@saadnvd1/agent-os 0.3.476 → 0.3.479

package/lib/orchestrator/repo.ts

@@ -7,8 +7,16 @@ import os from "os";
 import path from "path";
 import type { Session } from "../db";
 import { SKILL_DIRS } from "../agents/skill-dirs";
+import { getDefaultBranch } from "../git";
 import { getProject } from "../projects";
-import { git, gitFetch, gitOk, worktreeAdd, worktreeRemove } from "../git-exec";
+import {
+  git,
+  gitFetch,
+  gitOk,
+  isGitError,
+  worktreeAdd,
+  worktreeRemove,
+} from "../git-exec";
 import { expandHome } from "../tasks/session";
 
 export function repoOf(task: Session): string {
@@ -17,22 +25,79 @@ export function repoOf(task: Session): string {
   return expandHome(project.working_directory);
 }
 
-// The task's base on origin, fetched along with its head.
+// The task's base on origin, fetched along with its head. The base is the
+// PR's own (prFor records GitHub's baseRefName on the task). A base gone
+// from origin (a stacked parent's branch, deleted) falls back to the
+// project's default branch, and so does one that can't be found at all, so
+// a diff never names a missing revision.
 export async function fetchRefs(
   repo: string,
   task: Pick<Session, "base_branch" | "branch_name">
 ): Promise<string> {
-  const base = task.base_branch || "main";
-  await gitFetch(repo, [
-    "--quiet",
-    "--",
-    "origin",
-    base,
-    task.branch_name ?? base,
-  ]).catch(() => {});
-  const remote = `origin/${base}`;
-  const has = await gitOk(repo, ["rev-parse", "--verify", "--quiet", remote]);
-  return has ? remote : base;
+  const head = task.branch_name ? [task.branch_name] : [];
+  const recorded = task.base_branch || null;
+  if (recorded) {
+    const fetched = await fetchBranches(repo, [recorded, ...head]);
+    // A base gone on origin fails the fetch, so the head goes on its own.
+    if (fetched === "gone" && head.length)
+      requireFetched(await fetchBranches(repo, head));
+    requireFetched(fetched);
+    if (fetched !== "gone") {
+      const found = await existingRef(repo, recorded);
+      if (found) return found;
+    }
+  }
+  const fallback = await getDefaultBranch(repo);
+  if (fallback !== recorded) {
+    requireFetched(
+      await fetchBranches(repo, recorded ? [fallback] : [fallback, ...head])
+    );
+    const found = await existingRef(repo, fallback);
+    if (found) return found;
+  }
+  throw new Error(
+    `Neither the base ${recorded ?? "(none recorded)"} nor the default branch ${fallback} can be found`
+  );
+}
+
+// An unreachable origin leaves the tracking refs as they were, and a diff
+// against a stale base can hide or invent changes, so the gates stop.
+function requireFetched(result: "ok" | "gone" | "failed"): void {
+  if (result === "failed")
+    throw new Error("Couldn't fetch from origin, so the base can't be trusted");
+}
+
+// "gone" when origin answered that the first branch isn't there; any other
+// failure is "failed" (origin unreachable).
+async function fetchBranches(
+  repo: string,
+  branches: string[]
+): Promise<"ok" | "gone" | "failed"> {
+  try {
+    // In English whatever the locale: the message is read below.
+    await gitFetch(repo, ["--quiet", "--", "origin", ...branches], {
+      env: { LC_ALL: "C" },
+    });
+    return "ok";
+  } catch (error) {
+    const stderr = isGitError(error) ? error.stderr : "";
+    return stderr.includes(`couldn't find remote ref ${branches[0]}`)
+      ? "gone"
+      : "failed";
+  }
+}
+
+// origin/<branch> when it's there, else a local <branch>.
+async function existingRef(
+  repo: string,
+  branch: string
+): Promise<string | null> {
+  for (const ref of [`origin/${branch}`, branch])
+    if (
+      await gitOk(repo, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`])
+    )
+      return ref;
+  return null;
 }
 
 // When the commit was made, in seconds.

package/lib/orchestrator/review.ts

@@ -43,6 +43,7 @@ import {
   checkRunTotals,
   describeCheckRuns,
 } from "../usage/check-runs";
+import { noteQuickReview } from "./quick";
 import { workspaceTask } from "./targets";
 import { untrusted } from "./untrusted";
 
@@ -65,6 +66,13 @@ export function describeReview(row: CheckRow): string {
 // What a review reads: a task's PR, or a PR no task owns (external-pr.ts).
 // `id` keys its stored checks; `task` is set only for a task, whose card
 // gets a scope check.
+const baseBranchOf = (id: string) =>
+  (
+    db.prepare(`SELECT base_branch FROM sessions WHERE id = ?`).get(id) as
+      | { base_branch: string | null }
+      | undefined
+  )?.base_branch ?? null;
+
 export interface ReviewTarget {
   id: string;
   name: string;
@@ -85,6 +93,7 @@ async function reviewJob(
 ): Promise<CheckRow> {
   const { pr, repo, task } = target;
   const row = { workspaceId, sessionId: target.id, sha };
+  const judged = target.refs.base_branch;
   const base = await fetchRefs(repo, target.refs);
   const diff = await fullDiff(repo, base, sha);
   const parts =
@@ -160,6 +169,16 @@ async function reviewJob(
       });
       verdicts.push(toVerdict(answer));
     }
+    // A retarget while it ran (prFor records it): this verdict read the
+    // diff against the old base, so it covers nothing.
+    const now = task ? baseBranchOf(task.id) : judged;
+    if (now !== judged)
+      return putCheck({
+        ...row,
+        kind: "review",
+        status: "error",
+        detail: `the PR's base moved from ${judged} to ${now} while it was reviewed; review it again`,
+      });
     const done = putCheck({
       ...row,
       kind: "review",
@@ -254,6 +273,8 @@ export async function reviewAt(
       })
     )
     .then((done) => {
+      if (done.status === "pass" && target.task)
+        noteQuickReview(target.task, sha);
       const said =
         done.status === "pass"
           ? "passed"

package/lib/orchestrator/serve.ts

@@ -26,6 +26,8 @@ import { readSession } from "./read";
 import { reviewTarget, signOffTarget } from "./external-gates";
 import { land } from "./signoff";
 import { arm, disarm } from "./armed";
+import { quickChange, quickPR } from "./quick";
+import { review } from "./review";
 import { parseArgs as p, type ToolName } from "./tool-schemas";
 
 export { isToolName, TOOLS, type ToolName } from "./tool-schemas";
@@ -37,6 +39,8 @@ const ACTING = new Set<ToolName>([
   "start_task",
   "set_task_model",
   "start_session",
+  "quick_change",
+  "quick_pr",
   "stack",
   "land",
   "drop",
@@ -119,6 +123,19 @@ export async function runTool(
         view: a.view,
       });
     }
+    case "quick_change": {
+      const a = p(tool, raw);
+      return quickChange(w, a.project, a.name);
+    }
+    case "quick_pr": {
+      const a = p(tool, raw);
+      const opened = await quickPR(w, a.change, a.title, a.body);
+      // Its code-review gate is this review: it starts at once.
+      const reviewing = await review(w, opened.id).catch(
+        (e: Error) => `Its review couldn't start (${e.message}): call review.`
+      );
+      return `${opened.text}\n${reviewing}`;
+    }
     case "stack": {
       const a = p(tool, raw);
       return stack(w, a.target, a.plan_only);

package/lib/orchestrator/signoff.ts

@@ -15,6 +15,7 @@ import { getStack, landInBackground } from "../stacks";
 import { LAND_DEFAULTS } from "../stacks/land";
 import { db, stackQueries, type Session } from "../db";
 import { getCheck } from "./checks";
+import { isQuick, quickCodeReview } from "./quick";
 import {
   addedLines,
   changedFiles,
@@ -71,8 +72,33 @@ export async function judge(
   const pr = await prFor(task, true);
   if (!pr || pr.state !== "OPEN" || !pr.head)
     return { ok: false, wait: false, text: `${task.name} has no open PR` };
+  // prFor records a retarget to the default branch or the stack parent's
+  // branch; any other base would merge somewhere nobody chose, judged
+  // against a branch the task picked.
+  if (pr.base && pr.base !== task.base_branch)
+    return {
+      ok: false,
+      wait: false,
+      text: `${task.name}'s PR #${pr.number} targets ${pr.base}, not its base ${task.base_branch ?? "(none)"}: retarget it to ${task.base_branch ?? "the default branch"}`,
+    };
   const sha = pr.head;
   const repo = repoOf(task);
+  // A PR quick_pr opened (by the row AgentOS wrote, never the body): its
+  // code review is the independent review of this head, and until that
+  // passes it waits, before any gate is judged or counted.
+  const quick = isQuick(task)
+    ? quickCodeReview(
+        sha,
+        getCheck(task.id, sha, "review"),
+        restackedOf(task)?.to === sha
+      )
+    : null;
+  if (quick?.wait)
+    return {
+      ok: false,
+      wait: true,
+      text: `${task.name} (PR #${pr.number} at ${short(sha)}) can't merge yet: ${quick.wait}`,
+    };
   return gateVerdict(
     workspaceId,
     { id: task.id, name: task.name, repo, refs: task, pr, sha },
@@ -91,12 +117,17 @@ export async function judge(
       fromCard: !!task.lh_card_id,
       scope: getCheck(task.id, sha, "scope"),
       stackRefusal: landing ? null : signOffRefusal(task.id),
-      codeReview: codeReviewGate({
-        head: sha,
-        attribution: pr.attribution,
-        review: (at) => getCheck(task.id, at, "review"),
-        restacked: restackedOf(task),
-      }),
+      codeReview: (() => {
+        const gate = codeReviewGate({
+          head: sha,
+          attribution: pr.attribution,
+          review: (at) => getCheck(task.id, at, "review"),
+          restacked: restackedOf(task),
+        });
+        // A quick change keeps the body checks (attribution, unreadable);
+        // its wait on the review was judged above.
+        return quick ? { refusal: gate.refusal, wait: null } : gate;
+      })(),
     }),
     opts
   );

package/lib/orchestrator/task-state.ts

@@ -17,6 +17,8 @@ import { untrusted } from "./untrusted";
 export async function waitingState(
   task: Session
 ): Promise<{ blocked: string | null; waitingOn: string | null }> {
+  // A quick change has no agent to block or ask: the orchestrator makes it.
+  if (task.quick_of) return { blocked: null, waitingOn: null };
   // A linked machine's chat lives in that machine's store, not this one's:
   // its own reading of the task is asked for, fresh.
   const link = hostLink(task.host_id);

package/lib/orchestrator/tool-names.ts

@@ -16,6 +16,8 @@ export const TOOL_NAMES = {
   start_task: name("start_task"),
   set_task_model: name("set_task_model"),
   start_session: name("start_session"),
+  quick_change: name("quick_change"),
+  quick_pr: name("quick_pr"),
   stack: name("stack"),
   stack_status: name("stack_status"),
   land: name("land"),
@@ -39,8 +41,11 @@ export const TOOL_NAMES = {
 // braked; the shell keeps only `aos` commands that read, and notify, which
 // reaches only Saad, so `aos send`, `task`, `spawn` and `stack` can't go
 // around them. It writes files, but never in a project repository, a task
-// worktree, AgentOS's own state or a secret file: its worker checks each
-// write first (write-guard.ts).
+// worktree, AgentOS's own state or a secret file, except inside its own
+// quick changes' worktrees (quick.ts), where it may also run git that
+// looks, stages or undoes, never commits with hooks or pushes: its worker
+// checks each write and each shell command first (write-guard.ts,
+// git-guard.ts).
 export const ORCHESTRATOR_PERMISSIONS: {
   permissionMode: PermissionMode;
   allowedTools: string[];
@@ -67,6 +72,8 @@ export const ORCHESTRATOR_PERMISSIONS: {
     "Bash(aos notify:*)",
     "Bash(aos docs:*)",
     "Bash(aos doc:*)",
+    // Only `git -C <its own quick worktree>`, refused anywhere else.
+    "Bash(git:*)",
   ],
   disallowedTools: [],
 };

package/lib/orchestrator/tool-schemas.ts

@@ -135,6 +135,32 @@ export const TOOL_SHAPES = {
       .describe("A short name, 2-6 words (default: one made from the prompt)"),
     view,
   },
+  quick_change: {
+    project,
+    name: z
+      .string()
+      .trim()
+      .min(1)
+      .max(80)
+      .describe("A short name for the change, 2-6 words"),
+  },
+  quick_pr: {
+    change: ref("Your quick change, by name or id"),
+    title: z
+      .string()
+      .trim()
+      .min(1)
+      .max(200)
+      .describe("The PR's title, also its commit message"),
+    body: z
+      .string()
+      .trim()
+      .min(1)
+      .max(20000)
+      .describe(
+        "What changed and why; the review judges the change against it"
+      ),
+  },
   stack: {
     target: ref("Board or project name"),
     plan_only: z.boolean().optional(),

package/lib/orchestrator/tools.ts

@@ -66,6 +66,10 @@ const DESCRIPTIONS: Record<ToolName, string> = {
     'Resume a paused task on another model ("provider/model", or a map of role to one), keeping its conversation and worktree; it\'s told to carry on (or message). Refused mid-turn.',
   start_session:
     "Start an interactive agent session in a project with a prompt. It runs as a chat unless view is terminal (only for a job that needs a TUI). Refused while a brake holds.",
+  quick_change:
+    "Make a small, low-risk edit yourself (a typo, a config value, a one-file fix): cuts a worktree and branch from the project's default branch and returns its path. You may write there (Write, Edit) and run git there as `git -C <path> ...` (status, diff, add, rm, mv, restore, reset, log, show); nowhere else in a project. Anything needing real work, tests or an investigation is a task (start_task).",
+  quick_pr:
+    "Commit everything in a quick change's worktree, push its branch (never the default branch) and open its PR, or push to the PR it already has. The PR goes through the same gates as a task's; with no task agent to run /do-code-review, its code-review gate is the independent review of its exact head, which starts now.",
   stack:
     "Run a LumifyHub board's open cards as stacked tasks (each start braked), or with plan_only just show the plan.",
   stack_status: "One stack's items, PRs and progress.",

package/lib/orchestrator/write-guard.ts

@@ -21,6 +21,8 @@ import { isSecretPath } from "../secret-paths";
 import { WORKTREES_DIR } from "../worktrees";
 import { orchestratorDir } from "./home";
 import { LIMITS_FILE } from "./usage";
+import { GIT_LAYOUT_FILE, readCommand } from "./git-guard";
+import { quickWorktrees } from "./quick-store";
 
 // The tools that write a file, and the argument naming it.
 export const WRITE_TOOLS: Record<string, string> = {
@@ -43,6 +45,9 @@ export interface WriteBounds {
   home: string;
   // Folders whose files run (~/Library, PATH, the usage brake's input...).
   runs: string[];
+  // Its own quick changes' worktrees (quick.ts): the one place in a
+  // project it may write, everything else in `repos` still refused.
+  quick?: string[];
 }
 
 // Wherever they are, files that configure what an agent, git or a
@@ -129,6 +134,7 @@ export async function writeRefusal(
   let ownDir: string[];
   let home: string[];
   let runs: string[];
+  let quick: string[][];
   try {
     // Where it lands as written, and with `..` taken by name first, as a
     // tool that normalises the path before opening it would; and where it
@@ -151,16 +157,27 @@ export async function writeRefusal(
     state = await both(bounds.state);
     ownDir = await both(bounds.ownDir);
     home = await both(bounds.home);
+    quick = await Promise.all((bounds.quick ?? []).map(both));
   } catch (e) {
     return `Couldn't resolve ${filePath}: ${(e as Error).message}.`;
   }
   for (const target of targets) {
-    const repo = repos.find((r) => within(target, r));
+    // Inside one of its quick worktrees, the roots that hold that worktree
+    // (the worktrees folder, a project above it) don't count; any other
+    // root, one nested inside it included, still refuses.
+    const ownQuick = quick.find((q) => q.some((d) => within(target, d)));
+    const holdsQuick = (r: string) =>
+      !!ownQuick && ownQuick.some((d) => within(d, r));
+    const repo = repos.find((r) => within(target, r) && !holdsQuick(r));
     if (repo)
-      return `${filePath} is inside ${repo}, a project repository, task worktree or AgentOS itself. Change code there through a task (start_task), so its PR goes through the merge gates.`;
+      return `${filePath} is inside ${repo}, a project repository, task worktree or AgentOS itself. Change code there through a task (start_task), or for a small edit, in a quick change's worktree (quick_change), so its PR goes through the merge gates.`;
+    if (ownQuick && GIT_LAYOUT_FILE.test(target))
+      return `${filePath} is part of a git repository's layout (HEAD, .git/, .gitattributes); git config can run programs, so orchestrators never write those.`;
     if (AGENTOS_TEMP.test(target))
       return `${filePath} is in a checkout AgentOS is reviewing or rebasing; orchestrators never write there.`;
-    const own = ownDir.some((d) => within(target, d));
+    // Its folder, or a quick worktree (which sits in ~/.agent-os/worktrees):
+    // AgentOS's state and the home's dot-folders hold it, but it's its own.
+    const own = ownDir.some((d) => within(target, d)) || !!ownQuick;
     if (state.some((d) => within(target, d)) && !own)
       return `${filePath} is in AgentOS's own state (${bounds.state}); you may write only in your folder, ${bounds.ownDir}.`;
     if (isSecretPath(target) || isSecretPath(filePath))
@@ -219,6 +236,7 @@ export async function orchestratorWriteBounds(
       ...(process.env.PATH ?? "").split(":").filter((d) => d.startsWith("/")),
     ],
     ownDir: orchestratorDir(session.workspace_id ?? ""),
+    quick: quickWorktrees(session.id),
     state: path.join(os.homedir(), ".agent-os"),
     repos: [...repos, WORKTREES_DIR, process.cwd(), path.dirname(dbPath)],
   };
@@ -287,9 +305,68 @@ export async function orchestratorToolRefusal(
   tool: string,
   input: Record<string, unknown>
 ): Promise<string | null> {
+  if (tool === "Bash") return commandRefusal(session, input.command);
   const arg = WRITE_TOOLS[tool];
   if (!arg) return null;
   const filePath = input[arg];
   if (typeof filePath !== "string") return "No file path to check.";
   return writeRefusal(filePath, await orchestratorWriteBounds(session));
 }
+
+// A shell command: one plain command, and git only in its own quick
+// worktrees (git-guard.ts), the folder it names resolved like a write's.
+async function commandRefusal(
+  session: Session,
+  command: unknown
+): Promise<string | null> {
+  const read = readCommand(command);
+  if (read.refusal !== null || read.dir === null) return read.refusal;
+  const quick = quickWorktrees(session.id);
+  const dir = read.dir;
+  if (!dir.startsWith("/") || !quick.length)
+    return `Refused: git runs only in one of your quick changes' worktrees, named by its full path (${quick.length ? quick.join(", ") : "you have none open; start one with quick_change"}).`;
+  return (await isQuickRoot(dir, quick))
+    ? null
+    : `Refused: ${read.dir} isn't the root of one of your quick changes' worktrees (${quick.join(", ")}). Git runs at the root only, never in a subfolder, a project checkout or another session's worktree.`;
+}
+
+// Whether a folder is inside one of these worktrees by every way the
+// system could read it: as named, with `..` taken by name, and with links
+// followed.
+export async function insideQuick(
+  dir: string,
+  quick: string[]
+): Promise<boolean> {
+  try {
+    const forms = [
+      path.resolve(dir),
+      await physicalPath(dir),
+      await physicalPath(path.resolve(dir)),
+    ];
+    const roots = (
+      await Promise.all(
+        quick.map(async (q) => [path.resolve(q), await physicalPath(q)])
+      )
+    ).flat();
+    return forms.every((f) => roots.some((r) => within(f, r)));
+  } catch {
+    return false;
+  }
+}
+
+// Whether a folder is exactly the root of one of these worktrees (as named,
+// and with links followed), where git finds the real git dir.
+async function isQuickRoot(dir: string, quick: string[]): Promise<boolean> {
+  if (!(await insideQuick(dir, quick))) return false;
+  try {
+    const forms = [path.resolve(dir), await physicalPath(dir)];
+    const roots = (
+      await Promise.all(
+        quick.map(async (q) => [path.resolve(q), await physicalPath(q)])
+      )
+    ).flat();
+    return forms.every((f) => roots.includes(f));
+  } catch {
+    return false;
+  }
+}

package/lib/sessions/end.ts

@@ -0,0 +1,15 @@
+import type { Session } from "../db";
+import { stopChat } from "../chat/runner";
+import { waitForExit } from "../chat/worker/client";
+import { endTmuxSession } from "../tmux/end";
+
+type Agent = Pick<Session, "id" | "host_id" | "tmux_name">;
+
+// A session's agent, ended: its chat worker, and its own tmux session (a
+// chat session can still own one). The one call that delete, done, drop and
+// finish share.
+export async function endSessionAgent(s: Agent): Promise<void> {
+  stopChat(s.id);
+  void waitForExit(s.id).catch(() => {});
+  await endTmuxSession(s.host_id, s.tmux_name);
+}

package/lib/sidebar/shelves.ts

@@ -41,6 +41,10 @@ export interface SidebarRow {
   working: boolean;
   // Orchestration workers, nested under their conductor.
   workers: SidebarRow[];
+  // Its task's state, when it's a task.
+  task?: TaskState;
+  // An orchestrator's quick changes (orchestrator/quick.ts), nested under it.
+  quick?: SidebarRow[];
 }
 
 export interface Shelves {
@@ -113,6 +117,8 @@ function toRow(input: ShelfInput, session: Session): SidebarRow {
     unread: !!status?.unread,
     working: status?.status === "running",
     workers: [],
+    task: input.tasks[session.id],
+    quick: [],
   };
 }
 
@@ -129,6 +135,15 @@ export function buildShelves(input: ShelfInput): Shelves {
 
   const top: SidebarRow[] = [];
   for (const row of rows) {
+    // A quick change always sits under the orchestrator that makes it: it's
+    // that orchestrator's to carry, never one that needs you.
+    const owner = row.session.quick_of
+      ? byId.get(row.session.quick_of)
+      : undefined;
+    if (owner) {
+      (owner.quick ??= []).push(row);
+      continue;
+    }
     const conductor = row.session.conductor_session_id
       ? byId.get(row.session.conductor_session_id)
       : undefined;
@@ -200,8 +215,11 @@ export function sameRow(a: SidebarRow, b: SidebarRow): boolean {
     a.unread === b.unread &&
     a.working === b.working &&
     sameStatus(a.status, b.status) &&
+    a.task === b.task &&
     a.workers.length === b.workers.length &&
-    a.workers.every((w, i) => sameRow(w, b.workers[i]))
+    a.workers.every((w, i) => sameRow(w, b.workers[i])) &&
+    (a.quick?.length ?? 0) === (b.quick?.length ?? 0) &&
+    (a.quick ?? []).every((q, i) => sameRow(q, b.quick![i]))
   );
 }
 

package/lib/stacks/guard.ts

@@ -12,6 +12,17 @@ export function refusalFor(
 ): string | null {
   if (!parent) return null;
   const who = itemName(parent);
+  // A dropped parent never merges: once the PR moved off its branch
+  // (GitHub retargets it when the branch is deleted), there is nothing to
+  // wait for, and the review of the new base reads the parent's commits.
+  // A failed one can be retried, so it still blocks.
+  if (
+    parent.status === "dropped" &&
+    parentBranch &&
+    item.base_branch &&
+    item.base_branch !== parentBranch
+  )
+    return null;
   if (parent.status !== "merged") {
     const state =
       parent.status === "pr" ? "has not merged" : `is ${parent.status}`;

package/lib/tasks/finish.ts

@@ -10,7 +10,7 @@ import { republishAfterMerge } from "../lumifyhub/publish";
 import { restackAfterMerge } from "../stacks/restack";
 import { itemName, liveChildren, signOffRefusal } from "../stacks/guard";
 import { resolveMergedTaskAsks } from "../orchestrator/ask-settle";
-import { stopChat } from "../chat/runner";
+import { endSessionAgent } from "../sessions/end";
 import { run } from "./gh";
 import { gitFetch, gitPush } from "../git-exec";
 import {
@@ -39,13 +39,7 @@ async function cleanup(
   opts: { keepRemoteBranch?: boolean; merged?: MergedAs } = {}
 ): Promise<void> {
   const keepRemoteBranch = opts.keepRemoteBranch ?? false;
-  // A chat task's agent runs in its chat worker, not the task's tmux.
-  if (session.view === "chat") stopChat(session.id);
-  await run(
-    "tmux",
-    ["kill-session", "-t", `=${session.tmux_name}`],
-    repo
-  ).catch(() => {});
+  await endSessionAgent(session);
   // Never waited on: the row is read now, and Postgres can't hold this up.
   void dropSessionDatabase(session.id);
   if (session.worktree_path && opts.merged) {
@@ -127,9 +121,16 @@ export async function signOffTask(
   if (!repo) throw new Error("Task has no project");
   const refusal = signOffRefusal(id);
   if (refusal) throw new Error(refusal);
+  // prFor follows a retarget onto the record, so compare with what the
+  // checks above were judged against.
+  const judgedBase = session.base_branch;
   const pr = await prFor(session, true);
   const verdict = canSignOff(pr);
   if (!verdict.ok) throw new Error(verdict.reason);
+  if (pr!.base && pr!.base !== judgedBase)
+    throw new Error(
+      `PR #${pr!.number} targets ${pr!.base}, not its base ${judgedBase ?? "(none)"}: its review and checks were for the old base`
+    );
   if (opts.head && pr!.head && pr!.head !== opts.head)
     throw new Error(
       `The PR moved to ${pr!.head.slice(0, 7)} after ${opts.head.slice(0, 7)} was checked`

package/lib/tasks/gh.ts

@@ -54,6 +54,7 @@ export interface ListedPR {
   isCrossRepository?: boolean;
   createdAt?: string;
   mergeable?: TaskPR["mergeable"];
+  baseRefName?: string;
 }
 
 export interface FindPROpts {
@@ -81,7 +82,7 @@ export async function findPRStrict(
       "--limit",
       "10",
       "--json",
-      "number,url,state,headRefOid,statusCheckRollup,body,isCrossRepository,createdAt,mergeable",
+      "number,url,state,headRefOid,statusCheckRollup,body,isCrossRepository,createdAt,mergeable,baseRefName",
     ],
     repoDir,
     15000
@@ -118,6 +119,7 @@ export async function toTaskPR(repoDir: string, pr: ListedPR): Promise<TaskPR> {
       pr.body === undefined ? undefined : (attributionIn(pr.body) ?? null),
     scopeChange: parseScopeChange(pr.body),
     ...(pr.mergeable && { mergeable: pr.mergeable }),
+    ...(pr.baseRefName && { base: pr.baseRefName }),
   };
 }