@agentsdance/codejury 0.1.0 → 0.1.2

package/lib/config.js

@@ -147,8 +147,9 @@ export async function loadConfig(dir = process.cwd()) {
   };
 }
 
-/** The agent that owns the working tree and the commit. Never spawned. */
-export function mainAgent(cfg) {
+/** Select the agent that judges findings and owns the working tree. */
+export function judgeAgent(cfg, name) {
+  if (name) return cfg.agents.find((a) => a.name === name) ?? null;
   return cfg.main ?? null;
 }
 

package/lib/directories.js

@@ -0,0 +1,27 @@
+// One directory policy for every command. An explicit path wins; an empty path
+// or an unsuitable implicit cwd falls back to ~/.jury and creates it.
+import { mkdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+
+export function expandDirectory(value, { cwd = process.cwd(), home = homedir() } = {}) {
+  const raw = String(value ?? "").trim();
+  if (raw === "~") return home;
+  if (/^~[\\/]/.test(raw)) return path.join(home, raw.slice(2));
+  return path.resolve(cwd, raw);
+}
+
+export async function resolveJuryDirectory(
+  value,
+  { cwd = process.cwd(), home = homedir(), isUsable = async () => true } = {},
+) {
+  if (typeof value === "string" && value.trim()) {
+    return expandDirectory(value, { cwd, home });
+  }
+
+  if (value === undefined && await isUsable(cwd)) return path.resolve(cwd);
+
+  const fallback = path.join(home, ".jury");
+  await mkdir(fallback, { recursive: true });
+  return fallback;
+}

package/lib/findings.js

@@ -11,8 +11,12 @@ export const VERDICTS = ["accepted", "deferred", "rejected", "superseded"];
 /** Fold the log down to one record per finding id. */
 export async function findingsIn(dir) {
   const byId = new Map();
+  let judge = "claude"; // Backward compatibility for runs without judge metadata.
   for (const e of await readEvents(dir)) {
     switch (e.t) {
+      case "target":
+        judge = e.target?.judge ?? judge;
+        break;
       case "finding.raised":
         byId.set(e.id, {
           id: e.id, round: e.round, agent: e.agent, claim: e.claim,
@@ -56,7 +60,7 @@ export async function findingsIn(dir) {
           f.turns = (f.turns ?? 0) + 1;
           // Only a reviewer pushing back re-opens the argument; our own turn in
           // the thread is not a rebuttal against ourselves.
-          if (e.who && e.who !== "claude") f.contested = true;
+          if (e.who && e.who !== judge) f.contested = true;
         }
         break;
       }

package/lib/loop.js

@@ -23,6 +23,15 @@ import { appendEvent, writeArtifact } from "./store.js";
 // recorded rather than resolved by fiat.
 export const MAX_TURNS = 3;
 
+/** The judge in force at the end of a run, with a legacy-run fallback. */
+export function currentJudge(events) {
+  let judge = "claude";
+  for (const e of events) {
+    if (e.t === "target" && e.target?.judge) judge = e.target.judge;
+  }
+  return judge;
+}
+
 /**
  * One finding's state across the whole run, which is what decides whether the
  * loop may stop. `turns` counts round-trips on this specific claim, not rounds.
@@ -70,9 +79,13 @@ export function conversation(events) {
     return t;
   };
   const claims = new Map();
+  let judge = "claude"; // Runs created before --judge existed were Claude-led.
 
   for (const e of events) {
     switch (e.t) {
+      case "target":
+        judge = e.target?.judge ?? judge;
+        break;
       case "finding.raised":
         // Deliberately NOT a turn of its own. The reviewer already said this in
         // its report, verbatim and in its own shape; a parsed copy underneath
@@ -87,14 +100,14 @@ export function conversation(events) {
         break;
       case "finding.reproduced":
         thread(claims.get(e.id)?.agent ?? "?").turns.push({
-          who: "claude", kind: "reproduced", id: e.id,
+          who: e.who ?? judge, kind: "reproduced", id: e.id,
           claim: claims.get(e.id)?.claim ?? "",
           text: typeof e.evidence === "string" ? e.evidence : "reproduced", ts: e.ts,
         });
         break;
       case "finding.resolved":
         thread(claims.get(e.id)?.agent ?? "?").turns.push({
-          who: "claude", kind: "verdict", id: e.id,
+          who: e.who ?? judge, kind: "verdict", id: e.id,
           claim: claims.get(e.id)?.claim ?? "",
           verdict: e.verdict, text: e.reason ?? "", test: e.test ?? "", ts: e.ts,
         });
@@ -116,7 +129,7 @@ export function conversation(events) {
             who, kind: "rebuttal", id: e.id,
             claim: claims.get(e.id)?.claim ?? "", ts: e.ts,
           };
-          if (who === "claude") turn.text = e.text ?? "";
+          if (who === judge) turn.text = e.text ?? "";
           thread(claims.get(e.id)?.agent ?? e.agent ?? "?").turns.push(turn);
         }
         break;
@@ -179,7 +192,7 @@ export function conversation(events) {
         break;
       case "reply.sent":
         thread(e.agent).turns.push({
-          who: "claude", kind: "reply", text: e.text ?? "", resumed: e.resumed, ts: e.ts,
+          who: e.who ?? judge, kind: "reply", text: e.text ?? "", resumed: e.resumed, ts: e.ts,
         });
         break;
       case "reply.answered":
@@ -190,7 +203,7 @@ export function conversation(events) {
         break;
       case "commit.pushed":
         for (const t of threads.values()) {
-          t.turns.push({ who: "claude", kind: "commit", sha: e.sha, text: e.subject ?? "", ts: e.ts });
+          t.turns.push({ who: e.who ?? judge, kind: "commit", sha: e.sha, text: e.subject ?? "", ts: e.ts });
         }
         break;
     }
@@ -208,7 +221,7 @@ export function conversation(events) {
  * records the reproduction attempt *before* the verdict, so an "accepted" with
  * nothing behind it is refused by findings.gate rather than believed.
  */
-export async function triage(finding, { ask, dir, worktree, round }) {
+export async function triage(finding, { ask, dir, worktree, round, judge }) {
   const verdict = await ask({ kind: "triage", finding, worktree, round });
   // Order matters. gate() reads the folded log, so the reproduction has to be
   // on disk before the resolve is checked against it.
@@ -216,6 +229,7 @@ export async function triage(finding, { ask, dir, worktree, round }) {
     await appendEvent(dir, {
       t: "finding.reproduced", id: finding.id,
       evidence: verdict.reproduced, test: verdict.test ?? null,
+      ...(judge ? { who: judge } : {}),
     });
   }
   return verdict;
@@ -229,11 +243,11 @@ export async function triage(finding, { ask, dir, worktree, round }) {
  * open finding again, which the next round will re-raise. Crashing here would
  * throw away a whole round of reviewer time over one badly-formed answer.
  */
-export async function record(dir, findings, id, { verdict, reason, test }) {
+export async function record(dir, findings, id, { verdict, reason, test, who }) {
   const f = findings.get(id);
   const why = gate(f, { verdict, test });
   if (why) return { ok: false, why };
-  await appendEvent(dir, { t: "finding.resolved", id, verdict, reason: reason ?? "", test: test ?? null });
+  await appendEvent(dir, { t: "finding.resolved", id, verdict, reason: reason ?? "", test: test ?? null, ...(who ? { who } : {}) });
   return { ok: true };
 }
 
@@ -278,7 +292,7 @@ export async function refreshSettled(dir) {
  * not, and its rebuttal is recorded against the findings it concerns so the
  * turn counter can eventually end the argument.
  */
-export async function replyRound({ dir, pool, cfg, worktree, sha, round, findings, sessions, dryRun, onLog, onChunk }) {
+export async function replyRound({ dir, pool, cfg, worktree, sha, round, findings, sessions, dryRun, judge, onLog, onChunk }) {
   const names = pool.map((a) => a.name);
   const out = await Promise.all(pool.map(async (a) => {
     const thread = threadFor(a.name, findings);
@@ -298,7 +312,7 @@ export async function replyRound({ dir, pool, cfg, worktree, sha, round, finding
     // lands in that conversation rather than whichever ran most recently.
     const sessionId = sessions?.get(a.name) ?? null;
     const { argv, resumed } = replyArgv(a, { promptText: text, worktree, sha, sessionId });
-    await appendEvent(dir, { t: "reply.sent", agent: a.name, resumed, sessionId, text });
+    await appendEvent(dir, { t: "reply.sent", agent: a.name, resumed, sessionId, text, ...(judge ? { who: judge } : {}) });
 
     const r = await runAgent({ ...a, argv }, {
       worktree, prompt: text, stopToken: cfg.stopToken, dryRun,

package/lib/repository.js

@@ -5,8 +5,8 @@
 // PR's name. Keep this check independent of a hosting CLI so it also works for
 // self-hosted GitHub and GitLab instances.
 import { execFile } from "node:child_process";
-import { mkdtemp, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
 
@@ -89,6 +89,285 @@ function githubNumber(prUrl) {
   }
 }
 
+function mergeRequestNumber(prUrl) {
+  try {
+    const parts = new URL(prUrl).pathname.split("/").filter(Boolean);
+    const marker = parts.indexOf("merge_requests");
+    return marker >= 0 && /^\d+$/.test(parts[marker + 1] ?? "") ? parts[marker + 1] : null;
+  } catch {
+    return null;
+  }
+}
+
+function cloneUrlForMergeRequest(prUrl, repoPath) {
+  const url = new URL(prUrl);
+  url.pathname = `/${repoPath}.git`;
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+
+function branchAtHead(stdout, sha) {
+  const branches = String(stdout ?? "").split("\n").flatMap((line) => {
+    const [hash, ref] = line.trim().split(/\s+/, 2);
+    return hash === sha && ref?.startsWith("refs/heads/") ? [ref.slice(11)] : [];
+  });
+  return branches.length === 1 ? branches[0] : null;
+}
+
+class MergeRequestCheckoutError extends Error {}
+
+/**
+ * Fetch a merge request's head, falling back to numbered revision refs.
+ *
+ * Not every GitLab-compatible host publishes refs/merge-requests/<id>/head.
+ * Some expose the individual revisions instead, as
+ * refs/merge-requests/<id>/<id>/<revision>, where the highest revision is the
+ * current head. Returns the advertised sha when that fallback was used, so the
+ * caller can check the fetched commit against what the remote said: a request
+ * updated mid-fetch would otherwise be reviewed as though it were the head.
+ */
+async function fetchMergeRequestHead(exec, worktree, number) {
+  const options = { cwd: worktree };
+  try {
+    await exec("git", ["fetch", "origin", `refs/merge-requests/${number}/head`], options);
+    return null;
+  } catch (err) {
+    // Only a genuinely absent ref justifies looking elsewhere. An auth or
+    // transport failure keeps its own error, or every network problem would be
+    // reported as an unusual ref layout.
+    if (!/couldn't find remote ref/i.test(String(err.stderr ?? "") + String(err.message))) throw err;
+    const prefix = `refs/merge-requests/${number}/${number}/`;
+    const { stdout } = await exec("git", ["ls-remote", "--refs", "origin", `${prefix}*`], options);
+    const revisions = String(stdout).split("\n").flatMap((line) => {
+      const [sha, ref] = line.trim().split(/\s+/);
+      if (!/^[a-f\d]{40,64}$/i.test(sha ?? "") || !ref?.startsWith(prefix)) return [];
+      const revision = ref.slice(prefix.length);
+      // Numeric, so revision 10 sorts above revision 9 rather than beside 1.
+      return /^[1-9]\d*$/.test(revision) ? [{ sha, ref, revision: BigInt(revision) }] : [];
+    });
+    revisions.sort((a, b) => (a.revision > b.revision ? -1 : a.revision < b.revision ? 1 : 0));
+    if (!revisions.length) throw err; // no revisions either: the original error is the true one
+    const latest = revisions[0];
+    await exec("git", ["fetch", "--quiet", "origin", latest.ref], options);
+    return latest.sha;
+  }
+}
+
+/**
+ * Make origin/<trunk> resolvable in a clone taken from local disk. Best effort:
+ * offline the review may still fail, but it fails saying so rather than
+ * appearing to resolve and then diffing against a ref that is not there.
+ */
+async function ensureTrunkRef(worktree, trunk, { exec }) {
+  try {
+    await exec("git", ["rev-parse", "--verify", `refs/remotes/origin/${trunk}^{commit}`], { cwd: worktree });
+    return;
+  } catch { /* not present: try to bring it in */ }
+  try {
+    await exec("git", ["fetch", "--quiet", "origin",
+      `refs/heads/${trunk}:refs/remotes/origin/${trunk}`], { cwd: worktree });
+  } catch { /* offline: leave it, the review reports the real failure */ }
+}
+
+/**
+ * Whether a repository already contains a specific commit — and is the
+ * repository the request actually names. The identity check is not optional:
+ * an unrelated checkout holding the same commit would be reviewed under this
+ * request's name.
+ */
+async function hasCommit(dir, sha, { exec, target }) {
+  if (!dir || !sha || !await sameRepository(dir, target, { exec })) return false;
+  try {
+    await exec("git", ["-C", dir, "rev-parse", "--verify", `${sha}^{commit}`]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The commit a merge request points at, if this machine already has it.
+ *
+ * The head ref is the fragile part of resolving a merge request: GitLab prunes
+ * refs/merge-requests/<id>/head once a request is merged or old, so fetching it
+ * fails for requests that are otherwise perfectly reviewable. A repository that
+ * already contains the commits does not need that ref at all — and reviewing a
+ * branch you already have is the common case, not the exception.
+ *
+ * Read-only by construction: this resolves a revision and never checks anything
+ * out, because `jury <url>` run from master must not move the caller's tree.
+ */
+/**
+ * Whether a directory is a checkout of the repository the URL names.
+ *
+ * The URL names one repository; a local checkout of a DIFFERENT one that
+ * happens to hold the same ref or commit would review unrelated code under this
+ * request's name. Every local shortcut passes through here first.
+ */
+async function sameRepository(dir, target, { exec }) {
+  if (!dir || !target) return false;
+  try {
+    const { stdout } = await exec("git", ["-C", dir, "remote", "-v"]);
+    return String(stdout).split("\n").some((line) => {
+      const url = line.split(/\s+/)[1];
+      return url && repositoryFromRemote(url)?.display === target.display;
+    });
+  } catch {
+    return false; // not a repository, or no remotes: nothing to match against
+  }
+}
+
+async function localHead(dir, target, number, { exec, namespace, branch = null }) {
+  if (!dir || !await sameRepository(dir, target, { exec })) return null;
+
+  // Only the numbered ref. FETCH_HEAD was also consulted here, and it is not
+  // evidence of anything: it holds whatever the last fetch left behind, which
+  // after `git fetch origin main` is main. That resolved the wrong commit under
+  // this request's name, and — since branchAtHead then matched main on the
+  // remote — could make main the push target of a review that never examined it.
+  try {
+    const { stdout } = await exec(
+      "git", ["-C", dir, "rev-parse", "--verify", `${namespace}/${number}/head^{commit}`],
+    );
+    if (stdout.trim()) return stdout.trim();
+  } catch { /* an ordinary clone has no numbered ref; try the branch below */ }
+
+  // The numbered ref is the exception, not the rule: a normal clone or a
+  // source-branch checkout has none of them, only branches. Requiring it made
+  // this path unreachable for exactly the people the error told to "check out
+  // the source branch and pass --dir" — advice that could not work.
+  if (!branch) return null;
+  for (const rev of [`refs/remotes/origin/${branch}`, `refs/heads/${branch}`]) {
+    try {
+      const { stdout } = await exec("git", ["-C", dir, "rev-parse", "--verify", `${rev}^{commit}`]);
+      if (stdout.trim()) return stdout.trim();
+    } catch { /* try the next candidate */ }
+  }
+  return null;
+}
+
+async function resolveMergeRequestCheckout(prUrl, target, number, {
+  allowPush, exec, makeTemp, remove, dir, home = homedir(),
+}) {
+  // Where the clone lands when one is needed: the same ~/.jury the rest of the
+  // CLI already uses, rather than the system temp directory. The checkout is
+  // still removed when the review ends — this puts jury's working files under
+  // one predictable, inspectable root, and does not make them persist.
+  const worktree = await makeTemp(path.join(home, ".jury", "checkouts", `jury-mr-${number}-`));
+  let advertisedSha = null;
+  // Refresh the cached ref before trusting it. A ref fetched before the author
+  // pushed again names an obsolete head, and nothing about matching repository
+  // identity makes it current — a silent review of superseded code. When the
+  // refresh fails (offline, pruned) the cached ref is still better than nothing,
+  // which is the whole point of the local path.
+  if (dir && await sameRepository(dir, target, { exec })) {
+    try {
+      await exec("git", ["-C", dir, "fetch", "--quiet", "origin",
+        `refs/merge-requests/${number}/head:refs/merge-requests/${number}/head`, "--force"]);
+    } catch { /* keep whatever is cached */ }
+  }
+  const local = await localHead(dir, target, number, { exec, namespace: "refs/merge-requests" });
+  try {
+    if (local) {
+      // The commits are already here. Clone from disk rather than the network:
+      // no credentials, no head ref, and nothing the host may have pruned.
+      await exec("git", ["clone", "--quiet", "--no-checkout", dir, worktree]);
+      await exec("git", ["checkout", "--quiet", "-b", `jury-mr-${number}`, local], { cwd: worktree });
+      // Cloning from disk points origin at a filesystem path. Left alone, the
+      // branch lookup below would read the local clone and pushTarget would
+      // push into it — a review that never reaches the real remote. Repoint
+      // origin at the repository the URL actually names.
+      await exec("git", ["remote", "set-url", "origin",
+        cloneUrlForMergeRequest(prUrl, target.path)], { cwd: worktree });
+    } else {
+      await exec("git", ["clone", "--quiet", "--no-checkout", cloneUrlForMergeRequest(prUrl, target.path), worktree]);
+      advertisedSha = await fetchMergeRequestHead(exec, worktree, number);
+      await exec("git", ["checkout", "--quiet", "-b", `jury-mr-${number}`, "FETCH_HEAD"], { cwd: worktree });
+    }
+
+    const { stdout: actualOut } = await exec("git", ["rev-parse", "HEAD"], { cwd: worktree });
+    const sha = actualOut.trim();
+    if (advertisedSha && sha !== advertisedSha) {
+      throw new MergeRequestCheckoutError(
+        `merge request !${number} changed while it was being fetched; run the review again`,
+      );
+    }
+    // origin/HEAD comes from the clone SOURCE. Cloning the caller's repository
+    // copies whatever they had checked out, so a user sitting on the request's
+    // own source branch got that branch reported as trunk — and the review then
+    // diffed the branch against itself and saw nothing. Ask the real remote
+    // when the clone came from disk; fall back to the copied ref offline.
+    let trunk = "";
+    if (local) {
+      try {
+        const { stdout } = await exec("git", ["ls-remote", "--symref", "origin", "HEAD"], { cwd: worktree });
+        trunk = String(stdout).match(/^ref:\s+refs\/heads\/(\S+)\s+HEAD/m)?.[1] ?? "";
+      } catch { /* offline: fall through to the local ref */ }
+    }
+    if (!trunk && !local) {
+      // Only for a network clone, where origin/HEAD came from the host. In a
+      // clone taken from disk it was copied from whatever the caller had
+      // checked out — often this request's own source branch, which would make
+      // the review diff the branch against itself and report an empty change.
+      const { stdout: trunkOut } = await exec(
+        "git", ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"], { cwd: worktree },
+      );
+      trunk = trunkOut.trim().replace(/^origin\//, "");
+    }
+    // A network clone with no default branch is a broken repository, and saying
+    // so is right. A local clone that simply could not reach the host is not:
+    // the CLI applies its own --trunk after this returns, so failing here would
+    // refuse a run the user had already told where trunk is. Leave it empty and
+    // let that flag win; the CLI reports a missing trunk itself if there is none.
+    if (!trunk && !local) throw new MergeRequestCheckoutError(
+      `merge request !${number} repository has no default branch`,
+    );
+
+    // Only when a push target is actually needed. This ran unconditionally, so
+    // a --no-push review with every commit already on disk still failed the
+    // moment the network was unreachable — the one case the local path exists
+    // to serve.
+    let branch = null;
+    if (allowPush) {
+      const { stdout: headsOut } = await exec("git", ["ls-remote", "--heads", "origin"], { cwd: worktree });
+      branch = branchAtHead(headsOut, sha);
+    }
+    if (allowPush && !branch) {
+      throw new MergeRequestCheckoutError(
+        `resolved merge request !${number}, but its source branch is not uniquely available on origin — ` +
+        "use --no-push for a read-only review, or check out the source branch and pass --dir",
+      );
+    }
+
+    return {
+      worktree,
+      state: "OPEN",
+      trunk,
+      branch: branch ?? `merge-request/${number}`,
+      sha,
+      pushTarget: branch ? { remote: "origin", branch } : null,
+      cleanup: () => remove(worktree),
+    };
+  } catch (err) {
+    await remove(worktree);
+    if (err instanceof MergeRequestCheckoutError) throw err;
+    // git's own words, not a guess. --quiet used to hide them and only the
+    // first line survived, so a pruned head ref — the usual cause — was
+    // reported as a probable authentication problem. Whatever git said is the
+    // one thing that distinguishes the cases.
+    const said = [err.stderr, err.message].map((t) => String(t ?? "").trim()).find(Boolean) ?? "";
+    const missingRef = /couldn't find remote ref|no matching remote head/i.test(said);
+    throw new Error(
+      `could not resolve ${target.display} merge request !${number}: ${said.split("\n")[0]} — ` +
+      (missingRef
+        ? `${target.host} has no refs/merge-requests/${number}/head; hosts prune it once a request ` +
+          "is merged or old. Check out the source branch and pass --dir."
+        : "check Git authentication and refs/merge-requests support, or check out the source branch and pass --dir"),
+    );
+  }
+}
+
 function remoteForRepository(origin, repoPath) {
   const scp = String(origin).match(/^((?:[^@/\s]+@)?[^:/\s]+):(.+)$/);
   if (scp && !/^[a-z][a-z\d+.-]*:\/\//i.test(origin)) return `${scp[1]}:${repoPath}.git`;
@@ -100,7 +379,7 @@ function remoteForRepository(origin, repoPath) {
 }
 
 /**
- * Resolve a GitHub PR to an isolated checkout of its exact head.
+ * Resolve a GitHub PR or GitLab-style MR to an isolated checkout of its exact head.
  *
  * The checkout is a clone rather than a mutation of the caller's repository:
  * running `jury <url>` from master (or from an unrelated repo) must not switch
@@ -110,15 +389,31 @@ function remoteForRepository(origin, repoPath) {
 export async function resolvePrCheckout(prUrl, {
   allowPush = true,
   exec = run,
-  makeTemp = mkdtemp,
+  // Creates the parent too: a checkout under ~/.jury has a directory that may
+  // not exist yet, and a caller that injects this must not need the real one.
+  makeTemp = async (prefix) => {
+    await mkdir(path.dirname(prefix), { recursive: true });
+    return mkdtemp(prefix);
+  },
   remove = (dir) => rm(dir, { recursive: true, force: true }),
+  // The caller's checkout, when it has one. Consulted before the network: a
+  // repository that already holds the request's commits needs no head ref.
+  dir = null,
+  home = homedir(),
 } = {}) {
   const target = repositoryFromPrUrl(prUrl);
   const number = githubNumber(prUrl);
+  const mrNumber = mergeRequestNumber(prUrl);
+  if (target && mrNumber) {
+    return resolveMergeRequestCheckout(prUrl, target, mrNumber, {
+      allowPush, exec, makeTemp, remove, dir, home,
+    });
+  }
   if (!target || !number) {
     throw new Error(
       `cannot resolve the PR head from "${prUrl}" automatically — ` +
-      "run from its checked-out branch with --dir, or use a GitHub pull request URL",
+      "supported URL forms are GitHub /pull/<id> and GitLab-style /merge_requests/<id>; " +
+      "otherwise run from its checked-out branch with --dir",
     );
   }
 
@@ -147,11 +442,33 @@ export async function resolvePrCheckout(prUrl, {
     );
   }
 
-  const worktree = await makeTemp(path.join(tmpdir(), `jury-pr-${number}-`));
+  const worktree = await makeTemp(path.join(home, ".jury", "checkouts", `jury-pr-${number}-`));
+  // `gh` already gave the authoritative head oid, so that — not a cached ref —
+  // is what to look for locally. Consulting refs/pull/<id>/head first checked
+  // out whatever it pointed at when it was last fetched, which then failed the
+  // assertion below: a stale ref blocked a review whose real head was sitting
+  // in the same repository.
+  // `gh` gives both the oid and the branch name, so a plain checkout of the PR
+  // branch resolves here without any refs/pull ref existing.
+  const local = dir && await hasCommit(dir, details.headRefOid, { exec, target })
+    ? details.headRefOid
+    : await localHead(dir, target, number, {
+      exec, namespace: "refs/pull", branch: details.headRefName,
+    });
   try {
-    await exec("gh", ["repo", "clone", target.display, worktree, "--", "--quiet"]);
-    await exec("git", ["fetch", "--quiet", "origin", `refs/pull/${number}/head`], { cwd: worktree });
-    await exec("git", ["checkout", "--quiet", "-b", `jury-pr-${number}`, "FETCH_HEAD"], { cwd: worktree });
+    if (local) {
+      await exec("git", ["clone", "--quiet", "--no-checkout", dir, worktree]);
+      await exec("git", ["checkout", "--quiet", "-b", `jury-pr-${number}`, local], { cwd: worktree });
+      await exec("git", ["remote", "set-url", "origin", cloneUrlForMergeRequest(prUrl, target.path)],
+        { cwd: worktree });
+      // Same as the merge request path: a clone of a developer's checkout has
+      // their local branches, not origin/<base>, and every review prompt needs it.
+      await ensureTrunkRef(worktree, details.baseRefName, { exec });
+    } else {
+      await exec("gh", ["repo", "clone", target.display, worktree, "--", "--quiet"]);
+      await exec("git", ["fetch", "origin", `refs/pull/${number}/head`], { cwd: worktree });
+      await exec("git", ["checkout", "--quiet", "-b", `jury-pr-${number}`, "FETCH_HEAD"], { cwd: worktree });
+    }
 
     const { stdout: actual } = await exec("git", ["rev-parse", "HEAD"], { cwd: worktree });
     if (actual.trim() !== details.headRefOid) {

package/lib/store.js

@@ -183,6 +183,9 @@ export function foldEvents(events, seed = {}) {
   const lanes = new Map(); // agent -> lane, kept in launch order
   let t0 = null;
   let lastMin = 0;
+  // Events are replayed in order. Starting from the seed's latest judge would
+  // misattribute old Claude turns when a resumed run switches judges.
+  let judge = "claude";
 
   const laneFor = (agent) => {
     let lane = lanes.get(agent);
@@ -248,7 +251,7 @@ export function foldEvents(events, seed = {}) {
       case "reply.sent":
         for (const f of findings.values()) {
           if (f.with === e.agent && f.res !== "open") {
-            f.turns.push({ who: "claude", kind: "reply", resumed: e.resumed, at: min });
+            f.turns.push({ who: e.who ?? judge, kind: "reply", resumed: e.resumed, at: min });
           }
         }
         break;
@@ -268,6 +271,7 @@ export function foldEvents(events, seed = {}) {
       }
       case "target":
         run.target = { ...run.target, ...e.target };
+        judge = e.target?.judge ?? judge;
         break;
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsdance/codejury",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Independent AI reviewers that iterate until your pull request is clean.",
   "keywords": [
     "code-review",