chore: sync public mirror from internal

[haasonsaas]

Summary

• sync the sanitized public tree from evalops/maestro-internal
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: 2733dded090cfac485c6ac5048dc7184dc400d1c
• last generated public sync base: 4ca1799fd53c8aa96219607635a02287c8eb3404
• previewed public-tree drift: 14 file(s) to copy/update and 0 stale file(s) to delete
• public-only commits since last generated sync: 0

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/maestro
• private source: https://github.com/evalops/maestro-internal@main (2733dded090c)
• public projection: https://github.com/evalops/maestro@main (4ca1799fd53c)
• files to copy or update: 14
• stale files to delete: 0
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update src/agent/agent-resume.ts
• copy/update src/cli-tui/commands/undo-handlers.ts
• copy/update src/tools/diff-preview.ts
• copy/update src/undo/tracker.ts
• copy/update src/utils/url-extractor-git.ts
• copy/update src/utils/url-extractor.ts
• copy/update test/agent/agent-resume.test.ts
• copy/update test/agent/session-checkpoint.test.ts
• copy/update test/agent/smart-model-router.test.ts
• copy/update test/context/repo-map.test.ts
• copy/update test/oauth/command-key.test.ts
• copy/update test/platform/a2a-work-graph.test.ts
• copy/update test/tools/diff-preview.test.ts
• copy/update test/undo/tracker.test.ts

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update src/agent/agent-resume.ts
• copy/update src/cli-tui/commands/undo-handlers.ts
• copy/update src/tools/diff-preview.ts
• copy/update src/undo/tracker.ts
• copy/update src/utils/url-extractor-git.ts
• copy/update src/utils/url-extractor.ts
• copy/update test/agent/agent-resume.test.ts
• copy/update test/agent/session-checkpoint.test.ts
• copy/update test/agent/smart-model-router.test.ts
• copy/update test/context/repo-map.test.ts
• copy/update test/oauth/command-key.test.ts
• copy/update test/platform/a2a-work-graph.test.ts
• copy/update test/tools/diff-preview.test.ts
• copy/update test/undo/tracker.test.ts

Public-only commits since last generated sync

• none detected since last generated sync

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr check confirms internal source PR lineage
• CI, integration, rust-hosted-conformance, coverage, Socket, and Cursor checks must pass before merge
• Do not merge until Cursor Bugbot review completes — Bugbot catches bugs that CI guardrails may not cover yet. If Bugbot finds issues, address them on this branch before merging.

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/maestro-internal@2733dded090cfac485c6ac5048dc7184dc400d1c, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

Supersedes

• updates existing generated public sync PR chore: sync public mirror from internal #797 to internal source 2733dded090cfac485c6ac5048dc7184dc400d1c

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cursor]

PR Summary

Medium Risk
Touches security-adjacent shell/git URL parsing (refactor only) and file-edit diff application; changes are covered by new tests but affect undo and network policy paths.

Overview
Syncs bug fixes, a small TUI feature, a refactor, and broad test coverage from the internal tree.

FileTranscriptStore.list() now loads matching transcripts, sorts by updatedAt descending, then applies limit. It no longer stops early while scanning the directory, so limits reflect recency instead of arbitrary readdir order.

Undo checkpoints: ChangeTracker.deleteCheckpoint() removes a named checkpoint, /checkpoint delete is wired in the TUI (replacing the “not yet implemented” stub), and help documents the command.

Diff preview: applyHunks skips leading context when computing the splice index so partial hunk application lands on the first removal, not on context lines.

Shell URL extraction: Git-specific parsing moves into new url-extractor-git.ts; url-extractor.ts imports it (one-way dependency, same behavior, smaller main module).

Tests: New Vitest suites for agent resume, session checkpoints, smart model router, repo map, OAuth command keys, A2A work graph metadata, and diff preview; tracker tests cover checkpoint deletion.

^{Reviewed by Cursor Bugbot for commit b5e349c. Bugbot is set up for automated code reviews on this repo. Configure here.}