@saadnvd1/agent-os 0.3.468 → 0.3.471

package/lib/orchestrator/write-guard.ts

@@ -0,0 +1,295 @@
+/**
+ * Where an orchestrator may write. Anywhere on the machine except the
+ * workspace's project repositories and their task worktrees (code changes go
+ * through tasks, so the merge gates keep meaning something), AgentOS's own
+ * install and state (all of ~/.agent-os but its own folder), secret files,
+ * and files that make something run: the dotfiles and dot-folders in its
+ * home (shell, git, Claude and tool config), ~/Library, the folders on PATH,
+ * and any .git, .claude, .mcp.json, CLAUDE.md or the like. A write to one of
+ * those would hand it a shell, or run code in AgentOS's own git, without
+ * touching a protected path itself. Its chat worker checks every Write, Edit and NotebookEdit here
+ * before it runs (a PreToolUse hook), on the path with every symlink and
+ * `..` resolved the way the system will resolve it.
+ */
+
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { db, type Session } from "../db";
+import { git, GitError } from "../git-exec";
+import { isSecretPath } from "../secret-paths";
+import { WORKTREES_DIR } from "../worktrees";
+import { orchestratorDir } from "./home";
+import { LIMITS_FILE } from "./usage";
+
+// The tools that write a file, and the argument naming it.
+export const WRITE_TOOLS: Record<string, string> = {
+  Write: "file_path",
+  Edit: "file_path",
+  MultiEdit: "file_path",
+  NotebookEdit: "notebook_path",
+};
+
+export interface WriteBounds {
+  // Relative paths are taken from here.
+  cwd: string;
+  // Its own folder, the one part of `state` it may write.
+  ownDir: string;
+  // AgentOS's state (~/.agent-os).
+  state: string;
+  // Project repositories, task worktrees and AgentOS's install.
+  repos: string[];
+  // Its home: no dotfile or dot-folder in it may be written.
+  home: string;
+  // Folders whose files run (~/Library, PATH, the usage brake's input...).
+  runs: string[];
+}
+
+// Wherever they are, files that configure what an agent, git or a
+// language runtime runs.
+const RUNS_CODE =
+  /(^|\/)(\.git|\.claude|\.codex|\.cursor|\.vscode|\.husky|\.githooks)(\/|$)|(^|\/)(\.mcp\.json|\.claude\.json|CLAUDE(\.local)?\.md|AGENTS\.md|\.envrc|\.gitconfig|\.gitattributes|\.gitmodules|sitecustomize\.py|usercustomize\.py)$|\.pth$/i;
+
+// The temporary checkouts AgentOS reviews, rebases and writes PR bodies in
+// (repo.ts, rebase.ts): an edit while a review runs would change what it
+// judges.
+const AGENTOS_TEMP = /(^|\/)aos-(review|rebase|body)-[^/]+(\/|$)/;
+
+const MAX_LINKS = 40;
+
+// The path as the system resolves it: component by component from the root,
+// each symlink followed where it sits (a dangling one too, since a write
+// creates its target), and `..` taken from the real folder it's in. Parts
+// that don't exist yet are kept as named, under the real folder they'd be
+// made in.
+export async function physicalPath(p: string): Promise<string> {
+  const parts = p.split("/").filter(Boolean);
+  let at = "/";
+  let links = 0;
+  while (parts.length) {
+    const part = parts.shift()!;
+    if (part === ".") continue;
+    if (part === "..") {
+      at = path.dirname(at);
+      continue;
+    }
+    const next = path.join(at, part);
+    const link = await fs.promises.readlink(next).catch(() => null);
+    if (link === null) {
+      at = next;
+      continue;
+    }
+    if (++links > MAX_LINKS) throw new Error("Too many symlinks");
+    parts.unshift(...link.split("/").filter(Boolean));
+    if (link.startsWith("/")) at = "/";
+  }
+  return canonical(at);
+}
+
+// Its deepest existing folder as the file system spells it, so a path in
+// another case or Unicode form (one folder on macOS) compares equal.
+async function canonical(p: string): Promise<string> {
+  const rest: string[] = [];
+  let at = p;
+  for (;;) {
+    try {
+      return path.join(await fs.promises.realpath(at), ...rest.reverse());
+    } catch {
+      const up = path.dirname(at);
+      if (up === at) return p;
+      rest.push(path.basename(at));
+      at = up;
+    }
+  }
+}
+
+const FOLDS_CASE =
+  process.platform === "darwin" || process.platform === "win32";
+const key = (p: string) =>
+  FOLDS_CASE ? p.normalize("NFC").toLowerCase() : p.normalize("NFC");
+
+const within = (p: string, root: string) => {
+  const [a, b] = [key(p), key(root)];
+  return a === b || a.startsWith(b === "/" ? b : b + "/");
+};
+
+const expandHome = (p: string) => p.replace(/^~(?=$|\/)/, os.homedir());
+
+// Why a write to this path is refused, or null when it may go ahead.
+export async function writeRefusal(
+  filePath: string,
+  bounds: WriteBounds
+): Promise<string | null> {
+  if (!filePath) return "No file path to check.";
+  const given = expandHome(filePath);
+  const abs = given.startsWith("/") ? given : `${bounds.cwd}/${given}`;
+  let targets: string[];
+  let repos: string[];
+  let state: string[];
+  let ownDir: string[];
+  let home: string[];
+  let runs: string[];
+  try {
+    // Where it lands as written, and with `..` taken by name first, as a
+    // tool that normalises the path before opening it would; and where it
+    // was asked for, before any link: all must be allowed. A link sitting in
+    // a protected place (a dotfile kept in a dotfiles repo, Homebrew's
+    // bin/git) is refused there, wherever it points.
+    targets = [
+      ...new Set([
+        ...(await Promise.all([
+          physicalPath(abs),
+          physicalPath(path.resolve(abs)),
+        ])),
+        path.resolve(abs),
+      ]),
+    ];
+    // Each folder by its own name too, for a path that reaches it by name.
+    const both = async (p: string) => [path.resolve(p), await physicalPath(p)];
+    repos = (await Promise.all(bounds.repos.map(both))).flat();
+    runs = (await Promise.all(bounds.runs.map(both))).flat();
+    state = await both(bounds.state);
+    ownDir = await both(bounds.ownDir);
+    home = await both(bounds.home);
+  } catch (e) {
+    return `Couldn't resolve ${filePath}: ${(e as Error).message}.`;
+  }
+  for (const target of targets) {
+    const repo = repos.find((r) => within(target, r));
+    if (repo)
+      return `${filePath} is inside ${repo}, a project repository, task worktree or AgentOS itself. Change code there through a task (start_task), so its PR goes through the merge gates.`;
+    if (AGENTOS_TEMP.test(target))
+      return `${filePath} is in a checkout AgentOS is reviewing or rebasing; orchestrators never write there.`;
+    const own = ownDir.some((d) => within(target, d));
+    if (state.some((d) => within(target, d)) && !own)
+      return `${filePath} is in AgentOS's own state (${bounds.state}); you may write only in your folder, ${bounds.ownDir}.`;
+    if (isSecretPath(target) || isSecretPath(filePath))
+      return `${filePath} holds or guards secrets; orchestrators never write those.`;
+    const runsIn = runs.find((r) => within(target, r));
+    if (
+      RUNS_CODE.test(target) ||
+      RUNS_CODE.test(filePath) ||
+      runsIn ||
+      (!own &&
+        home.some(
+          (h) =>
+            within(target, h) &&
+            key(target)
+              .slice(key(h).length + 1)
+              .startsWith(".")
+        ))
+    )
+      return `${filePath} configures what runs (shell, git, agent or tool config${runsIn ? `, in ${runsIn}` : ""}); orchestrators never write those.`;
+  }
+  return null;
+}
+
+// What an orchestrator's writes are held to, read fresh for each one so a
+// project added since counts: every local project's repositories (not just
+// its workspace's, since a write to another workspace's repo skips its gates
+// as much), every session's worktree, and AgentOS's install and database.
+export async function orchestratorWriteBounds(
+  session: Session
+): Promise<WriteBounds> {
+  const projects = db
+    .prepare(
+      `SELECT working_directory AS dir FROM projects
+        WHERE is_uncategorized = 0 AND host_id = 'local'
+       UNION SELECT r.path FROM project_repositories r
+         JOIN projects p ON p.id = r.project_id
+        WHERE p.host_id = 'local'
+       UNION SELECT worktree_path FROM sessions
+        WHERE worktree_path IS NOT NULL AND worktree_path != ''`
+    )
+    .all() as { dir: string }[];
+  const dbPath = path.resolve(
+    process.env.DB_PATH || path.join(process.cwd(), "agent-os.db")
+  );
+  const repos = projects.map((p) => expandHome(p.dir)).filter((d) => d !== "");
+  return {
+    cwd: expandHome(session.working_directory),
+    home: os.homedir(),
+    runs: [
+      path.join(os.homedir(), "Library"),
+      "/Library/LaunchAgents",
+      "/Library/LaunchDaemons",
+      path.dirname(LIMITS_FILE),
+      ...(await hooksPaths(repos)),
+      ...(process.env.XDG_CONFIG_HOME ? [process.env.XDG_CONFIG_HOME] : []),
+      ...(process.env.PATH ?? "").split(":").filter((d) => d.startsWith("/")),
+    ],
+    ownDir: orchestratorDir(session.workspace_id ?? ""),
+    state: path.join(os.homedir(), ".agent-os"),
+    repos: [...repos, WORKTREES_DIR, process.cwd(), path.dirname(dbPath)],
+  };
+}
+
+// Where git looks for hooks instead of .git/hooks (core.hooksPath), in the
+// user's config and each project's: a script there runs on the next commit.
+// Read at most once a minute, not on every write.
+const HOOKS_TTL_MS = 60_000;
+let hooksCache: { key: string; at: number; dirs: string[] } | null = null;
+
+export async function hooksPaths(repos: string[]): Promise<string[]> {
+  const key = repos.join("\0");
+  if (hooksCache?.key === key && Date.now() - hooksCache.at < HOOKS_TTL_MS)
+    return hooksCache.dirs;
+  // Only "not set" and "not a repository" mean there's nothing to protect;
+  // any other failure (a timeout under load) throws, so the write is
+  // refused and nothing is cached.
+  const run = (cwd: string, args: string[]) =>
+    git(cwd, args, { timeout: 5000 })
+      .then((out) => out.trim())
+      .catch((e: unknown) => {
+        if (
+          e instanceof GitError &&
+          !e.timedOut &&
+          (e.exitCode === 1 || /not a git repository/i.test(e.stderr))
+        )
+          return "";
+        throw new Error(`couldn't read git's hooks folder in ${cwd}`);
+      });
+  // The user's, expanded by git (~ and ~user). A relative one is taken from
+  // each repo's top, so it names no one folder: each project's answer
+  // below covers it there. Each project's comes as git itself resolves it.
+  const global = await run(os.homedir(), [
+    "config",
+    "--global",
+    "--type=path",
+    "--get",
+    "core.hooksPath",
+  ]);
+  const found = await Promise.all(
+    repos.map(async (r) => {
+      // A project whose folder is gone has no hooks to run.
+      if (!fs.existsSync(r)) return "";
+      const dir = await run(r, [
+        "rev-parse",
+        "--path-format=absolute",
+        "--git-path",
+        "hooks",
+      ]);
+      if (dir !== "" && !dir.startsWith("/"))
+        throw new Error(`git named no folder for ${r}'s hooks`);
+      return dir;
+    })
+  );
+  const dirs = [
+    ...new Set([global, ...found].filter((d) => d.startsWith("/"))),
+  ];
+  hooksCache = { key, at: Date.now(), dirs };
+  return dirs;
+}
+
+// The check a PreToolUse hook makes: why this tool call is refused, or null.
+export async function orchestratorToolRefusal(
+  session: Session,
+  tool: string,
+  input: Record<string, unknown>
+): Promise<string | null> {
+  const arg = WRITE_TOOLS[tool];
+  if (!arg) return null;
+  const filePath = input[arg];
+  if (typeof filePath !== "string") return "No file path to check.";
+  return writeRefusal(filePath, await orchestratorWriteBounds(session));
+}

package/lib/project-add/index.ts

@@ -3,15 +3,25 @@
  * into it, or start a new one from a name (folder, git init, first commit).
  */
 
+import os from "os";
 import path from "path";
 import { randomUUID } from "crypto";
-import { createProject, type ProjectWithRepositories } from "../projects";
+import {
+  createProject,
+  getProject,
+  getProjectWithDevServers,
+  type ProjectWithRepositories,
+} from "../projects";
+import { db, queries, type Project } from "../db";
 import { getHost } from "../hosts";
+import { getWorkspace, setProjectWorkspace } from "../workspaces";
 import { shellQuote } from "../hosts/ssh";
 import { run, shellPath, spawnOn } from "./shell";
 import { onWindowsDrive, WINDOWS_DRIVE_WARNING } from "../wsl";
 
-export const PROJECT_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
+import { PROJECT_NAME } from "./name";
+
+export { PROJECT_NAME };
 // https://host/owner/repo(.git), ssh://…, or git@host:owner/repo(.git).
 const REPO_URL =
   /^(?:https:\/\/[\w.-]+(?::\d+)?\/|ssh:\/\/[\w.@-]+(?::\d+)?\/|[\w.-]+@[\w.-]+:)[\w./~-]+$/;
@@ -25,6 +35,8 @@ export interface FolderListing {
   parent: string | null;
   folders: string[];
   isGitRepo: boolean;
+  // The folder with every symlink resolved, for the secrets check.
+  realPath: string;
   // Set when the folder is somewhere a project shouldn't live (a Windows
   // drive under WSL).
   warning: string | null;
@@ -38,28 +50,129 @@ export async function listFolders(
   checkHost(hostId);
   const out = await run(
     hostId,
-    `cd ${shellPath(dir || "~")} && pwd && { test -e .git && echo GIT || echo NOGIT; } && find . -mindepth 1 -maxdepth 1 -type d ! -name '.*' 2>/dev/null | sort | head -500`
+    `cd ${shellPath(dir || "~")} && pwd && pwd -P && { test -e .git && echo GIT || echo NOGIT; } && find . -mindepth 1 -maxdepth 1 -type d ! -name '.*' 2>/dev/null | sort | head -500`
   );
-  const [abs, git, ...rest] = out.split("\n");
+  const [abs, real, git, ...rest] = out.split("\n");
   return {
     path: abs,
     parent: abs === "/" ? null : path.posix.dirname(abs),
     folders: rest.filter(Boolean).map((f) => f.replace(/^\.\//, "")),
     isGitRepo: git === "GIT",
+    realPath: real,
     warning: onWindowsDrive(abs) ? WINDOWS_DRIVE_WARNING : null,
   };
 }
 
+function checkWorkspace(workspaceId: string | null | undefined) {
+  if (workspaceId && !getWorkspace(workspaceId))
+    throw new Error("Unknown workspace");
+}
+
+// Folders that hold keys and credentials are never a project's home.
+const SECRET_DIR =
+  /(^|\/)(\.ssh|\.gnupg|\.aws|\.azure|\.kube|\.docker|\.password-store|\.agent-os|Keychains|tokenvault)(\/|$)/i;
+
+export function isSecretPath(dir: string): boolean {
+  const p = dir.replace(os.homedir(), "~");
+  return SECRET_DIR.test(p) || /^~\/\.config(\/|$)/i.test(p);
+}
+
+const folderKey = (hostId: string, dir: string) => {
+  const abs =
+    hostId === "local" ? dir.replace(/^~(?=$|\/)/, os.homedir()) : dir;
+  return `${hostId}\0${abs.replace(/\/+$/, "") || "/"}`;
+};
+
+// The project that already lives in this folder on this machine, if any.
+export function projectAt(hostId: string, dir: string): Project | null {
+  const key = folderKey(hostId, dir);
+  const row = (
+    queries.getProjectFolders(db).all() as {
+      id: string;
+      host_id: string;
+      working_directory: string;
+      is_uncategorized: number;
+    }[]
+  ).find(
+    (p) =>
+      !p.is_uncategorized &&
+      folderKey(p.host_id || "local", p.working_directory) === key
+  );
+  return (row && getProject(row.id)) || null;
+}
+
+// Adding a folder that's already a project: the caller is told which, and
+// can ask again with moveExisting to bring it into the workspace instead.
+export class ProjectExistsError extends Error {
+  constructor(readonly project: Project) {
+    super(`${project.name} is already a project`);
+  }
+}
+
+export interface AddFolderOptions {
+  workspaceId?: string | null;
+  name?: string;
+  // An existing project at the folder moves into workspaceId rather than
+  // failing.
+  moveExisting?: boolean;
+  // ...but only one in no workspace: taking a project from another
+  // workspace is refused (the orchestrator's limit).
+  moveOnlyUnassigned?: boolean;
+  requireGit?: boolean;
+}
+
+export interface AddedFolder {
+  project: ProjectWithRepositories;
+  // What happened: made, or an existing one moved (from its old
+  // workspace) or already there.
+  outcome: "created" | "moved" | "unchanged";
+  from: string | null;
+}
+
+// The one way a folder becomes a project in a workspace, for the add
+// dialog and the orchestrator's add_project alike.
 export async function addFolder(
   hostId: string,
-  dir: string
-): Promise<ProjectWithRepositories> {
-  const { path: abs } = await listFolders(hostId, dir);
-  return createProject({
-    name: path.posix.basename(abs) || "project",
-    workingDirectory: abs,
-    hostId,
-  });
+  dir: string,
+  opts: AddFolderOptions = {}
+): Promise<AddedFolder> {
+  checkHost(hostId);
+  checkWorkspace(opts.workspaceId);
+  if (isSecretPath(dir)) throw new Error("That folder holds secrets");
+  const { path: abs, realPath, isGitRepo } = await listFolders(hostId, dir);
+  if (isSecretPath(abs) || isSecretPath(realPath))
+    throw new Error("That folder holds secrets");
+  if (opts.requireGit && !isGitRepo)
+    throw new Error(`${abs} isn't a git repository`);
+  const workspaceId = opts.workspaceId ?? null;
+  const existing = projectAt(hostId, abs) ?? projectAt(hostId, realPath);
+  if (existing) {
+    if (!opts.moveExisting) throw new ProjectExistsError(existing);
+    const from = existing.workspace_id;
+    if (opts.moveOnlyUnassigned && from && from !== workspaceId)
+      throw new Error(
+        `${existing.name} belongs to the ${getWorkspace(from)?.name ?? "another"} workspace; only Saad moves a project between workspaces`
+      );
+    const outcome =
+      !workspaceId || from === workspaceId ? "unchanged" : "moved";
+    if (outcome === "moved") setProjectWorkspace(existing.id, workspaceId);
+    return {
+      project: getProjectWithDevServers(existing.id) as ProjectWithRepositories,
+      outcome,
+      from,
+    };
+  }
+  const name = opts.name?.trim() || path.posix.basename(abs) || "project";
+  return {
+    project: createProject({
+      name,
+      workingDirectory: abs,
+      hostId,
+      workspaceId,
+    }),
+    outcome: "created",
+    from: null,
+  };
 }
 
 // A machine with no git identity still gets its first commit, under a
@@ -71,9 +184,11 @@ const IDENTITY =
 export async function initProject(
   hostId: string,
   parent: string,
-  name: string
+  name: string,
+  workspaceId: string | null = null
 ): Promise<ProjectWithRepositories> {
   checkHost(hostId);
+  checkWorkspace(workspaceId);
   if (!PROJECT_NAME.test(name))
     throw new Error("Use letters, numbers, dots, dashes or underscores");
   const out = await run(
@@ -84,6 +199,7 @@ export async function initProject(
     name,
     workingDirectory: out.trim().split("\n").pop() || name,
     hostId,
+    workspaceId,
   });
 }
 
@@ -119,9 +235,11 @@ export const getCloneJob = (id: string) => jobs.get(id) ?? null;
 export function startClone(
   hostId: string,
   parent: string,
-  url: string
+  url: string,
+  workspaceId: string | null = null
 ): CloneJob {
   checkHost(hostId);
+  checkWorkspace(workspaceId);
   if (!REPO_URL.test(url)) throw new Error("That isn't a repository URL");
   const name = repoNameOf(url);
   if (!name) throw new Error("Couldn't tell the repository's name");
@@ -182,6 +300,7 @@ export function startClone(
         name,
         workingDirectory: stdout.trim().split("\n").pop() || name,
         hostId,
+        workspaceId,
       });
       job.projectId = project.id;
       job.status = "done";

package/lib/project-add/name.ts

@@ -0,0 +1 @@
+export const PROJECT_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;

package/lib/secret-paths.ts

@@ -0,0 +1,9 @@
+// Files that hold or guard secrets: env files, keys, credential stores and
+// the folders keys live in (.ssh, .aws, .gnupg, .kube, .docker, gh, gcloud,
+// tokenvault). Tested against a repo-relative or absolute path. A merge that
+// touches one goes to Saad (lib/orchestrator/diff), and an orchestrator may
+// never write one (lib/orchestrator/write-guard).
+export const SECRET_PATH =
+  /(^|\/)\.env(\.[^/]*)?$|(^|\/)[^/]*(secret|credential|tokenvault|keychain)[^/]*(\/|$)|\.(pem|key|p12|pfx)$|(^|\/)(id_(rsa|dsa|ecdsa|ed25519)|\.npmrc|\.netrc|\.pgpass)$|(^|\/)\.(ssh|aws|azure|gnupg|kube|docker)(\/|$)|(^|\/)\.config\/(gh|gcloud|op)(\/|$)/i;
+
+export const isSecretPath = (p: string): boolean => SECRET_PATH.test(p);

package/lib/session-audit/render.ts

@@ -427,7 +427,7 @@ export function renderSummary(
     )
   );
   out.push(
-    "\nThe reviewer the orchestrator runs (`review`) uses `claude -p --no-session-persistence` and leaves no transcript; reviews are counted from the checks above and from do-code-review subagents."
+    "\nThe reviewer the orchestrator runs (`review`) uses `claude -p --no-session-persistence` and leaves no transcript; each run's tokens are recorded in `check_runs` and shown in Usage."
   );
   return out.join("\n") + "\n";
 }

package/lib/stacks/land.ts

@@ -1,7 +1,7 @@
 /**
  * Land a stack: merge every PR bottom-up, ported from dispatch's `land`.
- * A preflight checks EVERY PR before anything merges: CI, and a Code review
- * section in its body for its head commit. Each sign-off restacks
+ * A preflight checks EVERY PR before anything merges: CI, and a passing
+ * independent review of its head commit (tasks/code-review.ts). Each sign-off restacks
  * what sits on it, so a restacked PR's checks are waited out again (its green
  * was against the parent's branch). It stops at the first failure and says
  * what landed. A chat item's agent is stopped between turns before anything
@@ -17,6 +17,8 @@ import {
   codeReviewRefusal,
   type TaskPR,
 } from "../tasks";
+import type { ReviewState } from "../tasks/code-review";
+import { getCheck } from "../orchestrator/checks";
 import { itemName } from "./guard";
 import { refreshItems } from "./tick";
 import { outputOf } from "./git";
@@ -34,6 +36,8 @@ export interface LandDeps {
   signOff: (sessionId: string, head?: string) => Promise<void>;
   beforeMerge?: MergeGate;
   prOf: (session: Session) => Promise<TaskPR | null>;
+  // The independent review of a task at a commit.
+  reviewOf: (sessionId: string, sha: string) => ReviewState | null;
   sleep: (ms: number) => Promise<void>;
   refresh: (stackId: string) => Promise<void>;
   waitMs: number;
@@ -52,6 +56,7 @@ export const LAND_DEFAULTS: LandDeps = {
     await signOffTask(id, { wait: true, head });
   },
   prOf: (s) => taskPR(s, true),
+  reviewOf: (id, sha) => getCheck(id, sha, "review"),
   sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
   refresh: refreshItems,
   waitMs: 45 * 60_000,
@@ -90,8 +95,20 @@ async function waitGreen(
   }
 }
 
+// Why an item can't merge on its review: none passed of its head, or of
+// the head the task pushed before a restack moved it.
+function unreviewed(item: StackItemRow, pr: TaskPR, deps: LandDeps) {
+  return codeReviewRefusal({
+    head: pr.head,
+    attribution: pr.attribution,
+    review: (sha) =>
+      item.session_id ? deps.reviewOf(item.session_id, sha) : null,
+    restacked: { from: item.restacked_from, to: item.restacked_to },
+  });
+}
+
 // Without the orchestrator's gate: the item's head right before merging,
-// only if its Code review section covers that commit. A push since the
+// only if a passing review covers that commit. A push since the
 // preflight needs a new review; the merge is pinned to this head.
 async function reviewedHead(
   item: StackItemRow,
@@ -100,12 +117,7 @@ async function reviewedHead(
   const now = q.item(db, item.id) ?? item;
   const session = sessionOf(now.session_id);
   const pr = session ? await deps.prOf(session) : null;
-  const refusal = pr
-    ? codeReviewRefusal(pr.codeReview, pr.head, {
-        from: now.restacked_from,
-        to: now.restacked_to,
-      })
-    : "its PR is gone";
+  const refusal = pr ? unreviewed(now, pr, deps) : "its PR is gone";
   if (refusal) throw new Stop(`stopped at ${itemName(now)}: ${refusal}`);
   return pr!.head!;
 }
@@ -157,14 +169,9 @@ export async function landStack(
       const pr =
         session && item.status === "pr" ? await deps.prOf(session) : null;
       const verdict = canSignOff(pr);
-      const unreviewed =
-        pr &&
-        codeReviewRefusal(pr.codeReview, pr.head, {
-          from: item.restacked_from,
-          to: item.restacked_to,
-        });
+      const refusal = pr && unreviewed(item, pr, deps);
       if (!verdict.ok) missing.push(`${itemName(item)}: ${verdict.reason}`);
-      else if (unreviewed) missing.push(`${itemName(item)}: ${unreviewed}`);
+      else if (refusal) missing.push(`${itemName(item)}: ${refusal}`);
       else if (item.error) missing.push(`${itemName(item)}: ${item.error}`);
       hadChecks.set(item.id, pr?.checks !== "none");
     }

package/lib/tasks/brief.ts

@@ -16,18 +16,9 @@ function stackedLines(baseBranch: string, stack: StackedOn): string {
   return `
 - This task is STACKED on ${stack.name} (${on}), which has not merged. Its commits are already in your branch and are not yours: don't change or revert them.
 - Open your pull request against ${baseBranch} (\`gh pr create --base ${baseBranch}\`) so its diff is only your commits, and start the body with the line "Stacked on ${on} (${stack.name})".
-- Never merge or rebase onto the default branch yourself. When the parent merges, AgentOS rebases your branch and retargets your PR, then tells you; re-run your checks when it does. Your code review still counts for the head AgentOS's restack left; if you push after that, review again and update the section.${also}`;
+- Never merge or rebase onto the default branch yourself. When the parent merges, AgentOS rebases your branch and retargets your PR, then tells you; re-run your checks when it does. AgentOS reviews your PR itself; a review of your head still counts for the head its restack left, and a push after that gets a new one.${also}`;
 }
 
-// What the PR body's review section looks like. lib/tasks/code-review.ts
-// parses it, and merges refuse a PR without one for its head commit.
-export const CODE_REVIEW_SECTION = `
-  ## Code review
-  Reviewed: <the full sha of the commit you reviewed, which is the PR's head>
-  Agents: <the review agents that ran>
-  Fixed: <each finding fixed, one line each, or "none">
-  Deferred: <each finding not fixed and why, or "none">`;
-
 // The system brief every task agent runs under. It finishes by opening a PR
 // and stopping: merging is the human's sign-off, never the agent's.
 export function buildTaskBrief(opts: {
@@ -39,10 +30,8 @@ export function buildTaskBrief(opts: {
 
 - Branch: ${opts.branch} (based on ${opts.baseBranch}). Stay in this directory and on this branch.
 - Do the task fully. Run the project's own checks (typecheck, tests, lint) when they exist and keep them passing.
-- When the work is done, commit with a conventional commit message, then review it before any pull request: run \`/do-code-review\` (the project's skill in .claude/skills/do-code-review; if the project has none, \`/code-review\`). Fix every Blocking and High finding, commit, and review again until none are left (two rounds at most; past that, list what's still open in the PR body).
-- Then run \`git push -u origin ${opts.branch}\` and open a pull request against ${opts.baseBranch} with \`gh pr create\`, using a clear title and a short body that says what changed and how you verified it, and ends with this section:
-${CODE_REVIEW_SECTION}
-  Merges are refused without it, and when its "Reviewed:" commit is not the PR's head: if you push again, review again and update the body (\`gh pr edit --body-file\`). Then stop and wait.
+- When the work is done, commit with a conventional commit message, run \`git push -u origin ${opts.branch}\` and open a pull request against ${opts.baseBranch} with \`gh pr create\`, using a clear title and a short body that says what changed and how you verified it. Then stop and wait.
+- You don't need to review it yourself: AgentOS runs an independent review of the PR's exact head commit before it can merge, and the orchestrator sends you any blocking findings to fix. For a risky change you may still run \`/do-code-review\` (or \`/code-review\`) before the PR.
 - Never merge the pull request, never push to ${opts.baseBranch}, and never delete branches or worktrees. A human reviews and merges.${opts.stack ? stackedLines(opts.baseBranch, opts.stack) : ""}
 - Write scratch files (PR bodies, review notes, logs, test output) outside the worktree, in your scratchpad or \$TMPDIR. Anything uncommitted left in the worktree keeps it from being removed when the task is done.
 - Do not add any AI or assistant attribution to commits or the pull request.