@saadnvd1/agent-os 0.3.477 → 0.3.479

package/lib/orchestrator/git-guard.ts

@@ -0,0 +1,201 @@
+/**
+ * The shell commands an orchestrator may run, read before the shell sees
+ * them. Its permissions allow `aos` commands and `git`; this makes sure each
+ * is one plain command (no `;`, `&&`, pipes, redirects, substitutions or
+ * globs a shell would act on), and that a git command works only in one of
+ * its own quick changes' worktrees (`-C <path>`), does nothing that runs
+ * other code or writes outside it, and never pushes: quick_pr pushes, and
+ * never to the default branch.
+ */
+
+// What git may do in a quick worktree: look, stage, undo. Committing is
+// quick_pr's alone: it runs with hooks off, where a shell commit would run
+// whatever the project (or the orchestrator's own edit) put in its hooks.
+const GIT_ALLOWED = new Set([
+  "status",
+  "diff",
+  "log",
+  "show",
+  "add",
+  "rm",
+  "restore",
+  "reset",
+  "rev-parse",
+  "ls-files",
+]);
+
+// Git config can run programs (core.fsmonitor, diff.external, filter and
+// textconv drivers), so git runs only at the worktree's own root, where it
+// finds the real git dir, never in a folder holding a repository the
+// orchestrator wrote (the write guard refuses HEAD, .git/ and .gitattributes
+// inside quick worktrees). A .gitattributes already committed can name a
+// driver, but a driver's command lives in config, which only a repository
+// the orchestrator can't write defines.
+export const GIT_LAYOUT_FILE =
+  /(^|\/)(HEAD|\.gitattributes)$|(^|\/)\.git(\/|$)/i;
+
+// `aos` commands carry free text (notify, send): only what a shell would
+// chain, redirect or substitute is refused, not ? ! # * or a plain $.
+export function aosRefusal(command: string): string | null {
+  const bad =
+    "use one plain aos command: no ;, &&, pipes, redirects, backticks or $( ) outside single quotes";
+  let q: string | null = null;
+  for (let i = 0; i < command.length; i++) {
+    const c = command[i];
+    if (q === "'") {
+      if (c === "'") q = null;
+      continue;
+    }
+    if (c === "\\") {
+      // zsh deletes a backslash-newline before it parses, joining $ to what
+      // follows; and its ${(e)...} evaluates what an escaped \$ or \` left.
+      const n = command[i + 1] ?? "";
+      if (/[\n\r]/.test(n) || (q === '"' && /[$`]/.test(n)))
+        return `Refused: ${bad}.`;
+      i++;
+      continue;
+    }
+    if (c === "`") return `Refused: ${bad}.`;
+    // After a $ only a plain variable name (or $?, $#, $@, $*, $-, a digit)
+    // or a literal $ may follow: ${..}, $[..], $'..' and the like evaluate
+    // or quote differently in the shell than here.
+    if (c === "$") {
+      const n = command[i + 1] ?? "";
+      if (!/^[\sA-Za-z0-9_?#@*-]?$/.test(n) && !(q === '"' && n === '"'))
+        return `Refused: ${bad}.`;
+    }
+    if (q === '"') {
+      if (c === '"') q = null;
+      continue;
+    }
+    if (c === "'" || c === '"') q = c;
+    else if (/[;&|<>()\n\r]/.test(c)) return `Refused: ${bad}.`;
+  }
+  return q ? "Refused: an unclosed quote." : null;
+}
+
+// Options that write a file somewhere else, read a command to run, or read
+// outside the repository. Git accepts any unique prefix of a long option
+// (--ext-di, --textc), so this refuses the prefixes, not the spellings.
+const GIT_REFUSED_ARG = /^--(ou|ex|te|no-i)/;
+
+// A shell word, with its quotes taken off, or why the command isn't one
+// plain command.
+export function shellWords(command: string): string[] | string {
+  const words: string[] = [];
+  let word: string | null = null;
+  const plain =
+    "use one plain command: no ;, &&, ||, pipes, redirects, $, backticks, globs or comments outside quotes (quote anything with those)";
+  for (let i = 0; i < command.length; i++) {
+    const c = command[i];
+    if (c === " " || c === "\t") {
+      if (word !== null) words.push(word);
+      word = null;
+      continue;
+    }
+    if (c === "'") {
+      const end = command.indexOf("'", i + 1);
+      if (end < 0) return "an unclosed ' quote";
+      word = (word ?? "") + command.slice(i + 1, end);
+      i = end;
+      continue;
+    }
+    if (c === '"') {
+      let text = "";
+      let j = i + 1;
+      for (; j < command.length && command[j] !== '"'; j++) {
+        const d = command[j];
+        if (d === "$" || d === "`") return plain;
+        if (d === "\\" && j + 1 < command.length) {
+          const n = command[++j];
+          text += /["\\$`\n]/.test(n) ? n : `\\${n}`;
+          continue;
+        }
+        text += d;
+      }
+      if (j >= command.length) return 'an unclosed " quote';
+      word = (word ?? "") + text;
+      i = j;
+      continue;
+    }
+    if (c === "\\") {
+      if (i + 1 >= command.length || command[i + 1] === "\n") return plain;
+      word = (word ?? "") + command[++i];
+      continue;
+    }
+    if (/[;&|<>()$`\n\r*?[\]{}!#]/.test(c)) return plain;
+    // zsh expands a word starting with = or ~name; only ~ and ~/ are read
+    // (as the home folder), by the caller.
+    if (word === null && c === "=") return plain;
+    if (word === null && c === "~" && !/^~($|[\s/])/.test(command.slice(i)))
+      return plain;
+    word = (word ?? "") + c;
+  }
+  if (word !== null) words.push(word);
+  return words;
+}
+
+export type GitCommand =
+  | { refusal: string }
+  | { refusal: null; dir: string | null; sub: string | null };
+
+// A shell command read for the guard: why it's refused outright, or, for a
+// git command, the folder it runs in (from -C) to check against its quick
+// worktrees. `dir` and `sub` are null for a command that isn't git.
+export function readCommand(command: unknown): GitCommand {
+  if (typeof command !== "string" || !command.trim())
+    return { refusal: "No command to check." };
+  if (/^aos(\s|$)/.test(command.trim())) {
+    const refusal = aosRefusal(command.trim());
+    return refusal ? { refusal } : { refusal: null, dir: null, sub: null };
+  }
+  const words = shellWords(command.trim());
+  if (typeof words === "string") return { refusal: `Refused: ${words}.` };
+  if (words[0] !== "git") {
+    // `VAR=value git …` sets an environment variable the shell would act on
+    // (GIT_DIR, GIT_INDEX_FILE, GIT_WORK_TREE), which can redirect git
+    // outside its quick worktree.
+    if (words[0].includes("="))
+      return {
+        refusal:
+          "Refused: no inline VAR=value before a command; environment variables can point git outside your worktree.",
+      };
+    return { refusal: null, dir: null, sub: null };
+  }
+  const usage =
+    "git runs only in one of your quick changes' worktrees, as `git -C <its path> <command>`";
+  let dir: string | null = null;
+  let i = 1;
+  for (; i < words.length; i++) {
+    const w = words[i];
+    if (w === "-C") {
+      if (dir !== null || i + 1 >= words.length)
+        return { refusal: `Refused: ${usage}, with one -C.` };
+      dir = words[++i];
+      continue;
+    }
+    if (w === "--no-pager" || w === "--no-optional-locks") continue;
+    if (w.startsWith("-"))
+      return {
+        refusal: `Refused: git's ${w} option isn't allowed here; ${usage}.`,
+      };
+    break;
+  }
+  if (dir === null) return { refusal: `Refused: ${usage}.` };
+  const sub = words[i] ?? null;
+  if (sub === "push")
+    return {
+      refusal:
+        "Refused: quick_pr pushes a quick change's branch and opens its PR; nothing pushes from the shell, and nothing ever pushes to the default branch.",
+    };
+  if (!sub || !GIT_ALLOWED.has(sub))
+    return {
+      refusal: `Refused: git ${sub ?? ""} isn't allowed here. In a quick worktree git may only ${[...GIT_ALLOWED].join(", ")}; quick_pr commits, pushes and opens the PR.`,
+    };
+  const bad = words.slice(i + 1).find((w) => GIT_REFUSED_ARG.test(w));
+  if (bad)
+    return {
+      refusal: `Refused: git's ${bad} option writes or runs something outside the worktree.`,
+    };
+  return { refusal: null, dir, sub };
+}

package/lib/orchestrator/pr-wake.ts

@@ -146,7 +146,15 @@ export async function wakeTasks(
     const pr = f.task?.pr;
     const task = pr?.state === "OPEN" && pr.head ? sessionRow(f.id) : null;
     const repo = pr && repoOfPR(pr.url);
-    if (!task || task.task_status !== "running" || !repo || !pr?.head) {
+    // A quick change has no agent to wake: its PR's events reach the
+    // orchestrator that made it, as any task's do.
+    if (
+      !task ||
+      task.task_status !== "running" ||
+      task.quick_of ||
+      !repo ||
+      !pr?.head
+    ) {
       handled.delete(f.id);
       continue;
     }

package/lib/orchestrator/quick-store.ts

@@ -0,0 +1,18 @@
+// The worktrees of an orchestrator's open quick changes, which its write
+// guard lets it edit (quick.ts). Only running ones: a finished or dropped
+// quick change's folder is gone, or about to be.
+
+import { db } from "../db";
+import { expandHome } from "../tasks/session";
+
+export function quickWorktrees(orchestratorId: string): string[] {
+  return (
+    db
+      .prepare(
+        `SELECT worktree_path AS dir FROM sessions
+          WHERE quick_of = ? AND task_status = 'running'
+            AND worktree_path IS NOT NULL AND worktree_path != ''`
+      )
+      .all(orchestratorId) as { dir: string }[]
+  ).map((r) => expandHome(r.dir));
+}

package/lib/orchestrator/quick.ts

@@ -0,0 +1,307 @@
+/**
+ * Quick changes: an edit too small for a task (a typo, a config value, a
+ * one-file fix) made by the orchestrator itself. quick_change cuts a
+ * worktree and branch from the project's default branch, as a task row
+ * with no agent (`quick_of` names the orchestrator that owns it); its write
+ * guard lets it edit there and nowhere else in a project. quick_pr commits,
+ * pushes that branch (never the default one) and opens the PR, which then
+ * goes through the same gates as any task's. With no task agent to run
+ * /do-code-review, the code-review gate of a PR AgentOS recorded as opened
+ * by quick_pr is the independent review of its exact head, never anything
+ * its body says. Signed off, dropped or done, it's cleaned up like a task.
+ */
+
+import { randomUUID } from "crypto";
+import fs from "fs";
+import { db, queries, type Session } from "../db";
+import { getDefaultBranch, slugify } from "../git";
+import { currentBranch, git, revParse } from "../git-exec";
+import { isRemoteHost } from "../hosts";
+import { createWorktree, deleteWorktree } from "../worktrees";
+import { PROTECTED_BRANCHES } from "../tasks/finish";
+import { run } from "../tasks/gh";
+import { ATTRIBUTION, renderedLines } from "../tasks/code-review";
+import { expandHome, forgetPR, prFor, projectPathFor } from "../tasks/session";
+import { inBackground } from "../lumifyhub/task-cards";
+import type { CheckRow } from "./checks";
+import { getOrchestrator } from "./home";
+import { addNote } from "./notes";
+import { quickWorktrees } from "./quick-store";
+import { findWorkspaceSession } from "./read";
+import { workspaceProject } from "./targets";
+
+// Open quick changes one orchestrator may hold at once.
+export const MAX_OPEN_QUICK = 5;
+
+// Git with no hooks: a hook is a script in the project (or one it calls,
+// like node_modules/.bin), which the orchestrator could have edited, so a
+// commit or push it makes runs none.
+const NO_HOOKS = ["-c", "core.hooksPath=/dev/null"];
+
+const short = (sha: string) => sha.slice(0, 7);
+
+export const isQuick = (s: Pick<Session, "quick_of">) => !!s.quick_of;
+
+function ownerOf(workspaceId: string): Session {
+  const o = getOrchestrator(workspaceId);
+  if (!o) throw new Error("This workspace has no orchestrator yet");
+  return o;
+}
+
+export async function quickChange(
+  workspaceId: string,
+  projectRef: string,
+  name: string
+): Promise<string> {
+  const owner = ownerOf(workspaceId);
+  const project = workspaceProject(workspaceId, projectRef);
+  if (isRemoteHost(project.host_id))
+    throw new Error(
+      `${project.name} runs on another machine; quick changes are made on this one only`
+    );
+  const open = quickWorktrees(owner.id);
+  if (open.length >= MAX_OPEN_QUICK)
+    throw new Error(
+      `You have ${open.length} quick changes open (${MAX_OPEN_QUICK} at most): finish one with quick_pr, or drop it, first`
+    );
+  const label = name.trim();
+  const id = randomUUID();
+  const projectPath = expandHome(project.working_directory);
+  const feature = `quick-${slugify(label.split(/\s+/).slice(0, 6).join(" "))}-${id.slice(0, 4)}`;
+  const baseBranch = await getDefaultBranch(projectPath);
+  const wt = await createWorktree({
+    projectPath,
+    featureName: feature,
+    baseBranch,
+  });
+  try {
+    db.transaction(() => {
+      queries
+        .createSession(db)
+        .run(
+          id,
+          label,
+          `quick-${id}`,
+          wt.worktreePath,
+          null,
+          project.default_model,
+          null,
+          "sessions",
+          "claude",
+          0,
+          project.id,
+          "local"
+        );
+      queries
+        .updateSessionWorktree(db)
+        .run(wt.worktreePath, wt.branchName, baseBranch, null, id);
+      db.prepare(
+        `UPDATE sessions SET task_prompt = ?, task_status = 'running', name_source = 'user', view = 'chat', quick_of = ? WHERE id = ?`
+      ).run(`Quick change: ${label}`, owner.id, id);
+    })();
+  } catch (e) {
+    await deleteWorktree(wt.worktreePath, projectPath, true).catch(() => {});
+    throw e;
+  }
+  addNote(
+    workspaceId,
+    `Quick change "${label}" in ${project.name} on ${wt.branchName}.`
+  );
+  return `Quick change "${label}" (id ${id.slice(0, 8)}) in ${project.name}: worktree ${wt.worktreePath} on ${wt.branchName}, cut from ${baseBranch}. Edit files there with Write and Edit; git there only as \`git -C ${wt.worktreePath} <status|diff|add|...>\`. Then quick_pr commits, pushes and opens its PR.`;
+}
+
+// A quick change of this workspace's orchestrator, by name, id or PR.
+export function workspaceQuick(workspaceId: string, ref: string): Session {
+  const owner = ownerOf(workspaceId);
+  const s = findWorkspaceSession(workspaceId, ref);
+  if (s.quick_of !== owner.id)
+    throw new Error(
+      `${s.name} isn't one of your quick changes; a task's own agent opens its PR`
+    );
+  if (s.task_status !== "running")
+    throw new Error(`${s.name} is already ${s.task_status}`);
+  return s;
+}
+
+// Why a branch may never be pushed by quick_pr, or null.
+export function pushRefusal(
+  branch: string | null,
+  defaultBranch: string,
+  base: string | null
+): string | null {
+  if (!branch) return "it has no branch";
+  if (
+    branch === defaultBranch ||
+    branch === base ||
+    PROTECTED_BRANCHES.has(branch)
+  )
+    return `its branch is ${branch}, the default branch; quick_pr never pushes to it`;
+  return null;
+}
+
+const attributed = (text: string) =>
+  renderedLines(text).some((l) => ATTRIBUTION.test(l.trimStart()));
+
+export async function quickPR(
+  workspaceId: string,
+  ref: string,
+  title: string,
+  body: string
+): Promise<{ id: string; text: string }> {
+  const s = workspaceQuick(workspaceId, ref);
+  const repo = projectPathFor(s);
+  const wt = s.worktree_path ? expandHome(s.worktree_path) : null;
+  if (!repo || !wt || !fs.existsSync(wt))
+    throw new Error(`${s.name}'s worktree is gone; drop it`);
+  if (attributed(title) || attributed(body))
+    throw new Error("Take the AI attribution out of the title and body");
+  const branch = s.branch_name;
+  const refusal = pushRefusal(
+    branch,
+    await getDefaultBranch(repo),
+    s.base_branch
+  );
+  if (refusal) throw new Error(`Refused: ${refusal}.`);
+  const on = await currentBranch(wt);
+  if (on !== branch)
+    throw new Error(
+      `Refused: ${s.name}'s worktree is on ${on || "a detached HEAD"}, not its branch ${branch}`
+    );
+  await git(wt, [...NO_HOOKS, "add", "-A"]);
+  const staged = await git(wt, ["diff", "--cached", "--name-only"]);
+  if (staged.trim())
+    await git(wt, [...NO_HOOKS, "commit", "-q", "-m", title.trim()]);
+  const ahead = (
+    await git(wt, [
+      "rev-list",
+      "--count",
+      `refs/remotes/origin/${s.base_branch}..HEAD`,
+    ]).catch(() => git(wt, ["rev-list", "--count", `${s.base_branch}..HEAD`]))
+  ).trim();
+  if (ahead === "0")
+    throw new Error(`${s.name} has nothing to commit: edit its worktree first`);
+  // The branch by its full name on both sides, so nothing but it moves.
+  await git(
+    wt,
+    [
+      ...NO_HOOKS,
+      "push",
+      "--quiet",
+      "-u",
+      "origin",
+      `refs/heads/${branch}:refs/heads/${branch}`,
+    ],
+    { timeout: 60_000 }
+  );
+  const head = (await revParse(wt, "HEAD")).trim();
+  const goal = `${title.trim()}\n\n${body.trim()}`;
+  db.prepare(`UPDATE sessions SET task_prompt = ? WHERE id = ?`).run(
+    goal,
+    s.id
+  );
+  const existing = await prFor(s, true);
+  if (existing?.state === "OPEN") {
+    forgetPR(s.id);
+    return {
+      id: s.id,
+      text: `Pushed ${short(head)} to ${s.name}'s PR #${existing.number} (${existing.url}).`,
+    };
+  }
+  const out = await run(
+    "gh",
+    [
+      "pr",
+      "create",
+      "--base",
+      s.base_branch!,
+      "--head",
+      branch!,
+      "--title",
+      title.trim(),
+      "--body",
+      body.trim(),
+    ],
+    wt,
+    60_000
+  );
+  const m = /https:\/\/\S+\/pull\/(\d+)/.exec(out);
+  if (m) queries.updateSessionPR(db).run(m[0], Number(m[1]), "open", s.id);
+  forgetPR(s.id);
+  addNote(
+    workspaceId,
+    `Quick change "${s.name}" opened ${m ? `PR #${m[1]}` : "its PR"} at ${short(head)}.`
+  );
+  return {
+    id: s.id,
+    text: `Opened ${m ? `PR #${m[1]} (${m[0]})` : "the PR"} for quick change "${s.name}" at ${short(head)}. It merges only through the gates, like a task's: CI, the independent review of its exact head (which is also its code-review gate, since no task agent ran /do-code-review), scope, then sign_off or arm.`,
+  };
+}
+
+const QUICK_FIX =
+  "for a quick change, the independent review of its exact head is its code review";
+
+// The code-review gate of a PR quick_pr opened (the row's quick_of, never
+// its body): the independent review of this exact head. Until it passes the
+// quick change waits, before any other gate is judged or counted: a CI that
+// wants a Code review section in the body fails until AgentOS writes one
+// after the review (noteQuickReview). A blocking review counts once, as the
+// review gate's failure, when its verdict arrives.
+export function quickCodeReview(
+  sha: string,
+  review: CheckRow | null,
+  rebased = false
+): { refusal: null; wait: string | null } {
+  if (review?.sha === sha && review.status === "pass")
+    return { refusal: null, wait: null };
+  const why =
+    review?.sha !== sha
+      ? rebased
+        ? `a rebase moved the branch to ${short(sha)}, so it needs a fresh independent review: call review`
+        : `no independent review of ${short(sha)} yet: call review`
+      : review.status === "running"
+        ? `the review of ${short(sha)} is still running`
+        : review.status === "block"
+          ? `the review of ${short(sha)} has blocking findings`
+          : `the review of ${short(sha)} couldn't run: call review with fresh`;
+  return { refusal: null, wait: `${why} (${QUICK_FIX})` };
+}
+
+// A PR body section for a repository whose CI wants one (this repo's
+// code-review workflow): written by AgentOS after the independent review
+// of the head passed, never by the orchestrator. The gate doesn't read it.
+const MARK = "<!-- agentos:quick-review -->";
+
+export function withQuickReview(body: string, sha: string): string {
+  const at = body.indexOf(MARK);
+  const kept = (at < 0 ? body : body.slice(0, at)).trimEnd();
+  return `${kept}\n\n${MARK}\n## Code review\nReviewed: ${sha}\nAgents: AgentOS's independent review of this exact commit (a quick change, with no task agent to run /do-code-review)\nFixed: none\nDeferred: none\n`;
+}
+
+export function noteQuickReview(reviewed: Session, sha: string): void {
+  if (!isQuick(reviewed)) return;
+  const task = queries.getSession(db).get(reviewed.id) as Session | undefined;
+  if (!task || task.task_status !== "running" || !task.pr_number) return;
+  const repo = projectPathFor(task);
+  if (!repo) return;
+  inBackground(`code review section on quick change ${task.id}`, async () => {
+    const pr = await prFor(task, true);
+    if (!pr || pr.state !== "OPEN" || pr.head !== sha) return;
+    const body = await run(
+      "gh",
+      ["pr", "view", String(pr.number), "--json", "body", "--jq", ".body"],
+      repo
+    );
+    await run(
+      "gh",
+      [
+        "pr",
+        "edit",
+        String(pr.number),
+        "--body",
+        withQuickReview(body.trimEnd(), sha),
+      ],
+      repo
+    );
+    forgetPR(task.id);
+  });
+}

package/lib/orchestrator/rebase.ts

@@ -241,7 +241,7 @@ async function rebaseOne(
     (await deps.idle(task)) &&
     !(await local()) &&
     (await catchUp(git, wt, task.branch_name!, pr.head, to));
-  if (!follows)
+  if (!follows && !task.quick_of)
     await deps.send(
       task.id,
       `AgentOS rebased your branch ${task.branch_name} onto ${branch} on origin (now ${short(to)}), because PR #${pr.number} conflicted with it. Your worktree is still on the old head: before changing anything, run \`git fetch origin && git reset --keep origin/${task.branch_name}\` (commit your work first). Its review carries over when its own patch didn't change.`
@@ -381,6 +381,16 @@ async function askToRebase(
     pr.head,
     task.id
   );
+  // A quick change has no agent to ask: it's the orchestrator's to redo.
+  if (task.quick_of) {
+    queueEvent(
+      workspaceId,
+      `conflict:${task.id}:${pr.head}`,
+      task.id,
+      `quick change ${task.name}: PR #${pr.number} conflicts with ${base} and can't be rebased automatically (${why.slice(0, 300)}). Drop it and make the change again in a new quick change.`
+    );
+    return;
+  }
   queueEvent(
     workspaceId,
     `conflict:${task.id}:${pr.head}`,

package/lib/orchestrator/review.ts

@@ -43,6 +43,7 @@ import {
   checkRunTotals,
   describeCheckRuns,
 } from "../usage/check-runs";
+import { noteQuickReview } from "./quick";
 import { workspaceTask } from "./targets";
 import { untrusted } from "./untrusted";
 
@@ -272,6 +273,8 @@ export async function reviewAt(
       })
     )
     .then((done) => {
+      if (done.status === "pass" && target.task)
+        noteQuickReview(target.task, sha);
       const said =
         done.status === "pass"
           ? "passed"

package/lib/orchestrator/serve.ts

@@ -26,6 +26,8 @@ import { readSession } from "./read";
 import { reviewTarget, signOffTarget } from "./external-gates";
 import { land } from "./signoff";
 import { arm, disarm } from "./armed";
+import { quickChange, quickPR } from "./quick";
+import { review } from "./review";
 import { parseArgs as p, type ToolName } from "./tool-schemas";
 
 export { isToolName, TOOLS, type ToolName } from "./tool-schemas";
@@ -37,6 +39,8 @@ const ACTING = new Set<ToolName>([
   "start_task",
   "set_task_model",
   "start_session",
+  "quick_change",
+  "quick_pr",
   "stack",
   "land",
   "drop",
@@ -119,6 +123,19 @@ export async function runTool(
         view: a.view,
       });
     }
+    case "quick_change": {
+      const a = p(tool, raw);
+      return quickChange(w, a.project, a.name);
+    }
+    case "quick_pr": {
+      const a = p(tool, raw);
+      const opened = await quickPR(w, a.change, a.title, a.body);
+      // Its code-review gate is this review: it starts at once.
+      const reviewing = await review(w, opened.id).catch(
+        (e: Error) => `Its review couldn't start (${e.message}): call review.`
+      );
+      return `${opened.text}\n${reviewing}`;
+    }
     case "stack": {
       const a = p(tool, raw);
       return stack(w, a.target, a.plan_only);

package/lib/orchestrator/signoff.ts

@@ -15,6 +15,7 @@ import { getStack, landInBackground } from "../stacks";
 import { LAND_DEFAULTS } from "../stacks/land";
 import { db, stackQueries, type Session } from "../db";
 import { getCheck } from "./checks";
+import { isQuick, quickCodeReview } from "./quick";
 import {
   addedLines,
   changedFiles,
@@ -82,6 +83,22 @@ export async function judge(
     };
   const sha = pr.head;
   const repo = repoOf(task);
+  // A PR quick_pr opened (by the row AgentOS wrote, never the body): its
+  // code review is the independent review of this head, and until that
+  // passes it waits, before any gate is judged or counted.
+  const quick = isQuick(task)
+    ? quickCodeReview(
+        sha,
+        getCheck(task.id, sha, "review"),
+        restackedOf(task)?.to === sha
+      )
+    : null;
+  if (quick?.wait)
+    return {
+      ok: false,
+      wait: true,
+      text: `${task.name} (PR #${pr.number} at ${short(sha)}) can't merge yet: ${quick.wait}`,
+    };
   return gateVerdict(
     workspaceId,
     { id: task.id, name: task.name, repo, refs: task, pr, sha },
@@ -100,12 +117,17 @@ export async function judge(
       fromCard: !!task.lh_card_id,
       scope: getCheck(task.id, sha, "scope"),
       stackRefusal: landing ? null : signOffRefusal(task.id),
-      codeReview: codeReviewGate({
-        head: sha,
-        attribution: pr.attribution,
-        review: (at) => getCheck(task.id, at, "review"),
-        restacked: restackedOf(task),
-      }),
+      codeReview: (() => {
+        const gate = codeReviewGate({
+          head: sha,
+          attribution: pr.attribution,
+          review: (at) => getCheck(task.id, at, "review"),
+          restacked: restackedOf(task),
+        });
+        // A quick change keeps the body checks (attribution, unreadable);
+        // its wait on the review was judged above.
+        return quick ? { refusal: gate.refusal, wait: null } : gate;
+      })(),
     }),
     opts
   );