:[]}}, summary:{status:null, phpVersions:[], matrixComplete:false, findingCount:0, truncated:false}, rawJson:{}, errors:[{code:'govard_not_found', message:'govard binary not found'}], diagnostics:result.stderr.slice(0,4000)} as never
-      }
-      const cleaned=cleanJson(result.stdout)
-      let parsed:any=null
-      try{ parsed=JSON.parse(cleaned) }catch{ parsed=null }
-      if(!parsed){
-        const fallback=cleaned.split('\n').slice(0,-1).join('\n').trimEnd()
-        try{ parsed=JSON.parse(fallback)}catch{}
-        if(!parsed){
-          const tryStderr=cleanJson(result.stdout+result.stderr)
-          try{ parsed=JSON.parse(tryStderr)}catch{}
-        }
-      }
-      if(!parsed){
-        return {ok:false, exitCode: result.code ?? 1, timedOut:false, worktreePath, lint:{phpcs:{violations:[]}, phpstan:{errors:[]}, pubMediaGuard:{violations:[]}}, summary:{status:null, phpVersions:[], matrixComplete:false, findingCount:0, truncated:false}, rawJson:{}, errors:[{code:'parse_error', message:'stdout not JSON'}], diagnostics:(cleaned+result.stderr).slice(0,4000)} as never
-      }
-      const collected = collectLintFindings(parsed)
-      const phpcsViolations = collected.phpcsViolations
-      const phpstanErrors = collected.phpstanErrors
-      const pubMediaViolations = collected.pubMediaViolations
-      const status=parsed.status ?? (result.code===0?'passed':'failed')
-      const phpVersions=parsed.php_versions ?? parsed.phpVersions ?? []
-      const findingCount=collected.total
-      const sessionId = parsed.session_id ?? parsed.sessionId ?? undefined
-      const runId = parsed.run_id ?? parsed.runId ?? undefined
-      return {
-        ok: result.code===0,
-        exitCode: result.code ?? 0,
-        timedOut:false,
-        worktreePath,
-        ...(sessionId ? { sessionId: String(sessionId) } : {}),
-        ...(runId ? { runId: String(runId) } : {}),
-        rawJson: parsed as Record<string, unknown>,
-        summary:{status, phpVersions, matrixComplete:true, findingCount, truncated: findingCount>100},
-        lint:{phpcs:{violations:phpcsViolations}, phpstan:{errors:phpstanErrors}, pubMediaGuard:{violations:pubMediaViolations}, compat:{findings:collected.compat}},
-        errors:[],
-        diagnostics: result.stderr.slice(0,4000),
-      } as never
-    }
-  })))
-}

package/src/host/govard-tool.ts

@@ -1,114 +0,0 @@
-import { spawn } from 'node:child_process'
-import { existsSync } from 'node:fs'
-import { join } from 'node:path'
-import type { Context } from '@deepseek-ai/cordis'
-import z from '@deepseek-ai/schemastery'
-import { defineTool } from '@deepseek-ai/dsh-tools'
-
-export const name = 'maestro-govard-tool'
-export const inject = ['tools']
-
-export interface Config {
-  rootPath?: string
-  timeoutMs?: number
-}
-
-export const Config: z<Config> = z.object({
-  rootPath: z.string(),
-  timeoutMs: z.number().min(1_000).default(300_000),
-})
-
-interface RunResult {
-  code: number | null
-  stdout: string
-  stderr: string
-}
-
-function run(command: string, args: string[], cwd: string, timeoutMs: number): Promise<RunResult> {
-  return new Promise((promiseResolve, promiseReject) => {
-    const child = spawn(command, args, { cwd })
-    let stdout = ''
-    let stderr = ''
-    const timer = setTimeout(() => {
-      child.kill('SIGKILL')
-      promiseReject(new Error(`"${command} ${args.join(' ')}" timed out after ${timeoutMs}ms`))
-    }, timeoutMs)
-    child.stdout?.on('data', (chunk: Buffer) => { stdout += chunk.toString() })
-    child.stderr?.on('data', (chunk: Buffer) => { stderr += chunk.toString() })
-    child.on('error', (err) => {
-      clearTimeout(timer)
-      promiseReject(err)
-    })
-    child.on('close', (code) => {
-      clearTimeout(timer)
-      promiseResolve({ code, stdout, stderr })
-    })
-  })
-}
-
-function textResult(result: RunResult, successText: string): { text: string } {
-  if (result.code !== 0) {
-    throw new Error(`Exit ${result.code}: ${result.stderr || result.stdout}`)
-  }
-  return { text: result.stdout.length > 0 ? result.stdout : successText }
-}
-
-export function apply(ctx: Context, config: Config): void {
-  const rootPath = config.rootPath ?? process.cwd()
-  const timeoutMs = config.timeoutMs ?? 300_000
-
-  async function ensureInitialized(): Promise<void> {
-    if (existsSync(join(rootPath, '.govard.yml'))) return
-    const result = await run('govard', ['init', '--framework', 'magento2', '-y'], rootPath, timeoutMs)
-    if (result.code !== 0) throw new Error(`govard init failed: ${result.stderr || result.stdout}`)
-  }
-
-  ctx.tools.register(defineTool({
-    name: 'govard_env_up',
-    description: 'Bring up the local Magento 2 Govard environment for the current worktree, initializing it first if needed.',
-    parameters: {},
-    output: {
-      schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string', required: true } } },
-      render: (_args, value) => [{ type: 'text', text: value.text }],
-    },
-    async execute() {
-      await ensureInitialized()
-      const result = await run('govard', ['up'], rootPath, timeoutMs)
-      return textResult(result, 'Environment is up.')
-    },
-  }))
-
-  ctx.tools.register(defineTool({
-    name: 'govard_shell',
-    description: 'Run one non-interactive command inside the Govard-managed container (e.g. a test suite) and return its output.',
-    parameters: {
-      command: { type: 'string', required: true, description: 'Shell command to run inside the container. PHPUnit in a Magento root: always scope it — "vendor/bin/phpunit -c dev/tests/unit/phpunit.xml.dist --filter <Module>" or "vendor/bin/phpunit --no-coverage --bootstrap dev/tests/unit/framework/bootstrap.php app/code/<Vendor>/<Module>/Test/Unit". The root ships no phpunit.xml so the bare binary prints usage and exits 1; never run the full suite bare (core fixture conflicts), and capture status via ${PIPESTATUS[0]} when piping through tail.' },
-    },
-    output: {
-      schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string', required: true } } },
-      render: (_args, value) => [{ type: 'text', text: value.text }],
-    },
-    async execute(args) {
-      const result = await run('govard', ['shell', '-c', args.command], rootPath, timeoutMs)
-      return textResult(result, '(no output)')
-    },
-  }))
-
-  ctx.tools.register(defineTool({
-    name: 'govard_env_down',
-    description: 'Tear down the local Govard environment for the current worktree, removing volumes.',
-    parameters: {},
-    output: {
-      schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string', required: true } } },
-      render: (_args, value) => [{ type: 'text', text: value.text }],
-    },
-    async execute() {
-      const result = await run('govard', ['down', '-v'], rootPath, timeoutMs)
-      return textResult(result, 'Environment is down.')
-    },
-  }))
-
-  ctx.effect(() => async () => {
-    await run('govard', ['down', '-v'], rootPath, timeoutMs).catch(() => undefined)
-  }, 'govard-tool teardown')
-}

package/src/host/workspace-tool.ts

@@ -1,108 +0,0 @@
-import { basename, dirname, resolve, sep } from 'node:path'
-import { mkdir, readFile, realpath, writeFile } from 'node:fs/promises'
-import type { Context } from '@deepseek-ai/cordis'
-import z from '@deepseek-ai/schemastery'
-import { defineTool } from '@deepseek-ai/dsh-tools'
-
-export const name = 'maestro-workspace-tool'
-export const inject = ['tools']
-
-export interface Config {
-  rootPath?: string
-}
-
-export const Config: z<Config> = z.object({
-  rootPath: z.string(),
-})
-
-async function resolveInRoot(rootPath: string, requestedPath: string): Promise<string | undefined> {
-  const absoluteRoot = resolve(rootPath)
-  const target = resolve(absoluteRoot, requestedPath)
-  if (target !== absoluteRoot && !target.startsWith(absoluteRoot + sep)) return undefined
-
-  let realRoot: string
-  try {
-    realRoot = await realpath(absoluteRoot)
-  } catch {
-    return undefined
-  }
-
-  let existing = target
-  const pending: string[] = []
-  while (true) {
-    let real: string
-    try {
-      real = await realpath(existing)
-    } catch (err) {
-      if ((err as NodeJS.ErrnoException).code !== 'ENOENT') return undefined
-      const parent = dirname(existing)
-      if (parent === existing) return undefined
-      pending.unshift(basename(existing))
-      existing = parent
-      continue
-    }
-    const realTarget = pending.length > 0 ? resolve(real, ...pending) : real
-    if (realTarget !== realRoot && !realTarget.startsWith(realRoot + sep)) return undefined
-    return target
-  }
-}
-
-/**
- * Structural view of the tool run-context fields this tool needs. Mirrors the
- * `@deepseek-ai/dsh-tool-fs` session-cwd semantics: without an explicit pinned
- * root, relative paths resolve against the CALLING agent's per-session
- * workspace (`exec.agent.session.header.cwd`), so subagents whose session
- * lives in a checkout or review worktree read their own tree instead of the
- * harness host's `process.cwd()`.
- */
-interface SessionCwdSource {
-  agent?: { session?: { header?: { cwd?: string } } }
-}
-
-function workspaceRootFor(configuredRoot: string | undefined, exec: unknown): string {
-  if (configuredRoot !== undefined) return configuredRoot
-  const cwd = (exec as SessionCwdSource | undefined)?.agent?.session?.header?.cwd
-  return typeof cwd === 'string' && cwd !== '' ? cwd : process.cwd()
-}
-
-export function apply(ctx: Context, config: Config = {}): void {
-  const configuredRoot = config.rootPath
-
-  ctx.effect(() => ctx.tools.register(defineTool({
-    name: 'maestro_read_file',
-    description: 'Read a text file relative to the current workspace root.',
-    parameters: {
-      path: { type: 'string', required: true, description: 'Path relative to the workspace root.' },
-    },
-    output: {
-      schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string', required: true } } },
-      render: (_args, value) => [{ type: 'text', text: value.text }],
-    },
-    async execute(args, exec) {
-      const target = await resolveInRoot(workspaceRootFor(configuredRoot, exec), args.path)
-      if (target === undefined) return { isError: true, text: `Path "${args.path}" escapes the workspace root.` } as never
-      const text = await readFile(target, 'utf-8')
-      return { text }
-    },
-  })))
-
-  ctx.effect(() => ctx.tools.register(defineTool({
-    name: 'maestro_write_file',
-    description: 'Write a text file relative to the current workspace root, creating parent directories as needed.',
-    parameters: {
-      path: { type: 'string', required: true, description: 'Path relative to the workspace root.' },
-      content: { type: 'string', required: true, description: 'File content to write.' },
-    },
-    output: {
-      schema: { type: 'object', additionalProperties: false, properties: { written: { type: 'boolean', required: true } } },
-      render: (args) => [{ type: 'text', text: `Wrote ${args.path}` }],
-    },
-    async execute(args, exec) {
-      const target = await resolveInRoot(workspaceRootFor(configuredRoot, exec), args.path)
-      if (target === undefined) return { isError: true, text: `Path "${args.path}" escapes the workspace root.` } as never
-      await mkdir(dirname(target), { recursive: true })
-      await writeFile(target, args.content, 'utf-8')
-      return { written: true }
-    },
-  })))
-}