@quickchatai/quickreview 1.1.0 → 1.3.1

package/src/onboard/steps/repoconfig.ts

@@ -0,0 +1,85 @@
+// The repository the home's setup checklist picks, written into config.toml:
+// the config fill's writer (configfill.ts) over the template or the
+// install's config, never touching dry_run.
+import { parse } from "smol-toml";
+import { assertNoDryRunEdit, changedEdits, patchToml, tomlString } from "./configfill.js";
+
+const message = (err: unknown): string => (err instanceof Error ? err.message : String(err));
+
+/** The repository pick, as the config takes it. */
+export interface RepoConfigChoice {
+  repo: string;
+  baseBranch: string | null;
+  timezone: string | null;
+  ownerName: string | null;
+  ownerLogin: string | null;
+}
+
+/** A config value as text, "" when absent or not a string. */
+function valueIn(doc: Record<string, unknown> | null, section: string, key: string): string {
+  const table = doc?.[section];
+  if (typeof table !== "object" || table === null) return "";
+  const v = (table as Record<string, unknown>)[key];
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The config text with the choice in it, from `existing` (null: none yet,
+ * so the template). What changed is named; a config that is not TOML is
+ * refused, since what it holds cannot be seen. */
+export function renderRepoConfig(
+  existing: string | null,
+  template: string,
+  choice: RepoConfigChoice,
+): { ok: true; text: string; wrote: string[] } | { ok: false; why: string } {
+  const fresh = existing === null;
+  const source = existing ?? template;
+  let doc: Record<string, unknown> | null = null;
+  try {
+    doc = parse(source);
+  } catch (err) {
+    return {
+      ok: false,
+      why: `${fresh ? "the shipped template" : "the config"} is not valid TOML (${message(err)}); nothing was written`,
+    };
+  }
+  const fill = (section: string, key: string): boolean =>
+    fresh || valueIn(doc, section, key) === "";
+  const wanted = [
+    { section: "github", key: "repo", value: tomlString(choice.repo) },
+    ...(choice.baseBranch
+      ? [{ section: "github", key: "base_branch", value: tomlString(choice.baseBranch) }]
+      : []),
+    ...(choice.timezone && fill("ops", "timezone")
+      ? [{ section: "ops", key: "timezone", value: tomlString(choice.timezone) }]
+      : []),
+    ...(choice.ownerName && fill("owner", "name")
+      ? [{ section: "owner", key: "name", value: tomlString(choice.ownerName) }]
+      : []),
+    ...(choice.ownerLogin && fill("owner", "github_login")
+      ? [{ section: "owner", key: "github_login", value: tomlString(choice.ownerLogin) }]
+      : []),
+  ];
+  assertNoDryRunEdit(wanted);
+  const edits = changedEdits(source, wanted);
+  const text = edits.length > 0 ? patchToml(source, edits) : source;
+  let after: Record<string, unknown>;
+  try {
+    after = parse(text);
+  } catch (err) {
+    return {
+      ok: false,
+      why: `the patched config would not parse (${message(err)}); nothing was written`,
+    };
+  }
+  if (valueIn(after, "github", "repo") !== choice.repo)
+    return {
+      ok: false,
+      why: "the patched config does not carry the repository; nothing was written",
+    };
+  if (fresh && after["dry_run"] !== true)
+    return {
+      ok: false,
+      why: "the shipped template no longer ships dry_run = true; nothing was written (invariant 6)",
+    };
+  return { ok: true, text, wrote: edits.map((e) => `[${e.section}] ${e.key}`) };
+}

package/src/onboard/steps/topology.ts

@@ -81,7 +81,7 @@ export interface TopologyOption {
 const TOPOLOGY_OPTION_METADATA = {
   vm: {
     headline:
-      "A VM or server over ssh — RECOMMENDED, because a reviewer that is asleep reviews nothing",
+      "A VM or server over ssh — RECOMMENDED when this computer sleeps (a laptop), because a reviewer that is asleep reviews nothing",
     tradeoffs: [
       "it is on 24/7: pull requests opened while you sleep, while your laptop is shut, or while you are on a plane still get reviewed",
       "you bring the box (any ssh-reachable Linux machine — a cheap cloud VM is plenty); the wizard does not create one for you",
@@ -91,12 +91,13 @@ const TOPOLOGY_OPTION_METADATA = {
     ],
   },
   local: {
-    headline: "This computer — everything in Docker on the machine you are sitting at",
+    headline:
+      "This computer — everything in Docker on the machine this wizard runs on; THE pick when it is itself an always-on server (a cloud VM you are logged into)",
     tradeoffs: [
-      "nothing else to own: `docker compose up` and the whole system is here — daemon, memory engine, tunnel",
-      "it reviews only while this machine is awake and the containers are running; close the lid and the reviewer stops",
-      "zero third-party signup on the default path: the quick tunnel needs no account, and the daemon re-points its own webhook URL when that hostname rotates",
-      "the honest way to try QuickReview, and a perfectly good permanent setup for one person on a desktop that stays on",
+      "nothing else to own: `docker compose up` and the whole system is here — daemon and memory engine, and the TUI reads them locally with no ssh",
+      "it reviews only while this machine is on and the containers are running: on a server that is always; on a laptop, close the lid and the reviewer stops",
+      "nothing to expose on the default path: the daemon polls GitHub for new pull requests every few minutes, with no webhook, tunnel or public URL",
+      "the honest way to try QuickReview, and a perfectly good permanent setup on a desktop that stays on or a cloud VM",
       "you can switch to a server later by re-running this step — the answers you gave (repo, App, keys) are kept",
     ],
   },

package/src/onboard/steps/transport.ts

@@ -37,6 +37,7 @@ import {
   composePs,
   containerStateCheck,
   daemonExecArgs,
+  daemonRootExecArgs,
   healthUrl,
   memoryOn,
   isUp,
@@ -87,6 +88,10 @@ export interface StackTransport {
   daemonState(): Promise<DaemonState>;
   /** Run an argv INSIDE the daemon container. */
   exec(argv: readonly string[]): Promise<ProcessResult>;
+  /** The same, as uid 0: the one way to write the root-sealed operator
+   * command directory (`commands/operator/`), as `qcr drain` and the TUI's
+   * levers do. Used for the operator's own commands only. */
+  execAsRoot(argv: readonly string[]): Promise<ProcessResult>;
   /** Run an argv INSIDE the container that owns the memory engine: the memory
    * sidecar on the compose stack, `[tui] memory_container` (else the daemon's
    * container) on the server route. */
@@ -155,6 +160,10 @@ function composeTransport(ctx: StepContext, opts: TransportOptions): StackTransp
       return ctx.adapters.runner.run("docker", daemonExecArgs(root, argv));
     },
 
+    async execAsRoot(argv) {
+      return ctx.adapters.runner.run("docker", daemonRootExecArgs(root, argv));
+    },
+
     async execMemory(argv) {
       return ctx.adapters.runner.run(
         "docker",
@@ -465,6 +474,12 @@ function sshTransport(ctx: StepContext, opts: TransportOptions): StackTransport
       return remote([...dockerPrefix, "exec", facts.container, ...argv]);
     },
 
+    async execAsRoot(argv) {
+      if (facts.alias === "")
+        return { code: 1, stdout: "", stderr: "no ssh alias recorded for the server route" };
+      return remote([...dockerPrefix, "exec", "-u", "0", facts.container, ...argv]);
+    },
+
     async execMemory(argv) {
       if (facts.alias === "")
         return { code: 1, stdout: "", stderr: "no ssh alias recorded for the server route" };

package/src/onboard/steps/tuiroute.ts

@@ -0,0 +1,119 @@
+// The TUI's own route, checked by the layered verification.
+//
+// The containers being up and the daemon answering /health prove the stack;
+// they do not prove that `qcr tui`, opened right after the wizard, can READ
+// it. The TUI reads status.json its own way — the [tui] block, resolved by
+// src/tui/route.ts, through `runnerFor` (local docker, or ssh to the VM) — so
+// this check runs exactly that: the same resolution, the same argv
+// (`statusArgv`), the same runner, and it needs a status.json that parses.
+// A red check here is the board that would open on "✖ unreachable".
+import { loadConfig, type TuiConfig } from "../../config.js";
+import { runnerFor, statusArgv, transportOf, type SshRunner } from "../../tui/remote.js";
+import { readRouteFacts, resolveTuiRoute, type RouteFacts } from "../../tui/route.js";
+import { sandboxRoot, type CheckResult, type StepContext } from "../engine.js";
+
+export const TUI_ROUTE_CHECK = "tui-route";
+
+export interface TuiRouteCheckOptions {
+  /** The runner for a resolved route; default `runnerFor` (spawns docker/ssh). */
+  runner?: (cfg: TuiConfig) => SshRunner;
+  /** Route facts that override what is read from the sandbox root. */
+  facts?: Partial<RouteFacts>;
+  /** Attempts while status.json is not written yet (a daemon just booted). */
+  attempts?: number;
+  intervalMs?: number;
+  sleep?: (ms: number) => Promise<void>;
+}
+
+function firstLine(text: string): string {
+  return (
+    text
+      .split("\n")
+      .map((l) => l.trim())
+      .find((l) => l !== "") ?? ""
+  );
+}
+
+/** Total: every outcome is a check, never a throw. */
+export async function tuiRouteCheck(
+  ctx: StepContext,
+  opts: TuiRouteCheckOptions = {},
+): Promise<CheckResult> {
+  if (ctx.adapters.host.inContainer) {
+    return {
+      name: TUI_ROUTE_CHECK,
+      ok: true,
+      detail:
+        "not checked here — this wizard runs inside the image, and the TUI runs on the host: open `qcr tui` there",
+    };
+  }
+  let tui: TuiConfig;
+  try {
+    tui = loadConfig(ctx.adapters.paths.configPath).tui;
+  } catch (err) {
+    return {
+      name: TUI_ROUTE_CHECK,
+      ok: false,
+      detail: `config.toml does not load, so the TUI could not start either: ${String(err instanceof Error ? err.message : err)}`,
+    };
+  }
+  const route = resolveTuiRoute(tui, {
+    ...readRouteFacts(sandboxRoot(ctx.adapters.paths)),
+    ...opts.facts,
+  });
+  if (route.unconfigured !== undefined)
+    return {
+      name: TUI_ROUTE_CHECK,
+      ok: false,
+      detail: `${route.unconfigured} — Fix: run the config_fill step again`,
+    };
+  const cfg = route.cfg;
+  const run = (opts.runner ?? runnerFor)(cfg);
+  const argv = statusArgv(cfg);
+  const where =
+    transportOf(cfg) === "local"
+      ? `local docker, container ${cfg.container}`
+      : `ssh ${cfg.ssh_host}`;
+  const attempts = Math.max(1, opts.attempts ?? 4);
+  const sleep = opts.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));
+  let last = "";
+  for (let i = 1; i <= attempts; i++) {
+    let res;
+    try {
+      res = await run(cfg.ssh_host, argv, { timeoutMs: 15_000 });
+    } catch (err) {
+      res = { ok: false, stdout: "", stderr: String(err), code: null };
+    }
+    if (res.ok) {
+      try {
+        const parsed = JSON.parse(res.stdout) as unknown;
+        if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+          const prs = (parsed as { prs?: unknown }).prs;
+          return {
+            name: TUI_ROUTE_CHECK,
+            ok: true,
+            detail:
+              `the TUI's own read works (${where}: \`${argv.join(" ")}\`) — status.json parses` +
+              `${Array.isArray(prs) ? `, ${prs.length} PR${prs.length === 1 ? "" : "s"} on the board` : ""}`,
+          };
+        }
+        last = "status.json is not a JSON object";
+      } catch {
+        last = "status.json is not valid JSON";
+      }
+    } else {
+      last = firstLine(res.stderr) || `exit ${String(res.code)}`;
+    }
+    if (i < attempts) await sleep(opts.intervalMs ?? 5_000);
+  }
+  return {
+    name: TUI_ROUTE_CHECK,
+    ok: false,
+    detail:
+      `the TUI could not read status.json the way it will (${where}: \`${argv.join(" ")}\`): ${last} — Fix: ` +
+      (transportOf(cfg) === "local"
+        ? "the [tui] container must be the running daemon container and remote_state_dir its state dir " +
+          "(run the config_fill step again to rewrite both)"
+        : `\`ssh ${cfg.ssh_host} true\` must work without a prompt, and remote_state_dir must be the VM's state dir`),
+  };
+}

package/src/onboard/steps/verifyup.ts

@@ -34,7 +34,7 @@
 // server, a curl on the box). Layer 3 needs no transport at all: it reads
 // GitHub's OWN delivery log, which is the same record wherever the daemon
 // runs, and that is exactly why it is the layer that proves the path.
-import { CHOICE_KEYS } from "../choices.js";
+import { CHOICE_KEYS, userAuthRecorded } from "../choices.js";
 import { mintAppJwt } from "@quickchatai/pi-quickreview/src/githubAuth.js";
 import type { CheckResult, OnboardingStep, StepContext, StepReport } from "../engine.js";
 import { ingressOptionOf, secretsDirFor, readConfigText } from "./compose.js";
@@ -42,6 +42,7 @@ import { api as githubApi, readCredentials } from "./githubapp.js";
 import { readTomlKey, WEBHOOK_PATH } from "./ingress.js";
 import { sshCommandLine } from "./ssh.js";
 import { sshAliasOf, topologyOf } from "./topology.js";
+import { tuiRouteCheck, type TuiRouteCheckOptions } from "./tuiroute.js";
 import {
   DEFAULT_HEALTH_TIMEOUT_MS,
   stackTransportFor,
@@ -67,6 +68,8 @@ export interface VerifyStackStepOptions {
    * WHICH transport is never an option: `stackTransportFor` decides from the
    * recorded topology, and this step never learns which one it got. */
   transport?: TransportOptions;
+  /** The TUI-route check's seams (tuiroute.ts): its runner and route facts. */
+  tuiRoute?: TuiRouteCheckOptions;
 }
 
 // ---- GitHub's delivery log ---------------------------------------------------
@@ -415,6 +418,22 @@ export function verifyStackStep(opts: VerifyStackStepOptions = {}): OnboardingSt
       });
       return { ok: false, checks };
     }
+    // The operator's own window onto the stack: can `qcr tui` read it the way
+    // it will? Independent of webhook delivery, so it never stops layer 3.
+    checks.push(await tuiRouteCheck(ctx, opts.tuiRoute));
+    // Layer 3 reads the App's own hook config and delivery log — App-JWT
+    // calls. The own-account route has no App, so there is no hook to read
+    // and nothing to deliver: the layer is skipped, and the reason said.
+    if (userAuthRecorded(ctx.choices)) {
+      checks.push({
+        name: "ping-delivery",
+        ok: true,
+        detail:
+          'not checked — this install runs on your own GitHub account ([github] auth = "user"), which has no GitHub App, ' +
+          "so there is no webhook and no App delivery log to read; the reconcile poll is the only trigger path",
+      });
+      return { ok: checks.every((c) => c.ok), checks };
+    }
     // Layer 3 exists only where GitHub can deliver. The polling topology
     // deliberately exposes nothing, so a ping can never land there — requiring
     // one would keep this step (and so onboarding's finish) red forever.

package/src/onboard/toolnames.ts

@@ -0,0 +1,34 @@
+// The onboarding session's tool names: one source for the extension that
+// registers them (extensions/onboarding.ts) and the `--tools` allowlist that
+// activates them (`onboardingToolAllowlist`).
+//
+// pi's `--tools <list>` is an allowlist over EVERY tool, extension tools
+// included (pi 1.4.0: createAgentSession({ tools }) leaves an extension tool
+// that is not on the list inactive). So the argv must name each wizard tool,
+// or the guide runs with no tools at all. The built-in belt stays read-only:
+// bash, write and edit are never on the list.
+
+/** pi's built-in tools the wizard may use: reading only. */
+export const ONBOARD_BUILTIN_TOOLS: readonly string[] = ["read", "ls", "grep"];
+
+/** The checklist tool. */
+export const ONBOARD_STATUS_TOOL = "onboard_status";
+/** The verify-everything-and-exit tool. */
+export const ONBOARD_FINISH_TOOL = "finish_and_exit";
+
+/** A step's tool name. */
+export function onboardStepToolName(stepId: string): string {
+  return `onboard_${stepId}`;
+}
+
+/** Every tool the onboarding extension registers over these step ids, in
+ * registration order. */
+export function onboardingExtensionToolNames(stepIds: readonly string[]): string[] {
+  return [...stepIds.map(onboardStepToolName), ONBOARD_STATUS_TOOL, ONBOARD_FINISH_TOOL];
+}
+
+/** The whole `--tools` allowlist for the onboarding pi: the read-only belt,
+ * then every wizard tool. */
+export function onboardingToolAllowlist(stepIds: readonly string[]): string[] {
+  return [...ONBOARD_BUILTIN_TOOLS, ...onboardingExtensionToolNames(stepIds)];
+}

package/src/operatorwrite.ts

@@ -0,0 +1,25 @@
+// The one in-container shell that writes an operator command file as root
+// into the root-sealed `<commands>/operator/` — its full rationale is on
+// `operatorCommandWriteScript` in src/tui/unwedge.ts, the TUI's caller. A
+// leaf module (no imports) so the onboarding wizard's proof round, which knows
+// the release image's command root rather than a TUI config, uses the same
+// script without reaching the TUI's module graph.
+
+/** `operatorCommandWriteScript` for a known command root (`<root>/commands`
+ * inside the container) — the onboarding wizard's caller, which knows the
+ * release image's layout rather than a TUI config. */
+export function operatorCommandWriteScriptAt(root: string, name: string): string {
+  const dir = `${root}/operator`;
+  const tmp = `.${name}.tmp`;
+  return (
+    `[ -d '${root}' ] || { echo 'daemon commands dir ${root} missing - is the daemon running?' >&2; exit 1; }; ` +
+    `mkdir -p '${dir}' || exit 1; ` +
+    `[ ! -L '${dir}' ] || { echo '${dir} is a symlink - refusing to write the operator command' >&2; exit 1; }; ` +
+    `R=$(cd -P '${root}' && pwd -P) || exit 1; ` +
+    `cd -P '${dir}' || exit 1; ` +
+    `[ "$(pwd -P)" = "$R/operator" ] || { echo '${dir} was replaced while writing - refusing to write the operator command' >&2; exit 1; }; ` +
+    `chown -h 0:0 . && chmod 0755 . || exit 1; ` +
+    `find . -maxdepth 1 -name '*.json' -mmin +1440 -delete 2>/dev/null; ` +
+    `rm -f '${tmp}' '${name}' && cat > '${tmp}' && chmod 0644 '${tmp}' && mv '${tmp}' '${name}'`
+  );
+}

package/src/outcomes.ts

@@ -97,6 +97,7 @@ import { prActivity, type PrActivity } from "./pr-activity.js";
 // read-only and memoised; a commit the clone does not hold is UNKNOWN, never a
 // change and never no-change. Every failure is the sweep's own — reconcile's
 // health (which lifts a deploy drain) never waits on it.
+import { carriesOwnMarker } from "@quickchatai/pi-quickreview/src/identity.js";
 import {
   carriedToRef,
   isPostedRow,
@@ -519,6 +520,10 @@ export interface OutcomeCaptureDeps {
   store: StateStore;
   /** `[github] bot_login` — whose root comments are findings. */
   botLogin: string;
+  /** `[github] auth = "user"`: the login is the person's, so a root comment is
+   * a finding only when it carries the reviewer's marker, and the person's
+   * own replies are a human's. */
+  personMode?: boolean;
   /** Absent ⇒ every "did the code change" question is unknown. */
   git?: AnchorGit;
   now?: () => Date;
@@ -585,6 +590,7 @@ export class OutcomeCapture {
     this.store.db.transaction(() => {
       for (const c of comments) {
         if (c.user !== this.deps.botLogin || c.in_reply_to_id !== null) continue;
+        if (this.deps.personMode && !carriesOwnMarker(c.body)) continue;
         const marker = parseFindingMarker(c.body);
         const head = commentHead(c.body);
         const info = stmt.run({
@@ -823,7 +829,8 @@ export class OutcomeCapture {
     const replies = new Map<number, PrCommentRow[]>();
     for (const c of this.store.prComments(pr)) {
       if (c.source !== "review_comment" || c.in_reply_to_id === null) continue;
-      if (c.author === this.deps.botLogin) continue;
+      if (c.author === this.deps.botLogin && (!this.deps.personMode || carriesOwnMarker(c.body)))
+        continue;
       replies.set(c.in_reply_to_id, [...(replies.get(c.in_reply_to_id) ?? []), c]);
     }
     const events = this.store.prEvents(pr, [

package/src/piagentdir.ts

@@ -0,0 +1,12 @@
+// pi's agent dir, the way pi itself finds it: a leaf, so the npm verbs
+// (src/npmverbs.ts) and the home's login reader (src/home/adapters.ts) read
+// one rule without importing each other.
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+/** pi's agent dir: `$PI_CODING_AGENT_DIR`, else `~/.pi/agent`, as pi reads it. */
+export function piAgentDir(env: Readonly<Record<string, string | undefined>>): string {
+  const set = (env["PI_CODING_AGENT_DIR"] ?? "").trim();
+  if (set !== "") return set;
+  return join((env["HOME"] ?? "").trim() || homedir(), ".pi", "agent");
+}

package/src/pilogin.ts

@@ -4,15 +4,24 @@
 // (src/scanbox.ts) share it without one reaching the other.
 
 /** pi itself, with `/login` (or `/login <provider>`) typed and sent for the
- * user: pi runs in a fresh tmux session; once its input box is drawn (two
- * editor borders on screen) the keys go in, and again every 0.3 s until pi's
- * login menu shows — an Enter sent while pi still starts is lost, and a
- * `/login` left in the editor then only needs the Enter. After 30 s the
- * terminal attaches regardless, so every login pi offers is there and
- * quitting pi ends it. `pi` is the pi to start: the companion image's CLI on
- * its PATH by default; the release image's entrypoint passes its one pi,
- * node_modules/.bin/pi (src/picli.ts `piCliIn`), and `qcr login` the pinned
- * package's own bin (src/picli.ts `piCliPath`). */
+ * user: pi runs in a fresh tmux session, and qcr reads pi's input box, the
+ * lines between the last two editor borders on screen, every 0.3 s (a second
+ * after a key, which counts as three polls toward the 30 s). Empty, it gets the keys and an Enter; still holding exactly
+ * the keys, one more Enter (an Enter sent while pi still starts is lost, and
+ * the first one may only accept the autocomplete). Anything else in the box is
+ * one of pi's menus (the provider list, a provider's own login methods), and
+ * no key goes in again. pi draws every selection in that box, so this holds
+ * whatever title pi or a provider gives the menu, where an Enter would pick
+ * its default: a browser login, opened again on every poll. pi starts with
+ * `--no-approve`: a login needs nothing from the folder qcr was run in, so a
+ * project folder neither stops it at pi's trust prompt nor gets trusted. A pi
+ * that has already exited ends the wait at once. After 30 s the terminal
+ * attaches regardless, so every login pi offers is there and quitting pi ends
+ * it; a failed attach (no terminal) ends the session instead of leaving pi
+ * running where nobody can reach it. `pi` is the pi to start: the
+ * companion image's CLI on its PATH by default; the release image's entrypoint
+ * passes its one pi, node_modules/.bin/pi (src/picli.ts `piCliIn`), and
+ * `qcr login` the pinned package's own bin (src/picli.ts `piCliPath`). */
 export function loginInPi(provider?: string, pi: string = "pi"): string[] {
   if (provider !== undefined && !/^[A-Za-z0-9._-]+$/.test(provider))
     throw new Error(
@@ -22,16 +31,23 @@ export function loginInPi(provider?: string, pi: string = "pi"): string[] {
   if (!/^[A-Za-z0-9._/@+-]+$/.test(pi))
     throw new Error(`scan login: pi ${JSON.stringify(pi)} is not a plain path`);
   const keys = provider ? `/login ${provider}` : "/login";
+  // The input box, its side padding (pi's editorPaddingX) trimmed and blank
+  // lines dropped; awk fails while fewer than two borders are drawn (pi still
+  // starting), and the loop then only waits.
+  const box =
+    `tmux capture-pane -p -t "$s" 2>/dev/null | awk '/──────────/ { b[++n] = NR } { l[NR] = $0 } ` +
+    `END { if (n < 2) exit 1; for (i = b[n - 1] + 1; i < b[n]; i++) ` +
+    `{ sub(/^ +/, "", l[i]); sub(/ +$/, "", l[i]); if (l[i] != "") print l[i] } }'`;
   return [
     "sh",
     "-c",
-    `s=qcr-login-$$; tmux new-session -d -s "$s" ${pi} || exit 1; i=0; ` +
-      `while [ $i -lt 100 ]; do p=$(tmux capture-pane -p -t "$s"); ` +
-      `case "$p" in *"Select authentication"*|*"Select provider"*) break;; esac; ` +
-      `if [ "$(printf '%s\\n' "$p" | grep -cF '──────────')" -ge 2 ]; then ` +
-      `if printf '%s\\n' "$p" | grep -qxF '${keys}'; then tmux send-keys -t "$s" Enter; ` +
-      `else tmux send-keys -t "$s" -l '${keys}'; tmux send-keys -t "$s" Enter; fi; fi; ` +
+    `s=qcr-login-$$; tmux new-session -d -s "$s" ${pi} --no-approve || exit 1; i=0; ` +
+      `while [ $i -lt 100 ]; do tmux has-session -t "$s" 2>/dev/null || break; ` +
+      `if e=$(${box}); then ` +
+      `if [ -z "$e" ]; then tmux send-keys -t "$s" -l '${keys}'; tmux send-keys -t "$s" Enter; sleep 1; i=$((i+3)); ` +
+      `elif [ "$e" = '${keys}' ]; then tmux send-keys -t "$s" Enter; sleep 1; i=$((i+3)); ` +
+      `else break; fi; fi; ` +
       `sleep 0.3; i=$((i+1)); done; ` +
-      `exec tmux attach -t "$s"`,
+      `tmux attach -t "$s" || { tmux kill-session -t "$s" 2>/dev/null; exit 1; }`,
   ];
 }

package/src/posting-journal.ts

@@ -106,6 +106,10 @@ export interface JournalOptions {
   /** `<state>/posting-receipts`, the dir the verdict watcher and the outbox read. */
   dir: string;
   repo: string;
+  /** `[github] auth = "user"`: every receipt says `person_mode`, the posting
+   * guard posts every event as a COMMENT, and an APPROVE posted as a COMMENT
+   * is NOT the withheld-approval shape (posting-receipt.ts). */
+  personMode?: boolean;
   now?: () => Date;
 }
 
@@ -357,7 +361,7 @@ export class PostingJournal {
         // An APPROVE that GitHub holds as a COMMENT was softened by guard 4 on
         // the gate after the CI preflight: the withheld-approval shape, which
         // the outbox's confirmation stamps the same way.
-        ...(o.intended === "APPROVE" && actual === "COMMENT"
+        ...(o.intended === "APPROVE" && actual === "COMMENT" && !this.o.personMode
           ? { delivered_by: "daemon_retry" as const }
           : {}),
       }),
@@ -519,6 +523,7 @@ export class PostingJournal {
       actual_event: actual,
       payload_sha256: payloadHash(payload),
       prepared_at: base.prepared_at ?? this.iso(),
+      ...(this.o.personMode ? { person_mode: true } : {}),
       ...extra,
     };
   }

package/src/posting-outbox.ts

@@ -285,6 +285,10 @@ export class PostingOutbox {
       repo: string;
       dryRun: boolean;
       botLogins: string[];
+      /** `[github] auth = "user"`: receipts say `person_mode`, and an APPROVE
+       * delivered as a COMMENT is the person-mode rule, not a guard-4
+       * softening (posting-receipt.ts). */
+      personMode?: boolean;
       adapter: PostingDeliveryAdapter;
       current: (job: PostingJob) => boolean;
       now?: () => Date;
@@ -432,10 +436,13 @@ export class PostingOutbox {
       gh_state: state,
       // An APPROVE that GitHub holds as a COMMENT was softened by guard 4 on
       // the gate, which only the daemon's delivery passes through (the shell
-      // route refuses a red-CI approval): the withheld-approval shape.
-      ...(deliveredBy || (j.intended_event === "APPROVE" && event === "COMMENT")
+      // route refuses a red-CI approval): the withheld-approval shape. Not in
+      // person mode, where every review is a COMMENT by rule.
+      ...(deliveredBy ||
+      (j.intended_event === "APPROVE" && event === "COMMENT" && !this.deps.personMode)
         ? { delivered_by: "daemon_retry" as const }
         : {}),
+      ...(this.deps.personMode ? { person_mode: true as const } : {}),
     } satisfies PostingReceipt);
     j.status = "done";
     writePostingFile(path, j);
@@ -762,6 +769,7 @@ export class PostingOutbox {
         status: "prepared",
         payload_sha256: j.payload_sha256,
         prepared_at: j.attempted_at,
+        ...(this.deps.personMode ? { person_mode: true as const } : {}),
       } satisfies PostingReceipt);
       try {
         const result = await this.deps.adapter.createReview(j.pr, j.payload);

package/src/posting-receipt.ts

@@ -52,6 +52,11 @@ export interface PostingReceipt {
    * (APPROVE posted as a COMMENT, approval withheld for red CI) is something
    * the verdict file cannot know: see `retrySoftenedApproval`. */
   delivered_by?: "daemon_retry";
+  /** Written by a person-mode install (`[github] auth = "user"`): the posting
+   * guard posts EVERY review as a COMMENT there, so `actual_event` COMMENT
+   * proves nothing about the decision — `intended_event` carries it, and an
+   * APPROVE posted as a COMMENT is not a withheld approval. */
+  person_mode?: true;
   /** In memory only, never written by the posting scripts: the
    * daemon SYNTHESISED this receipt from a bot review carrying the round's
    * marker, because the shell never persisted its own. `intended_event` is
@@ -209,6 +214,7 @@ export function parsePostingReceipt(raw: string): PostingOutcome | undefined {
         value.status !== "deferred") ||
       (value.status === "deferred" && !isoDate(value.deferred_at)) ||
       (value.delivered_by !== undefined && value.delivered_by !== "daemon_retry") ||
+      (value.person_mode !== undefined && value.person_mode !== true) ||
       typeof value.payload_sha256 !== "string" ||
       !/^[a-f0-9]{64}$/.test(value.payload_sha256) ||
       !isoDate(value.prepared_at)
@@ -245,6 +251,7 @@ export function parsePostingReceipt(raw: string): PostingOutcome | undefined {
  * the receipt is the evidence that the approval was withheld. */
 export function retrySoftenedApproval(receipt: PostingReceipt): boolean {
   return (
+    receipt.person_mode !== true &&
     receipt.delivered_by === "daemon_retry" &&
     receipt.status === "confirmed" &&
     receipt.intended_event === "APPROVE" &&
@@ -259,6 +266,16 @@ export function receiptMatchesVerdict(receipt: PostingReceipt, verdict: VerdictF
     receipt.head_sha.toLowerCase() !== verdict.head_sha.toLowerCase()
   )
     return false;
+  // Person mode posts every review as a COMMENT. A receipt synthesised from
+  // GitHub knows nothing more than that; any other one is matched on what
+  // the session asked for, as if it had been posted as asked.
+  if (receipt.person_mode === true && receipt.actual_event === "COMMENT") {
+    if (receipt.reconciled === true) return true;
+    const asAsked: PostingReceipt = { ...receipt, actual_event: receipt.intended_event };
+    delete asAsked.person_mode;
+    delete asAsked.delivered_by;
+    return receiptMatchesVerdict(asAsked, verdict);
+  }
   if (verdict.verdict === "REQUEST_CHANGES")
     return receipt.actual_event === "REQUEST_CHANGES" || receipt.actual_event === "COMMENT";
   if (verdict.verdict === "APPROVE" && retrySoftenedApproval(receipt)) return true;