chore: sync public mirror from internal by haasonsaas · Pull Request #415 · evalops/maestro

haasonsaas · 2026-05-16T03:54:56Z

Summary

sync the sanitized public tree from evalops/maestro-internal
keep evalops/maestro as a generated public mirror of the private source of truth
preserve public-owned CI and trusted-publishing workflows from the public checkout
internal source SHA: a6010fbee9200fd2fa028e8fe9f39c921fad19ba
last generated public sync base: eeeae08015dec2a1cb98a0219df8061dc4881f73
previewed public-tree drift: 27 file(s) to copy/update and 0 stale file(s) to delete
public-only commits since last generated sync: 0

Source-of-truth status

Public Mirror Drift Audit

package: @evalops/maestro
private source: https://github.com/evalops/maestro-internal@main (a6010fbee920)
public projection: https://github.com/evalops/maestro@main (eeeae08015de)
files to copy or update: 27
stale files to delete: 0
result: drift detected
invariant: public_projection_has_drift

Sample Changed Paths

copy/update docs/protocols/a2a-peer-pairing.md
copy/update docs/protocols/a2a-tmux-smoke.md
copy/update docs/protocols/codex-a2a-peer-relay.md
copy/update package.json
copy/update packages/tui-rs/src/app.rs
copy/update packages/tui-rs/src/commands/mod.rs
copy/update packages/tui-rs/src/commands/registry.rs
copy/update packages/tui-rs/src/commands/types.rs
copy/update scripts/smoke-maestro-a2a-tmux.sh
copy/update src/cli-tui/commands/a2a-handlers.ts
copy/update src/cli-tui/commands/command-catalog.ts
copy/update src/cli-tui/commands/command-registry-adapter.ts
copy/update src/cli-tui/commands/types.ts
copy/update src/cli-tui/tui-renderer/command-registry-options.ts
copy/update src/cli.ts
copy/update src/cli/args.ts
copy/update src/cli/commands/a2a.ts
copy/update src/index.ts
copy/update src/main.ts
copy/update src/platform/a2a-client.ts
copy/update src/platform/a2a-peer-pairing.ts
copy/update src/platform/a2a-peer-registry.ts
copy/update test/cli-tui/commands/command-registry-integration.test.ts
copy/update test/cli/args.test.ts
copy/update test/cli/commands/a2a.test.ts
... 2 more

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

copy/update docs/protocols/a2a-peer-pairing.md
copy/update docs/protocols/a2a-tmux-smoke.md
copy/update docs/protocols/codex-a2a-peer-relay.md
copy/update package.json
copy/update packages/tui-rs/src/app.rs
copy/update packages/tui-rs/src/commands/mod.rs
copy/update packages/tui-rs/src/commands/registry.rs
copy/update packages/tui-rs/src/commands/types.rs
copy/update scripts/smoke-maestro-a2a-tmux.sh
copy/update src/cli-tui/commands/a2a-handlers.ts
copy/update src/cli-tui/commands/command-catalog.ts
copy/update src/cli-tui/commands/command-registry-adapter.ts
copy/update src/cli-tui/commands/types.ts
copy/update src/cli-tui/tui-renderer/command-registry-options.ts
copy/update src/cli.ts
copy/update src/cli/args.ts
copy/update src/cli/commands/a2a.ts
copy/update src/index.ts
copy/update src/main.ts
copy/update src/platform/a2a-client.ts

Public-only commits since last generated sync

none detected since last generated sync

Validation

generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

generated by the sync-public-release-mirror workflow in public-tree mode
public-source-provenance require-internal-pr check confirms internal source PR lineage
CI, integration, rust-hosted-conformance, coverage, Socket, and Cursor checks must pass before merge

Staged Rollout

Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/maestro-internal@a6010fbee9200fd2fa028e8fe9f39c921fad19ba, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

cursor · 2026-05-16T03:55:02Z

PR Summary

Medium Risk
Adds new A2A pairing/registry code paths plus CLI send/wait flows that touch auth token loading and network endpoints, so regressions could impact peer connectivity and safety guarantees around secret handling.

Overview
Introduces native A2A peer pairing via short-lived maestro-pair-v1 codes, including new a2a-peer-pairing utilities that validate/normalize URLs, enforce expiry, add checksums, and explicitly reject secret-like fields.

Adds a shared A2A peer registry (~/.maestro/a2a/peers.json, overridable via MAESTRO_A2A_PEERS_FILE with legacy CODEX_A2A_PEERS_FILE support) plus a new maestro a2a command family (offer/accept/peers/card/send/wait) that can poll tasks and source auth from env/file references without persisting token values.

Extends both TUIs with a /a2a command surface (TypeScript wires accept/peers; Rust adds parsing and placeholder actions), updates command execution to report async handler failures, swaps npm run a2a:peer to the TS implementation, and adds a tmux-based end-to-end smoke script + protocol docs while marking the Python relay as legacy.

^{Reviewed by Cursor Bugbot for commit 190a213. Bugbot is set up for automated code reviews on this repo. Configure here.}

socket-security · 2026-05-16T03:55:47Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Maintenance
	@types/uuid@11.0.0
	nx@22.6.5
	husky@9.1.7
	@types/mime-types@3.0.1
	jszip@3.10.1
	vscode-jsonrpc@8.2.1
	@types/js-yaml@4.0.9
	@types/bcrypt@6.0.0
	@types/jsonwebtoken@9.0.10
	@crosscopy/clipboard@0.2.8
	@types/pdf-parse@1.1.5
	@vitest/coverage-v8@4.1.6
	partial-json@0.1.7
	fflate@0.8.3
	js-yaml@4.1.1
	tsx@4.22.0
	exceljs@4.4.0
	mammoth@1.12.0
	concurrently@9.2.1
	jsonwebtoken@9.0.3
	clipboardy@4.0.0
	postgres@3.4.9
	@opentelemetry/auto-instrumentations-node@0.74.0
	@opentelemetry/sdk-node@0.216.0
	bcrypt@6.0.0
	glob@10.5.0 ⏵ 13.0.6	^-4	⁺³⁵
	tree-sitter-bash@0.25.1
	smol-toml@1.6.1
	jsonc-parser@3.3.1
	tree-sitter@0.25.0
	otplib@13.4.0
	jiti@2.7.0
	@opentelemetry/resources@2.7.1
See 19 more rows in the dashboard

View full report

socket-security · 2026-05-16T03:55:49Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `ioredis` is 96.0% likely obfuscated Confidence: 0.96 Location: Package overview From: package.json → `npm/ioredis@5.10.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ioredis@5.10.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 190a213ba6

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-05-16T04:00:48Z

+				relayPeer: peer.name,
+			},
+		}),
+		...(wait ? { configuration: { returnImmediately: true } } : {}),


Make non-wait sends non-blocking

The send path currently sets configuration.returnImmediately only when --wait is true, so calls without --wait omit the field and fall back to A2A's blocking default (returnImmediately: false/unset waits for terminal or interrupted task states). That reverses the CLI contract implied by maestro a2a send <peer> <text> [--wait] and can cause send to hang unexpectedly instead of returning a task id for later a2a wait polling. In the send handler, set returnImmediately: true for the non-wait path (or otherwise invert this condition) so default behavior is actually non-blocking.

Useful? React with 👍 / 👎.

chore: sync public mirror from internal

190a213

chatgpt-codex-connector Bot reviewed May 16, 2026

View reviewed changes

haasonsaas merged commit 1e379ab into main May 16, 2026
12 checks passed

haasonsaas deleted the sync/public-release-mirror branch May 16, 2026 04:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: sync public mirror from internal#415

chore: sync public mirror from internal#415
haasonsaas merged 1 commit into
mainfrom
sync/public-release-mirror

haasonsaas commented May 16, 2026

Uh oh!

cursor Bot commented May 16, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented May 16, 2026

Uh oh!

socket-security Bot commented May 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot May 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

haasonsaas commented May 16, 2026

Summary

Source-of-truth status

Public Mirror Drift Audit

Sample Changed Paths

Guidance

Drift sample

Public-only commits since last generated sync

Validation

Test Plan

Staged Rollout

Uh oh!

cursor Bot commented May 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

socket-security Bot commented May 16, 2026

Uh oh!

socket-security Bot commented May 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cursor Bot commented May 16, 2026 •

edited

Loading