@saadnvd1/agent-os 0.3.470 → 0.3.472

package/lib/models/secrets.ts

@@ -0,0 +1,86 @@
+/**
+ * A provider's key, fetched from where its reference points at the moment
+ * an agent launches, and handed straight to that agent's environment. It is
+ * never written anywhere: not the database, not a log, not a prompt. Every
+ * key fetched is remembered in memory only so redact() can scrub it from
+ * any text on its way to a log or an error.
+ */
+
+import { execFile } from "child_process";
+import { shellQuote } from "../hosts/ssh";
+import type { SecretRef } from "./providers";
+
+export type SecretCommand = (cmd: string, args: string[]) => Promise<string>;
+
+const run: SecretCommand = (cmd, args) =>
+  new Promise((resolve, reject) =>
+    execFile(cmd, args, { timeout: 15_000 }, (err, stdout) =>
+      // Its stderr isn't passed on: a tool may echo what it was asked.
+      err ? reject(new Error(`${cmd} failed`)) : resolve(stdout)
+    )
+  );
+
+// An environment variable a key may be read from: one named for an API key,
+// never AgentOS's own nor its Claude login's, so a reference can't lift an
+// unrelated secret out of the server's environment.
+export const KEY_ENV_NAME =
+  /^(?!(?:ANTHROPIC|CLAUDE|AGENTOS)_)[A-Z][A-Z0-9_]*_API_KEY$/;
+
+// The command that prints the key, as argv; null for an environment
+// variable, which is read directly.
+export function secretCommand(ref: SecretRef): string[] | null {
+  if (ref.kind === "tokenvault")
+    return ["tv", "get", ref.project, ...(ref.desc ? [ref.desc] : [])];
+  if (ref.kind === "keychain")
+    return [
+      "security",
+      "find-generic-password",
+      "-s",
+      ref.service,
+      ...(ref.account ? ["-a", ref.account] : []),
+      "-w",
+    ];
+  return null;
+}
+
+// The same, as shell text that expands to the key inside the agent's own
+// shell (a terminal launch), so AgentOS never holds it at all.
+export function secretShellExpansion(ref: SecretRef): string {
+  const argv = secretCommand(ref);
+  if (!argv) return `"\${${ref.kind === "env" ? envName(ref.name) : ""}}"`;
+  return `"$(${argv.map(shellQuote).join(" ")})"`;
+}
+
+function envName(name: string): string {
+  if (!KEY_ENV_NAME.test(name))
+    throw new Error(
+      `A key can't be read from ${name}: name a *_API_KEY variable`
+    );
+  return name;
+}
+
+const seen = new Set<string>();
+
+export async function resolveSecret(
+  ref: SecretRef,
+  exec: SecretCommand = run
+): Promise<string> {
+  const argv = secretCommand(ref);
+  let value: string | undefined;
+  if (argv) {
+    const out = await exec(argv[0], argv.slice(1)).catch(() => {
+      throw new Error(`Couldn't read the key (${argv[0]} failed)`);
+    });
+    value = out.trim();
+  } else if (ref.kind === "env") value = process.env[envName(ref.name)]?.trim();
+  if (!value) throw new Error("The key reference resolved to nothing");
+  if (value.length >= 8) seen.add(value);
+  return value;
+}
+
+// Scrubs every key fetched so far out of the text.
+export function redact(text: string): string {
+  let out = text;
+  for (const s of seen) out = out.split(s).join("[redacted]");
+  return out;
+}

package/lib/models/session-model.ts

@@ -0,0 +1,40 @@
+/**
+ * Moving a session to another model without losing its conversation or
+ * worktree. On the same provider a live conversation switches in place;
+ * across providers the endpoint and key are in the agent's environment, so
+ * its worker goes and the next message starts one that resumes the same
+ * conversation on the new provider.
+ */
+
+import { db, type Session } from "../db";
+import { registry } from "../chat/registry";
+import { setChatModel } from "../chat/settings";
+import { setSessionModel, type RoutedModel } from "./resolve";
+import { ANTHROPIC } from "./roles";
+
+export async function switchSessionModel(
+  sessionId: string,
+  routed: RoutedModel
+): Promise<void> {
+  const before = db
+    .prepare(`SELECT model_provider FROM sessions WHERE id = ?`)
+    .get(sessionId) as Pick<Session, "model_provider"> | undefined;
+  setSessionModel(sessionId, routed);
+  await applySessionModel(
+    sessionId,
+    before?.model_provider ?? ANTHROPIC,
+    routed
+  );
+}
+
+// What's live catches up with the row: the model now, or a fresh worker.
+export async function applySessionModel(
+  sessionId: string,
+  fromProvider: string,
+  routed: RoutedModel
+): Promise<void> {
+  if (fromProvider === routed.provider.id)
+    return setChatModel(sessionId, routed.model);
+  if (registry.live.has(sessionId))
+    (await import("../chat/runner")).stopChat(sessionId);
+}

package/lib/models/test-provider.ts

@@ -0,0 +1,116 @@
+/**
+ * "Test provider": one tiny request to a provider's endpoint with its key,
+ * reporting whether it answered. The key goes only into the request's
+ * header; what comes back is scrubbed of it before anyone sees it.
+ */
+
+import { runClaude, type ClaudeRunner } from "../orchestrator/claude-cli";
+import { effectiveModels } from "./config";
+import type { ModelProvider } from "./providers";
+import { ANTHROPIC } from "./roles";
+import { redact, resolveSecret, type SecretCommand } from "./secrets";
+import os from "os";
+
+export interface ProviderTest {
+  ok: boolean;
+  message: string;
+  ms: number;
+}
+
+const PROMPT = "Reply with the word OK.";
+
+export async function testProvider(
+  providerId: string,
+  model?: string,
+  deps: {
+    exec?: SecretCommand;
+    fetch?: typeof fetch;
+    claude?: ClaudeRunner;
+  } = {}
+): Promise<ProviderTest> {
+  const started = Date.now();
+  const done = (ok: boolean, message: string): ProviderTest => ({
+    ok,
+    message: redact(message).slice(0, 300),
+    ms: Date.now() - started,
+  });
+  const p = effectiveModels().providers.find((x) => x.id === providerId);
+  if (!p) return done(false, `No provider "${providerId}"`);
+  const m = model || p.tiers?.haiku || p.models[0];
+  if (!m) return done(false, "It lists no model to try");
+  try {
+    if (p.id === ANTHROPIC) {
+      await (deps.claude ?? runClaude)({
+        cwd: os.tmpdir(),
+        system: "Answer in the schema.",
+        prompt: PROMPT,
+        schema: {
+          type: "object",
+          properties: { ok: { type: "boolean" } },
+          required: ["ok"],
+        },
+        tools: [],
+        model: m,
+        timeoutMs: 60_000,
+      });
+      return done(true, `${m} answered through the Claude login`);
+    }
+    if (!p.baseUrl || !p.auth) return done(false, "Set its base URL and key");
+    const key = await resolveSecret(p.auth, deps.exec);
+    const res = await (deps.fetch ?? fetch)(...request(p, m, key));
+    // Never followed: a redirect would carry the key somewhere else.
+    if (res.status >= 300 && res.status < 400)
+      return done(
+        false,
+        `HTTP ${res.status}: the endpoint redirected; set its final URL`
+      );
+    if (res.ok) return done(true, `${m} answered (HTTP ${res.status})`);
+    const body = (await res.text().catch(() => ""))
+      .slice(0, 200)
+      .replace(/[\u0000-\u001f\u007f-\u009f]/g, " ");
+    return done(false, `HTTP ${res.status}: ${body}`);
+  } catch (e) {
+    return done(false, e instanceof Error ? e.message : String(e));
+  }
+}
+
+function request(
+  p: ModelProvider,
+  model: string,
+  key: string
+): [string, RequestInit] {
+  const base = p.baseUrl!.replace(/\/+$/, "");
+  const messages = [{ role: "user", content: PROMPT }];
+  const signal = AbortSignal.timeout(30_000);
+  const redirect = "manual" as const;
+  if (p.api === "openai")
+    return [
+      `${base}/chat/completions`,
+      {
+        method: "POST",
+        redirect,
+        signal,
+        headers: {
+          "content-type": "application/json",
+          authorization: `Bearer ${key}`,
+        },
+        body: JSON.stringify({ model, max_tokens: 8, messages }),
+      },
+    ];
+  return [
+    `${base}/v1/messages`,
+    {
+      method: "POST",
+      redirect,
+      signal,
+      headers: {
+        "content-type": "application/json",
+        "anthropic-version": "2023-06-01",
+        ...(p.authHeader === "x-api-key"
+          ? { "x-api-key": key }
+          : { authorization: `Bearer ${key}` }),
+      },
+      body: JSON.stringify({ model, max_tokens: 8, messages }),
+    },
+  ];
+}

package/lib/orchestrator/act.ts

@@ -4,6 +4,7 @@
  * the brakes.
  */
 
+import { parseOverride, type ModelOverride } from "../models/resolve";
 import { sendMessage } from "../bus";
 import { chatState, interruptChat } from "../chat/runner";
 import { hostExec, isRemoteHost } from "../hosts";
@@ -80,9 +81,17 @@ export async function startTask(
   workspaceId: string,
   projectRef: string,
   prompt: string,
-  opts: { base?: string; name?: string; view?: StartView; after?: string } = {}
+  opts: {
+    base?: string;
+    name?: string;
+    view?: StartView;
+    after?: string;
+    model?: ModelOverride;
+    plan?: boolean;
+  } = {}
 ): Promise<string> {
   const project = workspaceProject(workspaceId, projectRef);
+  const model = parseOverride(opts.model) ?? undefined;
   // Its brakes read this machine's usage, not the other machine's account.
   if (isRemoteHost(project.host_id))
     throw new Error(
@@ -97,6 +106,7 @@ export async function startTask(
       prompt,
       name: opts.name,
       view,
+      model,
       baseBranch: opts.base || undefined,
       after: opts.after,
       originWorkspaceId: workspaceId,
@@ -112,6 +122,8 @@ export async function startTask(
             name: opts.name,
             baseBranch: opts.base || undefined,
             view,
+            model,
+            plan: opts.plan,
           }),
         (s) => s.id
       )

package/lib/orchestrator/armed.ts

@@ -126,8 +126,7 @@ function fingerprint(
     (f.task?.ciSettleIn ?? 0) > 0,
     getCheck(task.id, head, "review")?.status,
     getCheck(task.id, head, "scope")?.status,
-    pr.codeReview?.sha,
-    pr.codeReview?.attribution,
+    pr.attribution,
     f.task?.blocked,
     f.status,
     f.needsInput,

package/lib/orchestrator/brief.ts

@@ -41,16 +41,16 @@ You may act without asking on anything inside this workspace that's additive or
 Merge only through the gates: \`arm\` or \`sign_off\`. \`sign_off\` merges a task's PR, with the project's merge method (squash unless set otherwise), only if all of these hold, and otherwise refuses naming the gate:
 - ci: CI is green on the PR's head commit and has settled (the commit is 2 minutes old and no new check has appeared for 2 minutes). A repository with no CI goes to Saad.
 - review: an independent review of that exact commit passed. Run \`review\` on the task; it starts a fresh read-only reviewer in the background and its verdict reaches you as an event. A new commit needs a new review. The reviewer judges the PR against the task's brief plus every scope change you recorded on it with \`send\` and scope_change; a "Scope change" note in the PR body counts only where one of those backs it. When Saad changes a running task's scope, always tell the task that way.
-- code-review: the PR body has a "Code review" section (from the task's own \`/do-code-review\`) whose "Reviewed:" line names that exact commit, or the commit AgentOS restacked or rebased into it while the head is still the one AgentOS left. A task that pushed after its review has to review again and update the body; tell it so.
+- code-review: a passing review (the gate above) covers that exact commit, or the commit AgentOS restacked or rebased into it while the head is still the one AgentOS left, and the PR body carries no AI attribution. Tasks don't review themselves or write a "Code review" section any more: your review is the one review, so don't ask a task for one.
 - blocked: no BLOCKED: line and no approval or question waiting in the task's chat or terminal.
 - scope: the diff stays in the task's repository, adds no secrets, isn't only lockfiles, and, for a task from a card, a check against the card (run with the review) says it's within what the card asks.
 - stack: a stacked task's parent has merged.
 
-PRs AgentOS didn't open (dispatch on another machine, a person, dependabot) go through the same \`sign_off\` and \`review\`: name one by #N, owner/repo#N or its URL. It must be open, in the repository of one of this workspace's projects (anything else is refused), and not from a fork. It's an external PR: there's no task or session behind it, so the gates read it differently. blocked: a draft isn't ready yet, and a label like "blocked", "do not merge" or "wip" holds it. code-review: a body with no "Code review" section is fine once your \`review\` of that exact head passes (dispatch writes its review up its own way); a section it does have must name the head, like a task's. ci, review, scope, Saad's approvals and his hold are the same as for a task, and a stack never applies. A PR that turns out to be a task's is gated as that task.
+PRs AgentOS didn't open (dispatch on another machine, a person, dependabot) go through the same \`sign_off\` and \`review\`: name one by #N, owner/repo#N or its URL. It must be open, in the repository of one of this workspace's projects (anything else is refused), and not from a fork. It's an external PR: there's no task or session behind it, so the gates read it differently. blocked: a draft isn't ready yet, and a label like "blocked", "do not merge" or "wip" holds it. code-review: your \`review\` of that exact head is what counts, as for a task; a "Code review" section in its body is ignored. ci, review, scope, Saad's approvals and his hold are the same as for a task, and a stack never applies. A PR that turns out to be a task's is gated as that task.
 
 Arm a task once its work is what you want merged, rather than calling \`sign_off\` and waiting: \`arm\` makes AgentOS merge it the moment every gate passes at its head (it starts the review itself once CI is green), and you hear one event, "merged" or the failure. A failure counts like sign_off's, once per head, and the task stays armed for the fix; one that goes to Saad disarms it, as does an open ask_saad about that task (it merges on his answer). Don't poll an armed task with sign_off. \`disarm\` takes it back.
 
-When the base moves and a task's PR conflicts with it, AgentOS rebases it onto the base by itself if that's clean and its agent is idle with nothing uncommitted, pushes only the task's own branch, and tells you with one event. The task's Code review section still covers the rebased head, and your review of the old head carries over when the PR's own patch is unchanged (a fresh one starts otherwise). If it conflicts, the task is asked once to rebase and you get one event; don't send it the same request.
+When the base moves and a task's PR conflicts with it, AgentOS rebases it onto the base by itself if that's clean and its agent is idle with nothing uncommitted, pushes only the task's own branch, and tells you with one event. Your review of the old head carries over when the PR's own patch is unchanged (a fresh one starts otherwise). If it conflicts, the task is asked once to rebase and you get one event; don't send it the same request.
 
 Tasks are woken by AgentOS itself when a check fails on their PR's head (with the failing step and the log around the error) and when a collaborator reviews or comments on their PR, and you get one "task X woken: ..." line for each. Don't message a task about the same failure or review; act only if it doesn't fix it.
 
@@ -92,7 +92,8 @@ Reading:
 Acting:
 - \`${TOOL_NAMES.send}\` (session, message, scope_change?): message a session; it arrives as its next prompt. scope_change records it on the task's brief for its review.
 - \`${TOOL_NAMES.message_orchestrator}\` (workspace, message): message another workspace's orchestrator, the only thing you reach outside this workspace. Use it to hand over a bug or ask for something in its projects; it decides what to do there.
-- \`${TOOL_NAMES.start_task}\` (project, prompt, base?, name?, view?, after?): a task in its own worktree that ends in a PR. Write the prompt as a full brief; name it in 2-6 words, or it's named from the prompt. It runs as a chat; pass view terminal only when the job needs a TUI. Pass after (a task's id or name, or "any") to hold it until that task finishes, instead of remembering it in your notes. Over the workspace's running task limit it's queued too: the result says "Queued (position N)", it starts by itself, and you get an event when it does.
+- \`${TOOL_NAMES.start_task}\` (project, prompt, base?, name?, view?, after?, model?, plan?): a task in its own worktree that ends in a PR. Write the prompt as a full brief; name it in 2-6 words, or it's named from the prompt. It runs as a chat; pass view terminal only when the job needs a TUI. Pass after (a task's id or name, or "any") to hold it until that task finishes, instead of remembering it in your notes. Over the workspace's running task limit it's queued too: the result says "Queued (position N)", it starts by itself, and you get an event when it does. Its models follow the role settings (it plans on the planning model, then implements on the implementation one); pass model ("provider/model", or a map of role to one) only when Saad asks for one, and another provider than anthropic only then.
+- \`${TOOL_NAMES.set_task_model}\` (task, model, message?): move a paused task to another model and carry on in the same conversation and worktree; it keeps that model from then on. Only when Saad asks.
 - \`${TOOL_NAMES.start_session}\` (project, prompt, name?, view?): an interactive session, a chat unless view is terminal.
 - \`${TOOL_NAMES.stack}\` (target, plan_only?): run a board's open cards as stacked tasks; plan_only shows the plan without starting.
 - \`${TOOL_NAMES.land}\` (id): merge a stack bottom-up through the gates.

package/lib/orchestrator/claude-cli.ts

@@ -9,6 +9,10 @@
  */
 
 import { spawn } from "child_process";
+import { runUsageOf, type RunUsage } from "../usage/check-runs";
+import { routedRun } from "../models/launch";
+import type { ModelRole } from "../models/roles";
+import { redact } from "../models/secrets";
 
 export interface ClaudeRun {
   cwd: string;
@@ -20,14 +24,18 @@ export interface ClaudeRun {
   // Permission rules within those, e.g. "Bash(git diff:*)".
   allow?: string[];
   timeoutMs?: number;
-  // A model alias or id; the review model (or the CLI's default) otherwise.
+  // A model alias or id on Anthropic; the role's model otherwise.
   model?: string;
+  // What the run cost, from its result, even when it failed.
+  onUsage?: (usage: RunUsage) => void;
+  // The kind of work it is, which picks its model and provider
+  // (lib/models): Settings' and the workspace's role models.
+  role?: ModelRole;
+  workspaceId?: string | null;
 }
 
 export type ClaudeRunner = (run: ClaudeRun) => Promise<unknown>;
 
-const MODEL = process.env.AGENTOS_REVIEW_MODEL;
-
 // All a check's process gets from the server's environment: enough to run
 // and to sign in to Claude, nothing else.
 const ENV_ALLOW = [
@@ -54,7 +62,7 @@ export function checkEnv(
 }
 
 export function claudeArgs(run: ClaudeRun): string[] {
-  const model = run.model ?? MODEL;
+  const model = run.model;
   return [
     "-p",
     "--output-format",
@@ -84,12 +92,35 @@ export function claudeArgs(run: ClaudeRun): string[] {
   ];
 }
 
+interface ClaudeResult {
+  is_error?: boolean;
+  result?: string;
+  structured_output?: unknown;
+}
+
 // The structured answer, or throws with what went wrong.
-export const runClaude: ClaudeRunner = (run) =>
-  new Promise((resolve, reject) => {
+export const runClaude: ClaudeRunner = async (run) => {
+  const routed =
+    run.role && !run.model
+      ? await routedRun(run.role, { workspaceId: run.workspaceId })
+      : null;
+  const result = await execClaude(
+    { ...run, model: run.model ?? routed?.model },
+    { ...checkEnv(), ...routed?.env },
+    routed?.provider ?? "anthropic"
+  );
+  return result.structured_output;
+};
+
+function execClaude(
+  run: ClaudeRun,
+  env: NodeJS.ProcessEnv,
+  provider: string
+): Promise<ClaudeResult> {
+  return new Promise((resolve, reject) => {
     const child = spawn("claude", claudeArgs(run), {
       cwd: run.cwd,
-      env: checkEnv(),
+      env,
       stdio: ["pipe", "pipe", "pipe"],
     });
     let out = "";
@@ -110,18 +141,21 @@ export const runClaude: ClaudeRunner = (run) =>
     child.on("close", () => {
       clearTimeout(timer);
       try {
-        const result = JSON.parse(out) as {
-          is_error?: boolean;
-          result?: string;
-          structured_output?: unknown;
-        };
+        const result = JSON.parse(out) as ClaudeResult;
+        const usage = runUsageOf(result);
+        if (usage) run.onUsage?.({ ...usage, provider });
         if (result.is_error || result.structured_output === undefined)
           throw new Error(result.result || "No answer");
-        resolve(result.structured_output);
+        resolve(result);
       } catch (e) {
         const why = e instanceof Error ? e.message : String(e);
-        reject(new Error(`claude -p failed: ${why} ${err.slice(-300)}`.trim()));
+        reject(
+          new Error(
+            redact(`claude -p failed: ${why} ${err.slice(-300)}`.trim())
+          )
+        );
       }
     });
     child.stdin.end(run.prompt);
   });
+}

package/lib/orchestrator/diff.ts

@@ -93,7 +93,7 @@ const SENSITIVE: { why: string; test: RegExp }[] = [
     // What merges check a PR's code review with: a change that weakens it
     // must not merge through it.
     why: "the code review gate",
-    test: /^(lib\/tasks\/code-review\.ts|scripts\/check-code-review\.ts)$/i,
+    test: /^lib\/tasks\/code-review\.ts$/i,
   },
   {
     why: "secrets handling",

package/lib/orchestrator/external-gates.ts

@@ -12,11 +12,11 @@
 
 import { MERGED_AS, mergePolicy } from "../tasks/merge-policy";
 import { mergePR } from "../tasks/merge-pr";
-import { attributionIn, codeReviewRefusal } from "../tasks/code-review";
+import { attributionIn, codeReviewGate } from "../tasks/code-review";
 import { run } from "../tasks/gh";
 import { refundApproval, spendApproval } from "./ask-approvals";
 import { resolveAsks } from "./asks";
-import { clearStaleRunning, getCheck, type CheckRow } from "./checks";
+import { clearStaleRunning, getCheck } from "./checks";
 import { gateTarget, type ExternalPR } from "./external-pr";
 import { holdingEscalations } from "./gates";
 import { addNote } from "./notes";
@@ -39,44 +39,6 @@ const refsOf = (ext: ExternalPR) => ({
   branch_name: ext.branch,
 });
 
-// The code-review gate: a section in the body must cover the head like a
-// task's; with none, the independent review of the head stands in.
-export function externalCodeReview(
-  ext: Pick<ExternalPR, "name" | "body" | "pr">,
-  sha: string,
-  review: CheckRow | null
-): { refusal: string | null; wait: string | null } {
-  const attribution = attributionIn(ext.body);
-  if (attribution)
-    return {
-      refusal: `the PR body carries AI attribution (${attribution}): remove it with \`gh pr edit --body-file\``,
-      wait: null,
-    };
-  const section = ext.pr.codeReview;
-  if (section !== null)
-    return {
-      refusal: codeReviewRefusal(
-        section,
-        sha,
-        null,
-        `${ext.name}'s "Code review" section has to name ${short(sha)} on a "Reviewed:" line, or come out of the body`
-      ),
-      wait: null,
-    };
-  const none = `${ext.name}'s body has no "Code review" section; for a PR AgentOS didn't open, the orchestrator's own review of ${short(sha)} stands in for it`;
-  if (review?.sha === sha && review.status === "pass")
-    return { refusal: null, wait: null };
-  return {
-    refusal: null,
-    wait:
-      review?.sha === sha && review.status === "running"
-        ? `${none}, and it's still running`
-        : review?.sha === sha && review.status === "block"
-          ? `${none}, and it has blocking findings`
-          : `${none}: call review`,
-  };
-}
-
 export async function judgeExternal(
   workspaceId: string,
   ext: ExternalPR,
@@ -102,7 +64,6 @@ export async function judgeExternal(
     },
     async () => {
       const review = getCheck(ext.id, sha, "review");
-      const code = externalCodeReview(ext, sha, review);
       const label = ext.labels.find((l) => BLOCKED_LABEL.test(l));
       return {
         checks: pr.checks,
@@ -124,8 +85,12 @@ export async function judgeExternal(
         fromCard: false,
         scope: null,
         stackRefusal: null,
-        codeReviewRefusal: code.refusal,
-        codeReviewWait: code.wait,
+        // The same gate as a task's: the review of this exact head.
+        codeReview: codeReviewGate({
+          head: sha,
+          attribution: attributionIn(ext.body) ?? null,
+          review: (at) => getCheck(ext.id, at, "review"),
+        }),
       };
     },
     opts

package/lib/orchestrator/gates.ts

@@ -11,6 +11,7 @@
  */
 
 import { db } from "../db";
+import type { CodeReviewGate } from "../tasks/code-review";
 import type { ChecksVerdict } from "../tasks/state";
 import type { CheckRow } from "./checks";
 import { APPROVAL_GATES, mergeApprovalsOn } from "./merge-approvals";
@@ -45,11 +46,9 @@ export interface GateInput {
   fromCard: boolean;
   scope: CheckRow | null;
   stackRefusal: string | null;
-  // Why the PR body's Code review section doesn't cover this commit.
-  codeReviewRefusal: string | null;
-  // Why it isn't covered yet but will be (an external PR whose own review
-  // of this commit stands in for the section).
-  codeReviewWait?: string | null;
+  // Whether a passing independent review covers this commit, and the body
+  // carries no AI attribution (tasks/code-review.ts).
+  codeReview: CodeReviewGate;
   // A PR no task owns has no session to read: a draft isn't ready yet, and
   // a label saying it's blocked holds it.
   prDraft?: string | null;
@@ -147,11 +146,12 @@ export function evaluateGates(i: GateInput): GateOutcome[] {
   const stack: GateOutcome = i.stackRefusal
     ? { gate: "stack", state: "fail", reason: i.stackRefusal }
     : { gate: "stack", state: "pass" };
-  const codeReview: GateOutcome = i.codeReviewRefusal
-    ? { gate: "code-review", state: "fail", reason: i.codeReviewRefusal }
-    : i.codeReviewWait
-      ? { gate: "code-review", state: "wait", reason: i.codeReviewWait }
-      : { gate: "code-review", state: "pass" };
+  // Its wait is the review gate's own (no passing review of this exact
+  // head), which already holds the merge: only paths without that gate (an
+  // approval, a stack's land) read it.
+  const codeReview: GateOutcome = i.codeReview.refusal
+    ? { gate: "code-review", state: "fail", reason: i.codeReview.refusal }
+    : { gate: "code-review", state: "pass" };
   return [
     ciGate(i),
     checkGate("review", i.review, i.sha),

package/lib/orchestrator/home.ts

@@ -5,12 +5,12 @@
  * sessions.
  */
 
+import { resolveRoleOrDefault } from "../models/resolve";
 import fs from "fs";
 import os from "os";
 import path from "path";
 import { randomBytes, randomUUID, timingSafeEqual } from "crypto";
 import { db, type Session } from "../db";
-import { resolveModelForAgent } from "../model-catalog";
 import { getWorkspace } from "../workspaces";
 
 // It works through tools, not in a repo: a scratch folder of its own.
@@ -62,7 +62,7 @@ export function ensureOrchestrator(workspaceId: string): Session {
     `${workspace.name} orchestrator`,
     `claude-${id}`,
     dir,
-    resolveModelForAgent("claude", null),
+    resolveRoleOrDefault("orchestrator", { workspaceId }).model,
     workspaceId
   );
   return getOrchestrator(workspaceId)!;

package/lib/orchestrator/pr-wake.ts

@@ -272,7 +272,7 @@ export function checkMessage(
     : pr.failingUrl
       ? `\n\nIts details: ${untrusted("CI", pr.failingUrl)}`
       : "";
-  return `CI check ${untrusted("CI", pr.failing ?? "")} failed on your PR #${pr.number} at ${short(pr.head)}${step}.${tail}\n\n${UNTRUSTED_RULE}\n\nFix the root cause (not the check), re-run your checks, push, then run /do-code-review again and update the Reviewed: line in the PR body for the new head.`;
+  return `CI check ${untrusted("CI", pr.failing ?? "")} failed on your PR #${pr.number} at ${short(pr.head)}${step}.${tail}\n\n${UNTRUSTED_RULE}\n\nFix the root cause (not the check), re-run your checks, then push.`;
 }
 
 // True once the PR's activity at this fingerprint has been handled.
@@ -374,7 +374,7 @@ export function reviewMessage(pr: TaskPR, events: PREvent[]): string {
         : "";
     return `- ${e.author} ${what}${body}${notes}${more}`;
   });
-  return `New review activity on your PR #${pr.number}:\n${items.join("\n")}\n\n${UNTRUSTED_RULE} Address each point: fix what's right, re-run your checks, push, then run /do-code-review again and update the Reviewed: line for the new head. Where you disagree, reply on the PR (\`gh pr comment ${pr.number}\`) saying why.`;
+  return `New review activity on your PR #${pr.number}:\n${items.join("\n")}\n\n${UNTRUSTED_RULE} Address each point: fix what's right, re-run your checks, then push. Where you disagree, reply on the PR (\`gh pr comment ${pr.number}\`) saying why.`;
 }
 
 // Tests only.