@fitlab-ai/agent-infra 0.7.1 → 0.7.3

package/templates/.agents/skills/cancel-task/SKILL.zh-CN.md

@@ -15,7 +15,7 @@ description: "取消不再需要的任务并转移"
 
 ## 任务入参短号别名
 
-> 如果 `{task-id}` 入参以 `#` 开头，先读取 `.agents/rules/task-short-id.md` 的「SKILL 入参解析」段执行解析；后续命令视 `{task-id}` 为解析后的全长 `TASK-YYYYMMDD-HHMMSS` 形式。
+> 如果 `{task-id}` 入参匹配 `^[#]?[0-9]+$`（裸数字或带 `#` 前缀），先读取 `.agents/rules/task-short-id.md` 的「SKILL 入参解析」段执行解析；后续命令视 `{task-id}` 为解析后的全长 `TASK-YYYYMMDD-HHMMSS` 形式。
 
 ## 执行步骤
 ### 1. 验证任务存在
@@ -56,7 +56,7 @@ date "+%Y-%m-%d %H:%M:%S%:z"
 - `agent_infra_version`：按 `.agents/rules/version-stamp.md` 取值
 - **追加**到 `## Activity Log`（不要覆盖之前记录）：
   ```
-  - {YYYY-MM-DD HH:mm:ss±HH:MM} — **Cancelled** by {agent} — {一行取消原因}
+  - {YYYY-MM-DD HH:mm:ss±HH:MM} — **Cancel Task** by {agent} — {一行取消原因}
   ```
 
 ### 4. 转移任务
@@ -118,7 +118,9 @@ node .agents/scripts/validate-artifact.js gate cancel-task .agents/workspace/com
 
 > 仅在校验通过后执行本步骤。
 
-> **重要**：以下「下一步」中列出的所有 TUI 命令格式必须完整输出，不要只展示当前 AI 代理对应的格式。如果 `.agents/.airc.json` 中配置了自定义 TUI（`customTUIs`），读取每个工具的 `name` 和 `invoke`，按同样格式补充对应命令行（`${skillName}` 替换为技能名，`${projectName}` 替换为项目名）。
+> **重要**：以下「下一步」中列出的所有 TUI 命令格式必须完整输出，不要只展示当前 AI 代理对应的格式。如果 `.agents/.airc.json` 中配置了自定义 TUI（`customTUIs`），读取每个工具的 `name` 和 `invoke`，按同样格式补充对应命令行（`${skillName}` 替换为技能名，`${projectName}` 替换为项目名）。 渲染最终输出前，先读取 `.agents/rules/next-step-output.md` 并落实其两类规则：(1) 「下一步」命令把 `{task-ref}` 渲染为短号 `#NN`（未分配/已释放时回退完整 TASK-id）；(2) 在面向用户输出的绝对最后一行追加 `Completed at` 收尾行（成功、错误、早退等任何面向用户输出都适用，不限于校验通过的成功态）。
+
+> **可选沙箱清理提示（门控渲染）**：仅当同时满足 (1) `.agents/.airc.json` 存在 `sandbox` 字段、(2) task.md 的 `branch` 字段存在且不是 `main` / `master` 时，才渲染下方输出中「目标路径」之后、「下一步」之前的「可选：清理本任务的沙箱」块；任一不满足则整段省略。`{branch}` 取已读入的 task.md 的 `branch` 值（任务此时已移动到 completed/，从 `.agents/workspace/completed/{task-id}/task.md` 读取）。该块独立于「下一步」语义。
 
 输出格式：
 ```
@@ -128,10 +130,15 @@ node .agents/scripts/validate-artifact.js gate cancel-task .agents/workspace/com
 状态标签：{status-label 或 skipped}
 目标路径：.agents/workspace/completed/{task-id}/
 
+可选：清理本任务的沙箱
+（任务已归档，沙箱容器和 per-branch 配置目录不会自动回收。如果不再需要可执行：）
+
+ai sandbox rm {branch}
+
 下一步 - 查看已转移任务：
-  - Claude Code / OpenCode：/check-task {task-id}
-  - Gemini CLI：/{{project}}:check-task {task-id}
-  - Codex CLI：$check-task {task-id}
+  - Claude Code / OpenCode：/check-task {task-ref}
+  - Gemini CLI：/{{project}}:check-task {task-ref}
+  - Codex CLI：$check-task {task-ref}
 ```
 
 

package/templates/.agents/skills/cancel-task/config/verify.json

@@ -19,7 +19,7 @@
       "require_cancelled_at": true
     },
     "activity-log": {
-      "expected_action_pattern": "Cancelled",
+      "expected_action_pattern": "(Cancel Task|Cancelled)",
       "freshness_minutes": 30
     },
     "platform-sync": {

package/templates/.agents/skills/check-task/SKILL.en.md

@@ -12,7 +12,7 @@ description: "Check a task's current status and progress"
 
 ## Task id short ref
 
-> If `{task-id}` begins with `#`, follow the "SKILL parameter resolver" section of `.agents/rules/task-short-id.md`; treat `{task-id}` as the resolved full `TASK-YYYYMMDD-HHMMSS` form for every downstream command.
+> If `{task-id}` matches `^[#]?[0-9]+$` (bare numeric or `#`-prefixed), follow the "SKILL parameter resolver" section of `.agents/rules/task-short-id.md`; treat `{task-id}` as the resolved full `TASK-YYYYMMDD-HHMMSS` form for every downstream command.
 
 ## Steps
 
@@ -55,7 +55,7 @@ For versioned artifacts (`analysis`, `review-analysis`, `plan`, `review-plan`, `
 Format the status report with a clear structure and status indicators:
 
 ```
-Task status: {task-id}
+Task status: {task-id} (short id {task-ref})
 =======================
 
 Basic info:
@@ -124,18 +124,20 @@ Recommend the appropriate next skill based on the current workflow state. You mu
 > - `current_step = code-review` and the latest code review artifact exists, but any `Blocker`, `Major`, or `Minor` issue remains, or the verdict is not a clean approval -> choose "Code Review Has Issues"
 >
 > **Important: if the latest review report contains any issue at all, do not use the corresponding review-passed row. Use the corresponding has-issues row instead.**
+>
+> Before rendering the final output, read `.agents/rules/next-step-output.md` and apply both of its rules: (1) render `{task-ref}` in the table commands below as the short id `#NN` (falling back to the full TASK-id when unallocated or released); (2) append the `Completed at` line as the very last line of the user-facing output (this applies to every user-facing output — success, error, and early-return paths alike, not only the success path).
 
 | Current State              | Claude Code / OpenCode                              | Gemini CLI                               | Codex CLI                                           |
 |----------------------------|-----------------------------------------------------|------------------------------------------|-----------------------------------------------------|
-| Analysis Complete          | `/review-analysis {task-id}`                        | `/{{project}}:review-analysis {task-id}` | `$review-analysis {task-id}`                        |
-| Analysis Review Passed     | `/plan-task {task-id}`                              | `/{{project}}:plan-task {task-id}`       | `$plan-task {task-id}`                              |
-| Analysis Review Has Issues | `/analyze-task {task-id}`                           | `/{{project}}:analyze-task {task-id}`    | `$analyze-task {task-id}`                           |
-| Plan Complete              | `/review-plan {task-id}`                            | `/{{project}}:review-plan {task-id}`     | `$review-plan {task-id}`                            |
-| Plan Review Passed         | `/code-task {task-id}`                              | `/{{project}}:code-task {task-id}`       | `$code-task {task-id}`                              |
-| Plan Review Has Issues     | `/plan-task {task-id}`                              | `/{{project}}:plan-task {task-id}`       | `$plan-task {task-id}`                              |
-| Code Complete              | `/review-code {task-id}`                            | `/{{project}}:review-code {task-id}`     | `$review-code {task-id}`                            |
+| Analysis Complete          | `/review-analysis {task-ref}`                        | `/{{project}}:review-analysis {task-ref}` | `$review-analysis {task-ref}`                        |
+| Analysis Review Passed     | `/plan-task {task-ref}`                              | `/{{project}}:plan-task {task-ref}`       | `$plan-task {task-ref}`                              |
+| Analysis Review Has Issues | `/analyze-task {task-ref}`                           | `/{{project}}:analyze-task {task-ref}`    | `$analyze-task {task-ref}`                           |
+| Plan Complete              | `/review-plan {task-ref}`                            | `/{{project}}:review-plan {task-ref}`     | `$review-plan {task-ref}`                            |
+| Plan Review Passed         | `/code-task {task-ref}`                              | `/{{project}}:code-task {task-ref}`       | `$code-task {task-ref}`                              |
+| Plan Review Has Issues     | `/plan-task {task-ref}`                              | `/{{project}}:plan-task {task-ref}`       | `$plan-task {task-ref}`                              |
+| Code Complete              | `/review-code {task-ref}`                            | `/{{project}}:review-code {task-ref}`     | `$review-code {task-ref}`                            |
 | Code Review Passed         | `/commit`                                           | `/{{project}}:commit`                    | `$commit`                                           |
-| Code Review Has Issues     | `/code-task {task-id}`                              | `/{{project}}:code-task {task-id}`       | `$code-task {task-id}`                              |
+| Code Review Has Issues     | `/code-task {task-ref}`                              | `/{{project}}:code-task {task-ref}`       | `$code-task {task-ref}`                              |
 | Task Blocked               | Unblock the task or provide the missing information | —                                        | Unblock the task or provide the missing information |
 | Task Completed             | No action needed                                    | —                                        | No action needed                                    |
 

package/templates/.agents/skills/check-task/SKILL.zh-CN.md

@@ -12,7 +12,7 @@ description: "查看任务的当前状态和进度"
 
 ## 任务入参短号别名
 
-> 如果 `{task-id}` 入参以 `#` 开头，先读取 `.agents/rules/task-short-id.md` 的「SKILL 入参解析」段执行解析；后续命令视 `{task-id}` 为解析后的全长 `TASK-YYYYMMDD-HHMMSS` 形式。
+> 如果 `{task-id}` 入参匹配 `^[#]?[0-9]+$`（裸数字或带 `#` 前缀），先读取 `.agents/rules/task-short-id.md` 的「SKILL 入参解析」段执行解析；后续命令视 `{task-id}` 为解析后的全长 `TASK-YYYYMMDD-HHMMSS` 形式。
 
 ## 执行步骤
 ### 1. 查找任务
@@ -54,7 +54,7 @@ description: "查看任务的当前状态和进度"
 以清晰的结构和状态指示器格式化输出：
 
 ```
-任务状态：{task-id}
+任务状态：{task-id}（短号 {task-ref}）
 =======================
 
 基本信息：
@@ -123,18 +123,20 @@ description: "查看任务的当前状态和进度"
 > - `current_step = code-review` 且最新代码审查产物存在，但仍有任何 `Blocker`、`Major` 或 `Minor` 问题，或结论不是无问题通过 → 选择「代码审查有问题」
 >
 > **特别注意：只要最新审查报告中存在任何问题，就不能使用对应「审查通过」行。必须改用对应「审查有问题」行。**
+>
+> 渲染最终输出前先读取 `.agents/rules/next-step-output.md` 并落实其两类规则：(1) 下方表格中命令的 `{task-ref}` 渲染为短号 `#NN`（未分配/已释放时回退完整 TASK-id）；(2) 在面向用户输出的绝对最后一行追加 `Completed at` 收尾行（成功、错误、早退等任何面向用户输出都适用，不限于校验通过的成功态）。
 
 | 当前状态           | Claude Code / OpenCode       | Gemini CLI                               | Codex CLI                    |
 |--------------------|------------------------------|------------------------------------------|------------------------------|
-| 分析完成           | `/review-analysis {task-id}` | `/agent-infra:review-analysis {task-id}` | `$review-analysis {task-id}` |
-| 需求分析审查通过   | `/plan-task {task-id}`       | `/agent-infra:plan-task {task-id}`       | `$plan-task {task-id}`       |
-| 需求分析审查有问题 | `/analyze-task {task-id}`    | `/agent-infra:analyze-task {task-id}`    | `$analyze-task {task-id}`    |
-| 计划完成           | `/review-plan {task-id}`     | `/agent-infra:review-plan {task-id}`     | `$review-plan {task-id}`     |
-| 技术方案审查通过   | `/code-task {task-id}`       | `/agent-infra:code-task {task-id}`       | `$code-task {task-id}`       |
-| 技术方案审查有问题 | `/plan-task {task-id}`       | `/agent-infra:plan-task {task-id}`       | `$plan-task {task-id}`       |
-| 实现完成           | `/review-code {task-id}`     | `/agent-infra:review-code {task-id}`     | `$review-code {task-id}`     |
+| 分析完成           | `/review-analysis {task-ref}` | `/agent-infra:review-analysis {task-ref}` | `$review-analysis {task-ref}` |
+| 需求分析审查通过   | `/plan-task {task-ref}`       | `/agent-infra:plan-task {task-ref}`       | `$plan-task {task-ref}`       |
+| 需求分析审查有问题 | `/analyze-task {task-ref}`    | `/agent-infra:analyze-task {task-ref}`    | `$analyze-task {task-ref}`    |
+| 计划完成           | `/review-plan {task-ref}`     | `/agent-infra:review-plan {task-ref}`     | `$review-plan {task-ref}`     |
+| 技术方案审查通过   | `/code-task {task-ref}`       | `/agent-infra:code-task {task-ref}`       | `$code-task {task-ref}`       |
+| 技术方案审查有问题 | `/plan-task {task-ref}`       | `/agent-infra:plan-task {task-ref}`       | `$plan-task {task-ref}`       |
+| 实现完成           | `/review-code {task-ref}`     | `/agent-infra:review-code {task-ref}`     | `$review-code {task-ref}`     |
 | 代码审查通过       | `/commit`                    | `/agent-infra:commit`                    | `$commit`                    |
-| 代码审查有问题     | `/code-task {task-id}`       | `/agent-infra:code-task {task-id}`       | `$code-task {task-id}`       |
+| 代码审查有问题     | `/code-task {task-ref}`       | `/agent-infra:code-task {task-ref}`       | `$code-task {task-ref}`       |
 | 任务被阻塞         | 解除阻塞或提供所需信息       | —                                        | 解除阻塞或提供所需信息       |
 | 任务已完成         | 无需操作                     | —                                        | 无需操作                     |
 

package/templates/.agents/skills/close-codescan/SKILL.en.md

@@ -9,7 +9,7 @@ Dismiss the specified Code Scanning (CodeQL) alert and record a justified reason
 
 ## Task id short ref
 
-> If `{task-id}` begins with `#`, follow the "SKILL parameter resolver" section of `.agents/rules/task-short-id.md`; treat `{task-id}` as the resolved full `TASK-YYYYMMDD-HHMMSS` form for every downstream command.
+> If `{task-id}` matches `^[#]?[0-9]+$` (bare numeric or `#`-prefixed), follow the "SKILL parameter resolver" section of `.agents/rules/task-short-id.md`; treat `{task-id}` as the resolved full `TASK-YYYYMMDD-HHMMSS` form for every downstream command.
 
 ## Execution Flow
 
@@ -82,7 +82,7 @@ date "+%Y-%m-%d %H:%M:%S%:z"
 - Add the dismissal record to task.md
 - **Append** to `## Activity Log` (do NOT overwrite previous entries):
   ```
-  - {YYYY-MM-DD HH:mm:ss±HH:MM} — **Alert Closed** by {agent} — Code Scanning alert #{alert-number} dismissed: {reason}
+  - {YYYY-MM-DD HH:mm:ss±HH:MM} — **Close Codescan** by {agent} — Code Scanning alert #{alert-number} dismissed: {reason}
   ```
 - Archive the task
 - **Release short id** (after the archive `mv` succeeded; the script is idempotent):
@@ -93,7 +93,9 @@ date "+%Y-%m-%d %H:%M:%S%:z"
 
 ### 8. Inform User
 
-> **IMPORTANT**: All TUI command formats listed below must be output in full. Do not show only the format for the current AI agent. If `.agents/.airc.json` configures custom TUIs (via `customTUIs`), read each tool's `name` and `invoke`, then add the matching command line in the same format (`${skillName}` becomes the skill name and `${projectName}` becomes the project name).
+> **IMPORTANT**: All TUI command formats listed below must be output in full. Do not show only the format for the current AI agent. If `.agents/.airc.json` configures custom TUIs (via `customTUIs`), read each tool's `name` and `invoke`, then add the matching command line in the same format (`${skillName}` becomes the skill name and `${projectName}` becomes the project name). Before rendering the final output, read `.agents/rules/next-step-output.md` and apply both of its rules: (1) render `{task-ref}` in the "Next steps" commands as the short id `#NN` (falling back to the full TASK-id when unallocated or released); (2) append the `Completed at` line as the very last line of the user-facing output (this applies to every user-facing output — success, error, and early-return paths alike, not only the success path).
+
+> **Optional sandbox-cleanup hint (gated)**: Render the "Optional: clean up this task's sandbox" block — placed after the "Note:" line and before "Next step" in the output below — only when ALL of (1) `.agents/.airc.json` has a `sandbox` field, (2) step 7 located a related task by the alert number, and (3) that related task's task.md `branch` field exists and is not `main` / `master`; otherwise omit the whole block. `{branch}` is the `branch` value from the related task.md located in step 7. This block is independent of "Next step" semantics.
 
 ```
 Code Scanning alert #{alert-number} dismissed.
@@ -107,10 +109,15 @@ View: {html_url}
 
 Note: it can be reopened on the platform if necessary.
 
+Optional: clean up this task's sandbox
+(The related task's sandbox container and per-branch config directory are not reclaimed automatically. Run this if you no longer need them:)
+
+ai sandbox rm {branch}
+
 Next step - complete and archive the task if a related task exists:
-  - Claude Code / OpenCode: /complete-task {task-id}
-  - Gemini CLI: /{{project}}:complete-task {task-id}
-  - Codex CLI: $complete-task {task-id}
+  - Claude Code / OpenCode: /complete-task {task-ref}
+  - Gemini CLI: /{{project}}:complete-task {task-ref}
+  - Codex CLI: $complete-task {task-ref}
 ```
 
 ## Notes

package/templates/.agents/skills/close-codescan/SKILL.zh-CN.md

@@ -9,7 +9,7 @@ description: "关闭 Code Scanning 告警并记录理由"
 
 ## 任务入参短号别名
 
-> 如果 `{task-id}` 入参以 `#` 开头，先读取 `.agents/rules/task-short-id.md` 的「SKILL 入参解析」段执行解析；后续命令视 `{task-id}` 为解析后的全长 `TASK-YYYYMMDD-HHMMSS` 形式。
+> 如果 `{task-id}` 入参匹配 `^[#]?[0-9]+$`（裸数字或带 `#` 前缀），先读取 `.agents/rules/task-short-id.md` 的「SKILL 入参解析」段执行解析；后续命令视 `{task-id}` 为解析后的全长 `TASK-YYYYMMDD-HHMMSS` 形式。
 
 ## 执行流程
 
@@ -82,7 +82,7 @@ date "+%Y-%m-%d %H:%M:%S%:z"
 - 添加关闭记录到 task.md
 - **追加**到 `## Activity Log`（不要覆盖之前的记录）：
   ```
-  - {YYYY-MM-DD HH:mm:ss±HH:MM} — **Alert Closed** by {agent} — Code Scanning alert #{alert-number} dismissed: {reason}
+  - {YYYY-MM-DD HH:mm:ss±HH:MM} — **Close Codescan** by {agent} — Code Scanning alert #{alert-number} dismissed: {reason}
   ```
 - 归档任务
 - **释放短号**（归档目录已 mv 成功，再 release；脚本幂等）：
@@ -93,7 +93,9 @@ date "+%Y-%m-%d %H:%M:%S%:z"
 
 ### 8. 告知用户
 
-> **重要**：以下「下一步」中列出的所有 TUI 命令格式必须完整输出，不要只展示当前 AI 代理对应的格式。如果 `.agents/.airc.json` 中配置了自定义 TUI（`customTUIs`），读取每个工具的 `name` 和 `invoke`，按同样格式补充对应命令行（`${skillName}` 替换为技能名，`${projectName}` 替换为项目名）。
+> **重要**：以下「下一步」中列出的所有 TUI 命令格式必须完整输出，不要只展示当前 AI 代理对应的格式。如果 `.agents/.airc.json` 中配置了自定义 TUI（`customTUIs`），读取每个工具的 `name` 和 `invoke`，按同样格式补充对应命令行（`${skillName}` 替换为技能名，`${projectName}` 替换为项目名）。 渲染最终输出前，先读取 `.agents/rules/next-step-output.md` 并落实其两类规则：(1) 「下一步」命令把 `{task-ref}` 渲染为短号 `#NN`（未分配/已释放时回退完整 TASK-id）；(2) 在面向用户输出的绝对最后一行追加 `Completed at` 收尾行（成功、错误、早退等任何面向用户输出都适用，不限于校验通过的成功态）。
+
+> **可选沙箱清理提示（门控渲染）**：仅当同时满足 (1) `.agents/.airc.json` 存在 `sandbox` 字段、(2) 第 7 步按告警号定位到了关联任务、(3) 该关联任务 task.md 的 `branch` 字段存在且不是 `main` / `master` 时，才渲染下方输出中「注意：…」之后、「下一步」之前的「可选：清理本任务的沙箱」块；任一不满足则整段省略。`{branch}` 取第 7 步定位到的关联任务 task.md 的 `branch` 值。该块独立于「下一步」语义。
 
 ```
 Code Scanning 告警 #{alert-number} 已关闭。
@@ -107,10 +109,15 @@ Code Scanning 告警 #{alert-number} 已关闭。
 
 注意：如有需要，可在 平台上重新打开。
 
+可选：清理本任务的沙箱
+（关联任务的沙箱容器和 per-branch 配置目录不会自动回收。如果不再需要可执行：）
+
+ai sandbox rm {branch}
+
 下一步 - 完成并归档任务（如有关联任务）：
-  - Claude Code / OpenCode：/complete-task {task-id}
-  - Gemini CLI：/agent-infra:complete-task {task-id}
-  - Codex CLI：$complete-task {task-id}
+  - Claude Code / OpenCode：/complete-task {task-ref}
+  - Gemini CLI：/agent-infra:complete-task {task-ref}
+  - Codex CLI：$complete-task {task-ref}
 ```
 
 ## 注意事项

package/templates/.agents/skills/close-dependabot/SKILL.en.md

@@ -9,7 +9,7 @@ Dismiss the specified Dependabot security alert and record a justified reason.
 
 ## Task id short ref
 
-> If `{task-id}` begins with `#`, follow the "SKILL parameter resolver" section of `.agents/rules/task-short-id.md`; treat `{task-id}` as the resolved full `TASK-YYYYMMDD-HHMMSS` form for every downstream command.
+> If `{task-id}` matches `^[#]?[0-9]+$` (bare numeric or `#`-prefixed), follow the "SKILL parameter resolver" section of `.agents/rules/task-short-id.md`; treat `{task-id}` as the resolved full `TASK-YYYYMMDD-HHMMSS` form for every downstream command.
 
 ## Execution Flow
 
@@ -90,7 +90,7 @@ date "+%Y-%m-%d %H:%M:%S%:z"
 - Add the dismissal record to task.md
 - **Append** to `## Activity Log` (do NOT overwrite previous entries):
   ```
-  - {YYYY-MM-DD HH:mm:ss±HH:MM} — **Alert Closed** by {agent} — Dependabot alert #{alert-number} dismissed: {reason}
+  - {YYYY-MM-DD HH:mm:ss±HH:MM} — **Close Dependabot** by {agent} — Dependabot alert #{alert-number} dismissed: {reason}
   ```
 - Archive the task
 - **Release short id** (after the archive `mv` succeeded; the script is idempotent):
@@ -101,7 +101,9 @@ date "+%Y-%m-%d %H:%M:%S%:z"
 
 ### 8. Inform User
 
-> **IMPORTANT**: All TUI command formats listed below must be output in full. Do not show only the format for the current AI agent. If `.agents/.airc.json` configures custom TUIs (via `customTUIs`), read each tool's `name` and `invoke`, then add the matching command line in the same format (`${skillName}` becomes the skill name and `${projectName}` becomes the project name).
+> **IMPORTANT**: All TUI command formats listed below must be output in full. Do not show only the format for the current AI agent. If `.agents/.airc.json` configures custom TUIs (via `customTUIs`), read each tool's `name` and `invoke`, then add the matching command line in the same format (`${skillName}` becomes the skill name and `${projectName}` becomes the project name). Before rendering the final output, read `.agents/rules/next-step-output.md` and apply both of its rules: (1) render `{task-ref}` in the "Next steps" commands as the short id `#NN` (falling back to the full TASK-id when unallocated or released); (2) append the `Completed at` line as the very last line of the user-facing output (this applies to every user-facing output — success, error, and early-return paths alike, not only the success path).
+
+> **Optional sandbox-cleanup hint (gated)**: Render the "Optional: clean up this task's sandbox" block — placed after the "Note:" line and before "Next step" in the output below — only when ALL of (1) `.agents/.airc.json` has a `sandbox` field, (2) step 7 located a related task by the alert number, and (3) that related task's task.md `branch` field exists and is not `main` / `master`; otherwise omit the whole block. `{branch}` is the `branch` value from the related task.md located in step 7. This block is independent of "Next step" semantics.
 
 ```
 Security alert #{alert-number} dismissed.
@@ -115,10 +117,15 @@ View: {alert-url}
 
 Note: it can be reopened on the platform if necessary.
 
+Optional: clean up this task's sandbox
+(The related task's sandbox container and per-branch config directory are not reclaimed automatically. Run this if you no longer need them:)
+
+ai sandbox rm {branch}
+
 Next step - complete and archive the task if a related task exists:
-  - Claude Code / OpenCode: /complete-task {task-id}
-  - Gemini CLI: /{{project}}:complete-task {task-id}
-  - Codex CLI: $complete-task {task-id}
+  - Claude Code / OpenCode: /complete-task {task-ref}
+  - Gemini CLI: /{{project}}:complete-task {task-ref}
+  - Codex CLI: $complete-task {task-ref}
 ```
 
 ## Notes

package/templates/.agents/skills/close-dependabot/SKILL.zh-CN.md

@@ -9,7 +9,7 @@ description: "关闭 Dependabot 安全告警并记录理由"
 
 ## 任务入参短号别名
 
-> 如果 `{task-id}` 入参以 `#` 开头，先读取 `.agents/rules/task-short-id.md` 的「SKILL 入参解析」段执行解析；后续命令视 `{task-id}` 为解析后的全长 `TASK-YYYYMMDD-HHMMSS` 形式。
+> 如果 `{task-id}` 入参匹配 `^[#]?[0-9]+$`（裸数字或带 `#` 前缀），先读取 `.agents/rules/task-short-id.md` 的「SKILL 入参解析」段执行解析；后续命令视 `{task-id}` 为解析后的全长 `TASK-YYYYMMDD-HHMMSS` 形式。
 
 ## 执行流程
 
@@ -90,7 +90,7 @@ date "+%Y-%m-%d %H:%M:%S%:z"
 - 添加关闭记录到 task.md
 - **追加**到 `## Activity Log`（不要覆盖之前的记录）：
   ```
-  - {YYYY-MM-DD HH:mm:ss±HH:MM} — **Alert Closed** by {agent} — Dependabot alert #{alert-number} dismissed: {reason}
+  - {YYYY-MM-DD HH:mm:ss±HH:MM} — **Close Dependabot** by {agent} — Dependabot alert #{alert-number} dismissed: {reason}
   ```
 - 归档任务
 - **释放短号**（归档目录已 mv 成功，再 release；脚本幂等）：
@@ -101,7 +101,9 @@ date "+%Y-%m-%d %H:%M:%S%:z"
 
 ### 8. 告知用户
 
-> **重要**：以下「下一步」中列出的所有 TUI 命令格式必须完整输出，不要只展示当前 AI 代理对应的格式。如果 `.agents/.airc.json` 中配置了自定义 TUI（`customTUIs`），读取每个工具的 `name` 和 `invoke`，按同样格式补充对应命令行（`${skillName}` 替换为技能名，`${projectName}` 替换为项目名）。
+> **重要**：以下「下一步」中列出的所有 TUI 命令格式必须完整输出，不要只展示当前 AI 代理对应的格式。如果 `.agents/.airc.json` 中配置了自定义 TUI（`customTUIs`），读取每个工具的 `name` 和 `invoke`，按同样格式补充对应命令行（`${skillName}` 替换为技能名，`${projectName}` 替换为项目名）。 渲染最终输出前，先读取 `.agents/rules/next-step-output.md` 并落实其两类规则：(1) 「下一步」命令把 `{task-ref}` 渲染为短号 `#NN`（未分配/已释放时回退完整 TASK-id）；(2) 在面向用户输出的绝对最后一行追加 `Completed at` 收尾行（成功、错误、早退等任何面向用户输出都适用，不限于校验通过的成功态）。
+
+> **可选沙箱清理提示（门控渲染）**：仅当同时满足 (1) `.agents/.airc.json` 存在 `sandbox` 字段、(2) 第 7 步按告警号定位到了关联任务、(3) 该关联任务 task.md 的 `branch` 字段存在且不是 `main` / `master` 时，才渲染下方输出中「注意：…」之后、「下一步」之前的「可选：清理本任务的沙箱」块；任一不满足则整段省略。`{branch}` 取第 7 步定位到的关联任务 task.md 的 `branch` 值。该块独立于「下一步」语义。
 
 ```
 安全告警 #{alert-number} 已关闭。
@@ -115,10 +117,15 @@ date "+%Y-%m-%d %H:%M:%S%:z"
 
 注意：如有需要，可在平台侧重新打开。
 
+可选：清理本任务的沙箱
+（关联任务的沙箱容器和 per-branch 配置目录不会自动回收。如果不再需要可执行：）
+
+ai sandbox rm {branch}
+
 下一步 - 完成并归档任务（如有关联任务）：
-  - Claude Code / OpenCode：/complete-task {task-id}
-  - Gemini CLI：/agent-infra:complete-task {task-id}
-  - Codex CLI：$complete-task {task-id}
+  - Claude Code / OpenCode：/complete-task {task-ref}
+  - Gemini CLI：/agent-infra:complete-task {task-ref}
+  - Codex CLI：$complete-task {task-ref}
 ```
 
 ## 注意事项

package/templates/.agents/skills/code-task/SKILL.en.md

@@ -10,7 +10,7 @@ Implement the approved plan and produce `code.md` or `code-r{N}.md`. This skill
 ## Boundary / Critical Rules
 
 - Follow the latest plan artifact: `plan.md` or `plan-r{N}.md`
-- Fix mode only addresses findings from the latest `review-code`; env-blocked items are out of scope
+- Fix mode verifies each finding of the latest `review-code` one by one: fix it if it holds, or rebut it and record it under unresolved if it is unfounded/hallucinated; do not expand to issues the review did not list; env-blocked items are out of scope
 - Never auto-run `git add` or `git commit`
 - Create a new code artifact for each round and never overwrite an older one
 - After executing this skill, you **must** immediately update task.md
@@ -31,7 +31,7 @@ tail .agents/workspace/active/{task-id}/task.md
 
 ## Task id short ref
 
-> If `{task-id}` begins with `#`, follow the "SKILL parameter resolver" section of `.agents/rules/task-short-id.md`; treat `{task-id}` as the resolved full `TASK-YYYYMMDD-HHMMSS` form for every downstream command.
+> If `{task-id}` matches `^[#]?[0-9]+$` (bare numeric or `#`-prefixed), follow the "SKILL parameter resolver" section of `.agents/rules/task-short-id.md`; treat `{task-id}` as the resolved full `TASK-YYYYMMDD-HHMMSS` form for every downstream command.
 
 ## Steps
 
@@ -45,7 +45,9 @@ Read `reference/branch-management.md`, ensure the current branch matches the tas
 
 ### 3. Narrow the Milestone
 
-If task.md has a valid `issue_number`, read `.agents/rules/issue-sync.md` and `.agents/rules/milestone-inference.md`; follow Phase 2 for `code-task`.
+**Mandatory; do not skip.** If task.md has a valid `issue_number`, read `.agents/rules/issue-sync.md` first (upstream + permission detection), then `.agents/rules/milestone-inference.md` Phase 2 for `code-task` to narrow the Issue milestone. If `has_triage=false`, keep the existing milestone.
+
+> If this step is skipped or the Issue milestone is still a release line `X.Y.x` afterward, the step-11 `validate-artifact` gate will block the `code-task` round via `verify_milestone_specific` and require narrowing to a specific version (e.g. `0.7.1`) before proceeding.
 
 ### 4. Determine Mode and Round
 
@@ -102,8 +104,8 @@ date "+%Y-%m-%d %H:%M:%S%:z"
 
 Set `current_step` to `code`, refresh task metadata, and append one Activity Log entry:
 
-- initial implementation: `Code (Round {N})`
-- fix mode: `Code (Round {N}, fix for {review-artifact})`
+- initial implementation: `Code Task (Round {N})`
+- fix mode: `Code Task (Round {N}, fix for {review-artifact})`
 
 If task.md has a valid `issue_number`, read `.agents/rules/issue-sync.md`, then:
 - Set `status: in-progress` according to issue-sync.md
@@ -118,4 +120,6 @@ node .agents/scripts/validate-artifact.js gate code-task .agents/workspace/activ
 
 ### 12. Tell the User
 
-Use `reference/output-template.md` and show all TUI command formats.
+Use `reference/output-template.md` (or `reference/fix-mode.md` in fix mode) and show all TUI command formats.
+
+> Before rendering the final output, read `.agents/rules/next-step-output.md` and apply both of its rules: (1) render `{task-ref}` in the "Next steps" commands as the current task's short id `#NN` (see that file for lookup and fallback), while other `{task-id}` placeholders (report titles, paths) keep the full TASK-id form; (2) append the `Completed at` line as the very last line of the user-facing output (this applies to every user-facing output — success, error, and early-return paths alike, not only the success path).

package/templates/.agents/skills/code-task/SKILL.zh-CN.md

@@ -10,7 +10,7 @@ description: "根据技术方案编码任务并输出报告"
 ## 行为边界 / 关键规则
 
 - 严格遵循最新方案产物：`plan.md` 或 `plan-r{N}.md`
-- 修复模式只处理最新 `review-code` 标记的问题；env-blocked 项不在修复范围
+- 修复模式逐条核实最新 `review-code` 的发现：成立则修复，判定为不成立/幻觉则在报告中反驳并记入 unresolved；不擅自扩大到审查未列出的问题；env-blocked 项不在修复范围
 - 绝不自动执行 `git add` 或 `git commit`
 - 每轮实现都创建新的实现产物，不覆盖旧文件
 - 执行本技能后，你**必须**立即更新 task.md
@@ -27,6 +27,7 @@ description: "根据技术方案编码任务并输出报告"
 | 「先写代码再补测试更高效」 | 后补测试常沦为对实现的镜像；目标驱动应先定义可验证用例再让它通过。 |
 | 「方案这里不合理，顺手改更好」 | 偏离 `{plan-artifact}` 必须在报告中记录原因；有异议先停下确认，不擅自改方向。 |
 | 「测试过了，顺便提交一下」 | 本技能绝不执行 `git add`/`git commit`，提交是用户显式发起的独立步骤。 |
+| 「审查既然写了，照着改就行」 | 审查可能基于错误 `file:line` 或幻觉；动手前先 Read/Grep 核实，成立才修，不成立就反驳并记入 unresolved，不盲从。 |
 
 ## 第 0 步：状态核对（执行前硬约束）
 
@@ -44,7 +45,7 @@ tail .agents/workspace/active/{task-id}/task.md
 
 ## 任务入参短号别名
 
-> 如果 `{task-id}` 入参以 `#` 开头，先读取 `.agents/rules/task-short-id.md` 的「SKILL 入参解析」段执行解析；后续命令视 `{task-id}` 为解析后的全长 `TASK-YYYYMMDD-HHMMSS` 形式。
+> 如果 `{task-id}` 入参匹配 `^[#]?[0-9]+$`（裸数字或带 `#` 前缀），先读取 `.agents/rules/task-short-id.md` 的「SKILL 入参解析」段执行解析；后续命令视 `{task-id}` 为解析后的全长 `TASK-YYYYMMDD-HHMMSS` 形式。
 
 ## 执行步骤
 ### 1. 验证前置条件
@@ -70,7 +71,9 @@ tail .agents/workspace/active/{task-id}/task.md
 
 ### 3. 收窄里程碑
 
-如果 task.md 中存在有效的 `issue_number`，执行前先读取 `.agents/rules/issue-sync.md`，完成 upstream 仓库检测和权限检测；再读取 `.agents/rules/milestone-inference.md`，按其中的「阶段 2：`code-task`」收窄 Issue milestone；如果 `has_triage=false`，则保持原 milestone 不变。
+**必须执行，不得跳过。** 如果 task.md 中存在有效的 `issue_number`，执行前先读取 `.agents/rules/issue-sync.md`，完成 upstream 仓库检测和权限检测；再读取 `.agents/rules/milestone-inference.md`，按其中的「阶段 2：`code-task`」收窄 Issue milestone；如果 `has_triage=false`，则保持原 milestone 不变。
+
+> 若此步骤被跳过或收窄后 Issue milestone 仍为 `X.Y.x` 版本线，步骤 11 的 `validate-artifact` gate 会通过 `verify_milestone_specific` 截停本轮 `code-task`，要求重新收窄到具体版本（如 `0.7.1`）后再继续。
 
 ### 4. 确定模式与轮次
 
@@ -149,8 +152,8 @@ date "+%Y-%m-%d %H:%M:%S%:z"
 - 审查 `## 需求` 段落，仅把本轮已由代码实现且有测试通过支撑的条目从 `- [ ]` 勾为 `- [x]`
 - 记录 Round `{code-round}` 的 `{code-artifact}`
 - 追加：
-  - 初次实现：`- {YYYY-MM-DD HH:mm:ss±HH:MM} — **Code (Round {N})** by {agent} — Code implemented, {n} files modified, {n} tests passed → {code-artifact}`
-  - 修复模式：`- {YYYY-MM-DD HH:mm:ss±HH:MM} — **Code (Round {N}, fix for {review-artifact})** by {agent} — Fixed {n} blockers, {n} major, {n} minor issues[, skipped {n} env-blocked] → {code-artifact}`
+  - 初次实现：`- {YYYY-MM-DD HH:mm:ss±HH:MM} — **Code Task (Round {N})** by {agent} — Code implemented, {n} files modified, {n} tests passed → {code-artifact}`
+  - 修复模式：`- {YYYY-MM-DD HH:mm:ss±HH:MM} — **Code Task (Round {N}, fix for {review-artifact})** by {agent} — Fixed {n} blockers, {n} major, {n} minor issues[, skipped {n} env-blocked] → {code-artifact}`
 
 如果 task.md 中存在有效的 `issue_number`，执行以下同步操作（任一失败则跳过并继续；执行前先读取 `.agents/rules/issue-sync.md`，完成 upstream 仓库检测和权限检测）：
 - 按 issue-sync.md 设置 `status: in-progress`
@@ -176,7 +179,9 @@ node .agents/scripts/validate-artifact.js gate code-task .agents/workspace/activ
 
 > 仅在校验通过后执行本步骤。
 
-> **重要**：以下「下一步」中列出的所有 TUI 命令格式必须完整输出，不要只展示当前 AI 代理对应的格式。如果 `.agents/.airc.json` 中配置了自定义 TUI（`customTUIs`），读取每个工具的 `name` 和 `invoke`，按同样格式补充对应命令行（`${skillName}` 替换为技能名，`${projectName}` 替换为项目名）。输出格式见 `reference/output-template.md`。
+> **重要**：以下「下一步」中列出的所有 TUI 命令格式必须完整输出，不要只展示当前 AI 代理对应的格式。如果 `.agents/.airc.json` 中配置了自定义 TUI（`customTUIs`），读取每个工具的 `name` 和 `invoke`，按同样格式补充对应命令行（`${skillName}` 替换为技能名，`${projectName}` 替换为项目名）。输出格式见 `reference/output-template.md`；修复模式输出见 `reference/fix-mode.md`。
+
+> 渲染最终输出前先读取 `.agents/rules/next-step-output.md` 并落实其两类规则：(1) 「下一步」命令的 `{task-ref}` 渲染为当前任务短号 `#NN`（取值与回退见该文件），其他 `{task-id}` 占位（报告标题、路径）保持完整 TASK-id 形式；(2) 在面向用户输出的绝对最后一行追加 `Completed at` 收尾行（成功、错误、早退等任何面向用户输出都适用，不限于校验通过的成功态）。
 
 ## 完成检查清单
 

package/templates/.agents/skills/code-task/config/verify.en.json

@@ -32,7 +32,7 @@
       ]
     },
     "activity-log": {
-      "expected_action_pattern": "Code \\(Round \\d+(?:, fix for review-code(?:-r\\d+)?\\.md)?\\)",
+      "expected_action_pattern": "(Code Task|Code) \\(Round \\d+(?:, fix for review-code(?:-r\\d+)?\\.md)?\\)",
       "freshness_minutes": 30
     },
     "platform-sync": {
@@ -44,6 +44,7 @@
       "verify_issue_type": true,
       "verify_issue_fields": false,
       "verify_milestone": true,
+      "verify_milestone_specific": true,
       "expected_status_label_key": "inProgress",
       "expected_comment_marker_key": "artifact"
     }

package/templates/.agents/skills/code-task/config/verify.zh-CN.json

@@ -32,7 +32,7 @@
       ]
     },
     "activity-log": {
-      "expected_action_pattern": "Code \\(Round \\d+(?:, fix for review-code(?:-r\\d+)?\\.md)?\\)",
+      "expected_action_pattern": "(Code Task|Code) \\(Round \\d+(?:, fix for review-code(?:-r\\d+)?\\.md)?\\)",
       "freshness_minutes": 30
     },
     "platform-sync": {
@@ -44,6 +44,7 @@
       "verify_issue_type": true,
       "verify_issue_fields": false,
       "verify_milestone": true,
+      "verify_milestone_specific": true,
       "expected_status_label_key": "inProgress",
       "expected_comment_marker_key": "artifact"
     }

package/templates/.agents/skills/code-task/reference/fix-mode.en.md

@@ -4,6 +4,11 @@ Read this file before changing code during fix mode.
 
 ## Plan the Fixes
 
+**Verify each finding first (mandatory before editing)**: for every finding in `{review-artifact}`, Read/Grep the cited `file:line` and the corresponding `git diff` to confirm the issue is real:
+- Holds → include it in the classification and fixes below
+- Unfounded / based on a wrong `file:line` / hallucinated → do not change code; give a counter-argument in the report's `## Per-Finding Verification` section and record it under unresolved issues
+- Do not expand fixes to issues the review did not list
+
 Classify and prioritize work:
 1. **Blockers first**
 2. **Then major issues**
@@ -18,7 +23,7 @@ Detailed priority rules:
 - Blockers must all be fixed before anything else
 - Major issues should all be fixed in the same pass unless a blocker prevents progress
 - Minor issues are optional only after Blockers and Majors are resolved
-- If you disagree with a finding, record that disagreement under unresolved issues instead of silently skipping it
+- If you disagree with a finding, or judge it hallucinated after verification, do not silently skip it; give a counter-argument in the report's `## Per-Finding Verification` section and record it under unresolved issues
 
 ### Meta-category: env-blocked
 
@@ -66,9 +71,9 @@ Fix status:
 
 Next step - re-review or commit:
 - Re-review (always recommended):
-  - Claude Code / OpenCode: /review-code {task-id}
-  - Gemini CLI: /agent-infra:review-code {task-id}
-  - Codex CLI: $review-code {task-id}
+  - Claude Code / OpenCode: /review-code {task-ref}
+  - Gemini CLI: /agent-infra:review-code {task-ref}
+  - Codex CLI: $review-code {task-ref}
 - Commit directly (optional; only when all issues are resolved and changes are low risk):
   - Claude Code / OpenCode: /commit
   - Gemini CLI: /agent-infra:commit
@@ -79,7 +84,7 @@ Next step - re-review or commit:
 
 1. **Prerequisite**: a code review artifact must exist (`review-code.md` or `review-code-r{N}.md`)
 2. **No auto-commit**: do not run `git commit`
-3. **Scope discipline**: only fix reviewed issues
+3. **Scope discipline**: verify each reviewed issue one by one — fix it if it holds, rebut it if it does not; do not expand to issues the review did not list
 4. **Disagreement handling**: record any disagreement in the report
 5. **Re-review**: always recommend `review-code` as the default next step after fix mode
 6. **Consistency**: the latest review artifact, Activity Log entry, and code report must reference the same round

package/templates/.agents/skills/code-task/reference/fix-mode.zh-CN.md

@@ -4,6 +4,11 @@
 
 ## 规划修复
 
+**先逐条核实（动手前必做）**：对 `{review-artifact}` 的每一条发现，先 Read/Grep 其引用的 `file:line` 与对应 `git diff`，确认问题真实存在：
+- 成立 → 纳入下方分类与修复
+- 不成立 / 基于错误 `file:line` / 幻觉 → 不改代码，在报告 `## 对审查发现的逐条核实` 给出反证，并记入 unresolved issues
+- 不擅自把修复扩大到审查未列出的问题
+
 按以下顺序分类并确定优先级：
 1. **先处理 Blocker**
 2. **再处理 Major**
@@ -18,7 +23,7 @@
 - 所有 Blocker 都必须最先修完
 - 只要没有被 Blocker 阻塞，所有 Major 都应在同一轮一并修复
 - 只有在 Blocker 和 Major 都解决后，Minor 才是可选项
-- 如果你不同意某条审查意见，不要静默跳过，而是把分歧记录到 unresolved issues
+- 如果你不同意某条审查意见，或核实后判定为幻觉，不要静默跳过，而是在报告 `## 对审查发现的逐条核实` 给出反证并记录到 unresolved issues
 
 ### 元类目：env-blocked
 
@@ -66,9 +71,9 @@ env-blocked 项不在修复范围。处理规则：
 
 下一步 - 重新审查或提交：
 - 重新审查（始终推荐）：
-  - Claude Code / OpenCode：/review-code {task-id}
-  - Gemini CLI：/agent-infra:review-code {task-id}
-  - Codex CLI：$review-code {task-id}
+  - Claude Code / OpenCode：/review-code {task-ref}
+  - Gemini CLI：/agent-infra:review-code {task-ref}
+  - Codex CLI：$review-code {task-ref}
 - 直接提交（可选；仅在所有问题已解决且风险可控时）：
   - Claude Code / OpenCode：/commit
   - Gemini CLI：/agent-infra:commit
@@ -79,7 +84,7 @@ env-blocked 项不在修复范围。处理规则：
 
 1. **前置条件**：必须存在代码审查产物（`review-code.md` 或 `review-code-r{N}.md`）
 2. **禁止自动提交**：不要执行 `git commit`
-3. **范围约束**：只修复审查中列出的问题
+3. **范围约束**：逐条核实审查列出的问题，成立则修复、不成立则反驳；不扩大到审查未列出的问题
 4. **分歧处理**：如果不同意审查意见，要在报告里明确记录
 5. **重新审查**：修复后始终推荐执行 `review-code`
 6. **一致性**：最新审查产物、Activity Log 记录和修复报告必须引用同一轮次

package/templates/.agents/skills/code-task/reference/output-template.en.md

@@ -14,7 +14,7 @@ Output files:
 - Code report: .agents/workspace/active/{task-id}/{code-artifact}
 
 Next step - code review:
-  - Claude Code / OpenCode: /review-code {task-id}
-  - Gemini CLI: /{{project}}:review-code {task-id}
-  - Codex CLI: $review-code {task-id}
+  - Claude Code / OpenCode: /review-code {task-ref}
+  - Gemini CLI: /{{project}}:review-code {task-ref}
+  - Codex CLI: $review-code {task-ref}
 ```

package/templates/.agents/skills/code-task/reference/output-template.zh-CN.md

@@ -14,7 +14,7 @@
 - 实现报告：.agents/workspace/active/{task-id}/{code-artifact}
 
 下一步 - 代码审查：
-  - Claude Code / OpenCode：/review-code {task-id}
-  - Gemini CLI：/agent-infra:review-code {task-id}
-  - Codex CLI：$review-code {task-id}
+  - Claude Code / OpenCode：/review-code {task-ref}
+  - Gemini CLI：/agent-infra:review-code {task-ref}
+  - Codex CLI：$review-code {task-ref}
 ```