@fitlab-ai/agent-infra 0.8.0 → 0.8.1

package/bin/cli.ts

@@ -20,7 +20,7 @@ Commands:
   help            Show this help message
   init            Initialize a new project with update-agent-infra seed command
   merge           Merge tasks from another workspace directory (active/blocked/completed/archive)
-  run             Run a whitelisted lifecycle skill through a non-interactive TUI
+  run             Schedule a lifecycle skill in the task sandbox tmux session
   sandbox, s      Manage Docker-based AI sandboxes
   server          Run the local AI collaboration daemon (start/stop/status/logs)
   task, t         Read-only views over .agents/workspace tasks (cat / files / grep / log / ls / show / status)

package/dist/bin/cli.js

@@ -24,7 +24,7 @@ Commands:
   help            Show this help message
   init            Initialize a new project with update-agent-infra seed command
   merge           Merge tasks from another workspace directory (active/blocked/completed/archive)
-  run             Run a whitelisted lifecycle skill through a non-interactive TUI
+  run             Schedule a lifecycle skill in the task sandbox tmux session
   sandbox, s      Manage Docker-based AI sandboxes
   server          Run the local AI collaboration daemon (start/stop/status/logs)
   task, t         Read-only views over .agents/workspace tasks (cat / files / grep / log / ls / show / status)

package/dist/lib/run/index.js

@@ -1,11 +1,17 @@
+import fs from 'node:fs';
+import path from 'node:path';
 import { loadServerConfig } from "../server/config.js";
 import { resolveTaskBranch } from "../sandbox/task-resolver.js";
-import { runInSandbox } from "../sandbox/capture.js";
+import { createRunId, runInSandbox } from "../sandbox/capture.js";
+import { loadShortIdByTaskId, normalizeShortIdInput } from "../task/short-id.js";
 import { buildTuiCommand, renderPrompt, selectTui } from "./tui.js";
 import { getSkillRunSpec } from "./skills.js";
 import { runHostCommand } from "./host.js";
 const USAGE = `Usage: ai run <skill> [task-ref] [args...] [--tui <name>]
 
+Task skills are scheduled inside the sandbox tmux session; ai run returns once
+the tmux window is created.
+
 Examples:
   ai run create-task "describe the task" --tui codex
   ai run code-task #7 --tui codex`;
@@ -56,6 +62,83 @@ function assertAllowedByConfig(skill, commandConfig) {
         throw new Error(`Skill '${skill}' is not allowed by command.allowedSkills`);
     }
 }
+const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
+function readShortIdLength(repoRoot) {
+    try {
+        const cfg = JSON.parse(fs.readFileSync(path.join(repoRoot, '.agents', '.airc.json'), 'utf8'));
+        const value = cfg?.task?.shortIdLength;
+        if (typeof value === 'number' && Number.isFinite(value) && value >= 1)
+            return value;
+    }
+    catch {
+        // Use the project default when config is absent in lightweight tests.
+    }
+    return 2;
+}
+function readActiveShortIdRegistry(repoRoot) {
+    const registryPath = path.join(repoRoot, '.agents', 'workspace', 'active', '.short-ids.json');
+    try {
+        const data = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
+        return data && typeof data === 'object' && data.ids && typeof data.ids === 'object' ? data.ids : {};
+    }
+    catch {
+        return {};
+    }
+}
+function resolveActiveTaskIdentity(taskRef, repoRoot) {
+    let taskId = null;
+    let resolvedTaskRef = taskRef;
+    if (TASK_ID_RE.test(taskRef)) {
+        taskId = taskRef;
+        resolvedTaskRef = loadShortIdByTaskId(repoRoot).get(taskId) ?? taskRef;
+    }
+    else {
+        const normalized = normalizeShortIdInput(taskRef, { shortIdLength: readShortIdLength(repoRoot) });
+        if (normalized.kind !== 'shortId')
+            return null;
+        resolvedTaskRef = normalized.value;
+        taskId = readActiveShortIdRegistry(repoRoot)[normalized.value.slice(1)] ?? null;
+    }
+    if (!taskId)
+        return null;
+    const taskDir = path.join(repoRoot, '.agents', 'workspace', 'active', taskId);
+    if (!fs.existsSync(path.join(taskDir, 'task.md')))
+        return null;
+    return { taskId, taskDir, taskRef: resolvedTaskRef };
+}
+function formatLocalTimestamp(date = new Date()) {
+    const pad = (n) => String(n).padStart(2, '0');
+    const year = date.getFullYear();
+    const month = pad(date.getMonth() + 1);
+    const day = pad(date.getDate());
+    const hour = pad(date.getHours());
+    const minute = pad(date.getMinutes());
+    const second = pad(date.getSeconds());
+    const offsetMinutes = -date.getTimezoneOffset();
+    const sign = offsetMinutes >= 0 ? '+' : '-';
+    const offsetHour = pad(Math.floor(Math.abs(offsetMinutes) / 60));
+    const offsetMinute = pad(Math.abs(offsetMinutes) % 60);
+    return `${year}-${month}-${day} ${hour}:${minute}:${second}${sign}${offsetHour}:${offsetMinute}`;
+}
+function writeRunRecord(params) {
+    const runsDir = path.join(params.identity.taskDir, 'runs');
+    fs.mkdirSync(runsDir, { recursive: true });
+    const record = {
+        version: 1,
+        run_id: params.run.runId,
+        task_id: params.identity.taskId,
+        task_ref: params.identity.taskRef,
+        branch: params.branch,
+        engine: params.run.engine,
+        container: params.run.container,
+        run_dir: params.run.runDir,
+        status_file: `${params.run.runDir}/status`,
+        log_file: `${params.run.runDir}/output.log`,
+        created_at: formatLocalTimestamp(),
+        command: params.command
+    };
+    fs.writeFileSync(path.join(runsDir, `${params.run.runId}.json`), `${JSON.stringify(record, null, 2)}\n`, 'utf8');
+}
 export async function runSkill(args, options = {}) {
     const parsed = parseRunArgs(args);
     const config = options.command ? null : loadServerConfig({ rootDir: options.repoRoot });
@@ -72,13 +155,21 @@ export async function runSkill(args, options = {}) {
     }
     const repoRoot = options.repoRoot ?? config?.repoRoot ?? process.cwd();
     const branch = resolveTaskBranch(parsed.taskRef, repoRoot);
-    const runSandbox = options.runSandbox ?? ((request) => runInSandbox(request));
-    const result = await runSandbox({ taskRef: parsed.taskRef, branch, command });
+    const identity = resolveActiveTaskIdentity(parsed.taskRef, repoRoot);
+    const runId = identity ? createRunId() : undefined;
+    const writeStdout = options.writeStdout ?? ((chunk) => process.stdout.write(chunk));
+    const writeStderr = options.writeStderr ?? ((chunk) => process.stderr.write(chunk));
+    const runSandbox = options.runSandbox ??
+        ((request) => runInSandbox(request));
+    const result = await runSandbox({ taskRef: parsed.taskRef, branch, command, runId });
     if (result.stdout) {
-        (options.writeStdout ?? ((chunk) => process.stdout.write(chunk)))(result.stdout);
+        writeStdout(result.stdout);
     }
     if (result.stderr) {
-        (options.writeStderr ?? ((chunk) => process.stderr.write(chunk)))(result.stderr);
+        writeStderr(result.stderr);
+    }
+    if ((result.exitCode ?? (result.signal ? 1 : 0)) === 0 && identity && result.run) {
+        writeRunRecord({ identity, run: result.run, branch, command });
     }
     return result.exitCode ?? (result.signal ? 1 : 0);
 }

package/dist/lib/sandbox/capture.js

@@ -9,6 +9,19 @@ async function spawnCapture(file, args) {
         const child = spawn(file, args, { stdio: ['ignore', 'pipe', 'pipe'] });
         let stdout = '';
         let stderr = '';
+        let settled = false;
+        const rejectOnce = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            reject(error);
+        };
+        const resolveOnce = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(result);
+        };
         child.stdout.setEncoding('utf8');
         child.stderr.setEncoding('utf8');
         child.stdout.on('data', (chunk) => {
@@ -17,10 +30,93 @@ async function spawnCapture(file, args) {
         child.stderr.on('data', (chunk) => {
             stderr += chunk;
         });
-        child.on('error', reject);
-        child.on('close', (exitCode, signal) => resolve({ exitCode, signal, stdout, stderr }));
+        child.on('error', rejectOnce);
+        child.on('close', (exitCode, signal) => {
+            resolveOnce({ exitCode, signal, stdout, stderr });
+        });
     });
 }
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+export function createRunId(date = new Date()) {
+    return `run-${date.toISOString().replace(/\.\d{3}Z$/, 'Z').replace(/[-:]/g, '').replace('T', '-').replace('Z', '')}-${process.pid}`;
+}
+function buildRunScript(params) {
+    const command = params.command.map(shellQuote).join(' ');
+    const runDir = shellQuote(params.runDir);
+    const runId = shellQuote(params.runId);
+    return `#!/bin/sh
+set -u
+cd /workspace
+date "+%Y-%m-%d %H:%M:%S%:z" > ${runDir}/started_at
+printf '%s\\n' running > ${runDir}/status
+${command}
+code=$?
+printf '%s\\n' "$code" > ${runDir}/exit_code
+date "+%Y-%m-%d %H:%M:%S%:z" > ${runDir}/finished_at
+if [ "$code" -eq 0 ]; then
+  printf '%s\\n' completed > ${runDir}/status
+else
+  printf '%s\\n' failed > ${runDir}/status
+fi
+printf '\\n[agent-infra] run %s finished with exit code %s\\n' ${runId} "$code"
+exec bash -l
+`;
+}
+function buildTmuxLauncher(params) {
+    const session = 'work';
+    const window = `ai-${params.runId.replace(/^run-/, '').slice(0, 18)}`;
+    const runRoot = '/tmp/agent-infra-runs';
+    const runDir = `${runRoot}/${params.runId}`;
+    const runScript = buildRunScript({ command: params.request.command, runDir, runId: params.runId });
+    const runScriptBase64 = Buffer.from(runScript, 'utf8').toString('base64');
+    const paneCommand = `cd /workspace && ${shellQuote(`${runDir}/run.sh`)}`;
+    return `set -eu
+session=${shellQuote(session)}
+window=${shellQuote(window)}
+run_id=${shellQuote(params.runId)}
+run_dir=${shellQuote(runDir)}
+task_ref=${shellQuote(params.request.taskRef)}
+branch=${shellQuote(params.request.branch)}
+
+sandbox-dotfiles-link >/dev/null 2>&1 || true
+mkdir -p "$run_dir"
+printf '%s\\n' pending > "$run_dir/status"
+printf '%s\\n' "$task_ref" > "$run_dir/task_ref"
+printf '%s\\n' "$branch" > "$run_dir/branch"
+printf '%s\\n' ${shellQuote(params.request.command.join(' '))} > "$run_dir/command"
+printf '%s' ${shellQuote(runScriptBase64)} | base64 -d > "$run_dir/run.sh"
+chmod +x "$run_dir/run.sh"
+
+if ! command -v tmux >/dev/null 2>&1; then
+  printf '%s\\n' "tmux is not installed in this sandbox" >&2
+  exit 127
+fi
+
+if ! tmux has-session -t "$session" 2>/dev/null; then
+  tmux new-session -d -s "$session" -n shell
+fi
+
+if [ -n "\${TZ:-}" ]; then
+  tmux set-environment -t "$session" TZ "$TZ" 2>/dev/null || true
+fi
+
+pane=$(tmux new-window -d -P -F '#{pane_id}' -t "$session" -n "$window")
+printf '%s\\n' "$session" > "$run_dir/session"
+printf '%s\\n' "$window" > "$run_dir/window"
+printf '%s\\n' "$pane" > "$run_dir/pane"
+tmux pipe-pane -o -t "$pane" "cat > $run_dir/output.log"
+tmux send-keys -t "$pane" ${shellQuote(paneCommand)} Enter
+
+cat <<EOF
+Started sandbox run $run_id in tmux session '$session', window '$window', pane '$pane'.
+Attach with: ai sandbox enter $task_ref
+Status file: $run_dir/status
+Output log: $run_dir/output.log
+EOF
+`;
+}
 export async function runInSandbox(request, options = {}) {
     const config = options.engine ? null : loadConfig();
     const engine = options.engine ?? detectEngine(config);
@@ -37,13 +133,26 @@ export async function runInSandbox(request, options = {}) {
     if (!found.running) {
         (options.startContainer ?? ((name) => startSandboxContainer(engine, name)))(found.name);
     }
+    const runId = options.runId ?? createRunId();
+    const runDir = `/tmp/agent-infra-runs/${runId}`;
     const dockerArgs = [
         'exec',
         ...terminalEnvFlags(),
         ...hostTimezoneEnvFlags(),
         found.name,
-        ...request.command
+        'bash',
+        '-lc',
+        buildTmuxLauncher({ request, runId })
     ];
-    return (options.spawn ?? spawnCapture)('docker', dockerArgs);
+    const result = await (options.spawn ?? spawnCapture)('docker', dockerArgs);
+    return {
+        ...result,
+        run: {
+            runId,
+            engine,
+            container: found.name,
+            runDir
+        }
+    };
 }
 //# sourceMappingURL=capture.js.map

package/dist/lib/sandbox/commands/create.js

@@ -1113,9 +1113,9 @@ export async function create(args) {
                         if (claudeCodeEntry) {
                             ensureClaudeOnboarding(claudeCodeEntry.dir, effectiveConfig.home);
                             ensureClaudeSettings(claudeCodeEntry.dir, effectiveConfig.home);
-                            // prepareClaudeCredentials wrote the shared credentials file
-                            // before this point. If credentials were missing, the
-                            // claude-code entry was removed from effectiveResolvedTools.
+                            // prepareClaudeCredentials wrote OAuth credentials or confirmed
+                            // provider/API settings are enough for Claude Code. If no usable
+                            // auth was present, the claude-code entry was removed above.
                         }
                         const codexEntry = effectiveResolvedTools.find(({ tool }) => tool.id === 'codex');
                         if (codexEntry) {

package/dist/lib/sandbox/commands/enter.js

@@ -1,7 +1,7 @@
 import { loadConfig } from "../config.js";
 import { assertValidBranchName, containerNameCandidates, sandboxBranchLabel, sandboxLabel } from "../constants.js";
 import { detectEngine } from "../engine.js";
-import { formatCredentialWarnings, formatRemaining, reconcileClaudeCredentials, redactCommandError, validateClaudeCredentialsEnvOverride } from "../credentials.js";
+import { formatCredentialWarnings, formatRemaining, hasClaudeProviderAuth, reconcileClaudeCredentials, redactCommandError, validateClaudeCredentialsEnvOverride } from "../credentials.js";
 import { runInteractiveEngine } from "../shell.js";
 import { dotfilesCacheDir, materializeDotfiles } from "../dotfiles.js";
 import { runInteractiveWithClipboardBridge } from "../clipboard/bridge.js";
@@ -50,7 +50,10 @@ export function runSandboxInteractive(params) {
     }
     return runBridge({ engine, dockerArgs, container, home });
 }
-export function formatCredentialSyncStatus(result, isTTY = process.stderr.isTTY) {
+export function formatCredentialSyncStatus(result, isTTY = process.stderr.isTTY, providerAuthAvailable = false) {
+    if (providerAuthAvailable && (result.status === 'STALE_ACCESS' || result.status === 'MISSING')) {
+        return null;
+    }
     if (result.status === 'STALE_ACCESS') {
         return 'Warning: Claude Code credentials on host appear stale. Run "ai sandbox refresh" or "claude /login" to renew.\n';
     }
@@ -100,8 +103,9 @@ export async function enter(args) {
     if (config.tools.includes('claude-code')) {
         try {
             // Scan all projects so a refresh from a neighbouring sandbox can still flow back to the host.
+            const providerAuthAvailable = hasClaudeProviderAuth(config.home);
             const result = reconcileClaudeCredentials(config.home);
-            const message = formatCredentialSyncStatus(result);
+            const message = formatCredentialSyncStatus(result, process.stderr.isTTY, providerAuthAvailable);
             if (message) {
                 process.stderr.write(message);
             }

package/dist/lib/sandbox/credentials.js

@@ -11,6 +11,12 @@ const REDACTION_PATTERNS = [
     { pattern: /gh[psoru]_[A-Za-z0-9]{30,}/g, replacement: '[REDACTED github token]' },
     { pattern: /Bearer\s+[A-Za-z0-9._~+/=-]{20,}/gi, replacement: 'Bearer [REDACTED]' }
 ];
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function hasNonEmptyString(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
 function errorMessage(error) {
     return error instanceof Error ? error.message : 'unknown error';
 }
@@ -102,6 +108,28 @@ export function validateClaudeCredentialsEnvOverride(env = process.env) {
         throw new Error('Invalid AGENT_INFRA_CLAUDE_CREDENTIALS_FILE value. Expected an absolute file path.');
     }
 }
+export function hasClaudeProviderAuthInSettings(settings) {
+    if (!isRecord(settings)) {
+        return false;
+    }
+    const env = isRecord(settings.env) ? settings.env : {};
+    return hasNonEmptyString(env.ANTHROPIC_AUTH_TOKEN)
+        || hasNonEmptyString(env.ANTHROPIC_API_KEY)
+        || hasNonEmptyString(settings.apiKeyHelper);
+}
+export function hasClaudeProviderAuth(home, options = {}) {
+    const { readFn = (targetPath) => fs.readFileSync(targetPath, 'utf8'), existsFn = fs.existsSync } = options;
+    const settingsPath = path.join(home, '.claude', 'settings.json');
+    if (!existsFn(settingsPath)) {
+        return false;
+    }
+    try {
+        return hasClaudeProviderAuthInSettings(JSON.parse(readFn(settingsPath)));
+    }
+    catch {
+        return false;
+    }
+}
 // Reconcile treats the freshest valid endpoint as authoritative so sandbox
 // token rotations can flow back to the host credential store.
 function validateClaudeCredentialsBlob(raw, blob = null) {
@@ -395,11 +423,19 @@ export function formatRemaining(expiresAt) {
     const minutes = totalMinutes % 60;
     return hours > 0 ? `${hours}h ${minutes}m` : `${minutes}m`;
 }
-export function prepareClaudeCredentials(home, project, resolvedTools, extractFn = extractClaudeCredentialsBlob, writeFn = writeClaudeCredentialsFile, inspectFn = inspectClaudeKeychainStatus) {
+export function prepareClaudeCredentials(home, project, resolvedTools, extractFn = extractClaudeCredentialsBlob, writeFn = writeClaudeCredentialsFile, inspectFn = inspectClaudeKeychainStatus, providerAuthFn = hasClaudeProviderAuth) {
     const claudeCodeEntry = resolvedTools.find(({ tool }) => tool.id === 'claude-code');
     if (!claudeCodeEntry) {
         return { status: 'NOT_APPLICABLE' };
     }
+    const providerAuthAvailable = () => {
+        try {
+            return providerAuthFn(home);
+        }
+        catch {
+            return false;
+        }
+    };
     let blob = null;
     const hasCustomInspectFn = inspectFn !== inspectClaudeKeychainStatus;
     const hasCustomExtractFn = extractFn !== extractClaudeCredentialsBlob;
@@ -410,7 +446,7 @@ export function prepareClaudeCredentials(home, project, resolvedTools, extractFn
                 blob = inspection.blob;
                 break;
             case 'MISSING':
-                return { status: 'SKIPPED' };
+                return providerAuthAvailable() ? { status: 'OK' } : { status: 'SKIPPED' };
             case 'KEYCHAIN_LOCKED':
                 throw new Error([
                     'Claude Code credentials are stored in the macOS keychain, but the keychain is locked.',
@@ -418,6 +454,9 @@ export function prepareClaudeCredentials(home, project, resolvedTools, extractFn
                     buildLockedGuidance()
                 ].join('\n'));
             case 'STALE_ACCESS':
+                if (providerAuthAvailable()) {
+                    return { status: 'OK' };
+                }
                 throw new Error([
                     'Claude Code credentials on host are invalid or expired.',
                     '',
@@ -447,7 +486,7 @@ export function prepareClaudeCredentials(home, project, resolvedTools, extractFn
     else {
         blob = extractFn(home);
         if (!blob) {
-            return { status: 'SKIPPED' };
+            return providerAuthAvailable() ? { status: 'OK' } : { status: 'SKIPPED' };
         }
     }
     writeFn(home, project, blob);

package/dist/lib/sandbox/runtimes/base.dockerfile

@@ -61,6 +61,19 @@ RUN cat > /usr/local/bin/cc-token-status <<'SCRIPT' && chmod +x /usr/local/bin/c
 #!/bin/sh
 set -eu
 
+SETTINGS_FILE="/home/devuser/.claude/settings.json"
+if [ -r "$SETTINGS_FILE" ] && jq -e '
+  def has_nonempty($v):
+    if ($v | type) == "string" then ($v | gsub("^\\s+|\\s+$"; "") | length) > 0 else false end;
+  (if type == "object" then . else {} end) as $settings
+  | (if ($settings.env | type) == "object" then $settings.env else {} end) as $env
+  | has_nonempty($env.ANTHROPIC_AUTH_TOKEN)
+    or has_nonempty($env.ANTHROPIC_API_KEY)
+    or has_nonempty($settings.apiKeyHelper)
+' "$SETTINGS_FILE" >/dev/null 2>&1; then
+  exit 0
+fi
+
 CRED_FILE="/home/devuser/.claude/.credentials.json"
 [ -r "$CRED_FILE" ] || exit 0
 

package/dist/lib/task/commands/log.js

@@ -12,7 +12,7 @@ completion time (or '(in progress)' while still running).
 Columns: # (row) / STEP / AGENT / STARTED / DONE / NOTE
   A human-executed step shows AGENT as 'human' and, when it has no start marker,
   a '-' STARTED placeholder. Review-step NOTE also carries two human counts in
-  the verdict list, right after blockers/major/minor: manual-verify (env-blocked)
+  the verdict list, right after blockers/major/minor: manual-validation
   and human-decision (current ledger stage total).
 `;
 const TABLE_HEADERS = ['#', 'STEP', 'AGENT', 'STARTED', 'DONE', 'NOTE'];
@@ -33,10 +33,6 @@ const STARTED_SUFFIX_RE = /\s*\[started\]\s*$/;
 // note these differ from the `.airc.json` long names claude-code/gemini-cli).
 // Any other executor token (a human name, possibly CJK) is treated as human.
 const KNOWN_AI_AGENTS = new Set(['claude', 'codex', 'gemini', 'opencode', 'cursor']);
-const ENV_BLOCKED_RE = /\(\+\s*(\d+)\s+env-blocked\)/i;
-// Same match plus any leading whitespace, so folding the count into the verdict
-// text drops the redundant `(+ n env-blocked)` fragment without leaving a gap.
-const ENV_BLOCKED_STRIP_RE = /\s*\(\+\s*\d+\s+env-blocked\)/i;
 const REVIEW_STAGE_PREFIXES = [
     { prefix: 'Review Analysis', stage: 'analysis' },
     { prefix: 'Review Plan', stage: 'plan' },
@@ -116,9 +112,31 @@ function isReviewStage(stage) {
 function reviewStageForStep(step) {
     return REVIEW_STAGE_PREFIXES.find(({ prefix }) => step.startsWith(prefix))?.stage;
 }
+function splitArtifactSuffix(note) {
+    const arrow = note.indexOf(' → ');
+    return arrow === -1 ? { verdict: note, suffix: '' } : { verdict: note.slice(0, arrow), suffix: note.slice(arrow) };
+}
+function fieldNumber(field, label) {
+    const trimmed = field.trim();
+    const colon = trimmed.indexOf(':');
+    if (colon === -1)
+        return undefined;
+    if (trimmed.slice(0, colon).trim().toLowerCase() !== label)
+        return undefined;
+    const value = Number(trimmed.slice(colon + 1).trim());
+    return Number.isInteger(value) && value >= 0 ? value : undefined;
+}
 function humanValidationCount(note) {
-    const match = ENV_BLOCKED_RE.exec(note);
-    return match ? Number(match[1]) : 0;
+    const { verdict } = splitArtifactSuffix(note);
+    for (const field of verdict.split(',')) {
+        const value = fieldNumber(field, 'manual-validation');
+        if (value !== undefined)
+            return value;
+    }
+    return 0;
+}
+function isHumanCountField(field) {
+    return fieldNumber(field, 'manual-validation') !== undefined || fieldNumber(field, 'human-decision') !== undefined;
 }
 // A step is human-executed when its agent token is not a known AI token. Take
 // the first whitespace-delimited token and drop any trailing parenthetical
@@ -129,13 +147,17 @@ function isHumanAgent(agent) {
 }
 // Fold the two human counts into a review row's verdict NOTE: comma-joined, right
 // after the blockers/major/minor list and before the ` → artifact` link, mirroring
-// the review count line. The raw `(+ n env-blocked)` fragment is dropped so the
-// env-blocked number is not shown twice (it becomes the manual-verify count).
-function foldHumanCounts(note, decisions, envBlocked) {
-    const base = note.replace(ENV_BLOCKED_STRIP_RE, '');
-    const group = `Manual-verify: ${envBlocked}, Human-decision: ${decisions}`;
-    const arrow = base.indexOf(' → ');
-    return arrow === -1 ? `${base}, ${group}` : `${base.slice(0, arrow)}, ${group}${base.slice(arrow)}`;
+// the review count line. Review done notes already carry `Manual-validation` as a
+// source field, so build the final verdict field list once instead of cleaning a
+// previously rendered string.
+function foldHumanCounts(note, decisions, manualValidation) {
+    const { verdict, suffix } = splitArtifactSuffix(note);
+    const fields = verdict
+        .split(',')
+        .map((field) => field.trim())
+        .filter((field) => field !== '' && !isHumanCountField(field));
+    const group = `Manual-validation: ${manualValidation}, Human-decision: ${decisions}`;
+    return `${[...fields, group].join(', ')}${suffix}`;
 }
 function log(args = []) {
     if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {