@fitlab-ai/agent-infra 0.8.1 → 0.8.3

package/templates/.agents/skills/complete-manual-validation/reference/report-template.zh-CN.md

@@ -0,0 +1,48 @@
+# 人工验证完成报告模板
+
+创建 `manual-validation.md` / `manual-validation-r{N}.md` 前先读取本文件。
+
+````markdown
+# 人工验证完成报告
+
+- **验证轮次**：Round {N}
+- **产物文件**：`manual-validation.md`
+
+## 状态核对
+
+```text
+$ git status -s
+$ ls -la .agents/workspace/active/{task-id}/
+$ tail .agents/workspace/active/{task-id}/task.md
+```
+
+## 验证结论
+
+- 结论：通过
+- 验证时间：{YYYY-MM-DD HH:mm:ss±HH:MM}
+- 执行者：{agent}
+
+## 验证范围
+
+- PR：#{pr-number}
+- 摘要评论：{comment-id 或 URL}
+- 待人工校验项：
+  - {item-1}
+
+## 验证详情
+
+{verification-summary}
+
+## PR 摘要同步
+
+- 结果：{summary-result}
+- 摘要评论：{comment-id 或 URL}
+- 更新状态：`### ✅ 人工验证已通过`
+````
+
+## 填写规则
+
+- `验证详情` 保留用户提供的人工验证说明，不改写成未经确认的结论。
+- `验证范围` 来自 PR 摘要评论中的 `### ⚠️ 需人工校验` 段。
+- `PR 摘要同步` 必须记录成功、跳过或失败结果。
+- 只有在摘要评论已成功更新或无 diff 跳过时，才写入通过产物。

package/templates/.agents/skills/complete-manual-validation/reference/summary-update.en.md

@@ -0,0 +1,60 @@
+# PR Summary Manual Validation Update
+
+Read this file before `complete-manual-validation` updates the PR summary comment.
+
+## Responsibility Boundary
+
+This file only describes PR summary comment updates. The manual-validation artifact schema lives in `reference/report-template.md`.
+
+## PR Number Resolution
+
+1. Resolve `{task-ref}` to the task directory and read `task.md`.
+2. Prefer `task.md` frontmatter `pr_number`.
+3. If `pr_number` is empty, parse `{pr-ref}` from user input: `#123`, `123`, or a full PR URL.
+4. If `task.md` already has `pr_number` and the user also passed `{pr-ref}`, they must match.
+5. If they differ, fail with `summary failed: pr_number mismatch`. Do not write an artifact or PATCH a comment.
+6. If both are missing, fail with `summary failed: missing pr_number`. Do not write an artifact or PATCH a comment.
+
+## Required Reads
+
+Before remote operations, read:
+- `.agents/rules/issue-sync.md` to resolve upstream repository and permissions.
+- `.agents/rules/pr-sync.md` to reuse the PR summary hidden marker, Issues comments API, and shell safety rules.
+
+## Comment Lookup
+
+Fetch ordinary PR comments with the current platform's Issues comments API. Follow the concrete command pattern in `.agents/rules/pr-sync.md`.
+
+Find the `<!-- sync-pr:{task-id}:summary -->` summary comment. If it is missing, fail with `summary failed: missing sync-pr summary`.
+
+On failure, do not create an ordinary validation comment, do not create a partial summary comment, and do not write a `manual-validation*` artifact.
+
+## Manual Validation Scope Extraction
+
+- If a `### ⚠️ Manual Verification Required` section exists, take that section until the next `### ` heading.
+- If the current summary already says `### ✅ Manual Validation Passed`, allow a new validation artifact round and update the details.
+- If the current summary says `### ✅ No Manual Verification Needed`, stop and report that this PR does not need manual validation; do not mark it as passed.
+
+## Three-Branch Rendering
+
+The updated `{manual-validation-section}` is:
+
+```markdown
+### ✅ Manual Validation Passed
+
+- Validation time: {time}
+- Validation notes: {verification-summary}
+```
+
+Later `pr-sync` aggregation renders in this priority order:
+1. latest `manual-validation.md` / `manual-validation-r{N}.md` has a passed verdict -> `### ✅ Manual Validation Passed`
+2. no passed artifact and retained manual-validation items exist -> `### ⚠️ Manual Verification Required`
+3. no passed artifact and no retained manual-validation items -> `### ✅ No Manual Verification Needed`
+
+## PATCH Rules
+
+Update existing comments with Issues comments PATCH and follow the heredoc safety rules in `.agents/rules/pr-sync.md`.
+
+## Result Reporting
+
+Return `summary updated`, `summary skipped (no diff)`, or `summary failed: <reason>`.

package/templates/.agents/skills/complete-manual-validation/reference/summary-update.zh-CN.md

@@ -0,0 +1,87 @@
+# PR 摘要人工验证更新
+
+在 `complete-manual-validation` 更新 PR 摘要评论前先读取本文件。
+
+## 职责边界
+
+本文件只描述 PR 摘要评论更新流程。人工验证产物结构见 `reference/report-template.md`。
+
+## PR 号解析
+
+1. 从 `{task-ref}` 定位任务目录并读取 `task.md`。
+2. 优先读取 `task.md` frontmatter 的 `pr_number`。
+3. 如果 `pr_number` 为空，再从用户输入的 `{pr-ref}` 解析：
+   - `#123`
+   - `123`
+   - `{platform-host}/{owner}/{repo}/pull/123`
+4. 如果 `task.md` 已有 `pr_number`，且用户也传入 `{pr-ref}`，两者必须一致。
+5. 两者不一致时失败：`summary failed: pr_number mismatch`。不写 artifact，不 PATCH 评论。
+6. 两者都缺失时失败：`summary failed: missing pr_number`。不写 artifact，不 PATCH 评论。
+
+## 前置读取
+
+执行远端操作前先读取：
+- `.agents/rules/issue-sync.md`，完成 upstream 仓库检测和权限检测。
+- `.agents/rules/pr-sync.md`，复用 PR 摘要隐藏标记、Issues comments API 和 Shell 安全规则。
+
+## 评论查找
+
+使用当前平台的 Issues comments API 查询 PR 上的普通评论，具体命令遵循 `.agents/rules/pr-sync.md`。
+
+查找以以下标记开头或包含该标记的评论：
+
+```html
+<!-- sync-pr:{task-id}:summary -->
+```
+
+找不到时失败：
+
+```text
+summary failed: missing sync-pr summary
+```
+
+失败时不创建普通验证留言，不创建部分摘要评论，不写 `manual-validation*` artifact。
+
+## 待人工校验范围提取
+
+从当前摘要评论中提取人工校验范围：
+- 如果存在 `### ⚠️ 需人工校验` 段，取该段到下一个 `### ` heading 之前的内容。
+- 如果当前摘要已是 `### ✅ 人工验证已通过`，允许再次写入新一轮验证产物并更新详情。
+- 如果当前摘要是 `### ✅ 无需人工校验`，停止并提示当前 PR 无需人工校验；不误标为人工验证已通过。
+
+## 三分支渲染
+
+更新后的 `{manual-validation-section}` 为：
+
+```markdown
+### ✅ 人工验证已通过
+
+- 验证时间：{time}
+- 验证说明：{verification-summary}
+```
+
+后续 `pr-sync` 聚合时按以下优先级渲染：
+1. 最新 `manual-validation.md` / `manual-validation-r{N}.md` 结论为通过 -> `### ✅ 人工验证已通过`
+2. 没有通过产物且仍有保留人工校验项 -> `### ⚠️ 需人工校验`
+3. 没有通过产物且无保留人工校验项 -> `### ✅ 无需人工校验`
+
+## PATCH 规则
+
+更新已有评论时必须使用 Issues comments PATCH，具体命令遵循 `.agents/rules/pr-sync.md`。
+
+Shell 安全规则：
+- 先读取本地和远端正文，再构造完整正文。
+- heredoc 使用单引号 `<<'EOF'`。
+- 不在 heredoc 内执行变量展开或命令替换。
+- 构造含 `<!-- -->` 的正文时不用 `echo`。
+
+## 结果回传
+
+返回以下结果之一：
+- `summary updated`
+- `summary skipped (no diff)`
+- `summary failed: missing pr_number`
+- `summary failed: pr_number mismatch`
+- `summary failed: missing sync-pr summary`
+- `summary failed: no manual validation required`
+- `summary failed: <reason>`

package/templates/.agents/skills/create-pr/SKILL.en.md

@@ -165,3 +165,5 @@ Next step (alternative) - Skip monitoring and archive the task directly:
 - Push rejected: suggest `git pull --rebase`
 - Existing PR found: show the current PR URL and stop
 - Inaccessible Issue metadata: skip inheritance and continue
+- PR creation failed with an associated `{task-id}`: run `node .agents/scripts/workflow-warnings.js add .agents/workspace/active/{task-id} --step create-pr --severity ACTION_REQUIRED --code PR_CREATE_FAILED --target pr --message "{reason}" --action "Fix push, permission, or platform issues and rerun create-pr"` and do not write `pr_number`
+- PR summary comment failed with an associated `{task-id}`: record a `COMMENT_SYNC_FAILED` warning per `.agents/rules/pr-sync.md`, without rolling back an already-created PR

package/templates/.agents/skills/create-pr/SKILL.zh-CN.md

@@ -165,3 +165,5 @@ node .agents/scripts/validate-artifact.js gate create-pr .agents/workspace/activ
 - 推送被拒绝：建议执行 `git pull --rebase`
 - 已存在 PR：直接输出当前 PR URL 并结束
 - 无法访问 Issue 元数据：跳过继承并继续
+- PR 创建失败且已关联 `{task-id}`：调用 `node .agents/scripts/workflow-warnings.js add .agents/workspace/active/{task-id} --step create-pr --severity ACTION_REQUIRED --code PR_CREATE_FAILED --target pr --message "{reason}" --action "修复推送、权限或平台问题后重跑 create-pr"`，不写 `pr_number`
+- PR 摘要评论失败且已关联 `{task-id}`：按 `.agents/rules/pr-sync.md` 记录 `COMMENT_SYNC_FAILED` 告警，不回滚已创建 PR

package/templates/.agents/skills/create-task/SKILL.en.md

@@ -135,7 +135,7 @@ The rule's content is determined by the configured code platform:
 
 Handle the result:
 - Rule successfully created the Issue: `issue_number` has been written back to task.md per the rule; continue by reading `.agents/rules/issue-sync.md`, completing upstream repository and permission detection, then sync the task comment and set `status: waiting-for-triage` by rule
-- Rule failed (auth / network / template parse / etc.): do not roll back task.md; do NOT append an extra Activity Log entry; follow "Scenario C: Issue creation failed" output to surface `error_code` and `error_message` to the user so they can decide whether to retry manually or write `issue_number` later
+- Rule failed (auth / network / template parse / etc.): do not roll back task.md; do NOT append an extra Activity Log entry; first run `node .agents/scripts/workflow-warnings.js add .agents/workspace/active/{task-id} --step create-task --severity ACTION_REQUIRED --code ISSUE_CREATE_FAILED --target issue --message "{error_code}: {error_message}" --action "Fix auth/network/template issues and manually retry Issue creation, or create/find an Issue and write issue_number"` to record a generic warning; then follow "Scenario C: Issue creation failed" output to surface `error_code` and `error_message`
 - Rule was a no-op (custom or empty platform): do not create comments, do not block the workflow, and do not write an Activity Log entry
 - task.md already has `issue_number`: the rule's prerequisite check skips creation; `create-task` proceeds directly to step 5
 
@@ -231,6 +231,9 @@ Next step - run requirements analysis:
   - Codex CLI: $analyze-task {task-ref}
 
 For later platform sync: after fixing auth / network / template issues, manually run the Issue creation flow in `.agents/rules/create-issue.md` for this task; or manually create/find an Issue and write `issue_number` into task.md so later skills can take over cascade sync.
+
+[ACTION REQUIRED] Workflow warnings are open:
+  - WW-N ISSUE_CREATE_FAILED (issue): Fix auth/network/template issues and manually retry Issue creation, or create/find an Issue and write issue_number
 ```
 
 

package/templates/.agents/skills/create-task/SKILL.zh-CN.md

@@ -134,7 +134,7 @@ date "+%Y-%m-%d %H:%M:%S%:z"
 
 处理结果：
 - 规则成功创建 Issue：`issue_number` 已按规则回写到 task.md；继续读取 `.agents/rules/issue-sync.md`，完成 upstream 仓库检测和权限检测，然后同步 task 评论并按规则设置 `status: waiting-for-triage`
-- 规则失败（认证 / 网络 / 模板解析等）：不回滚 task.md；不追加额外 Activity Log；按"场景 C：Issue 创建失败"输出向用户透出 `error_code` 与 `error_message`，让用户决定后续是否手动重试或写入 `issue_number`
+- 规则失败（认证 / 网络 / 模板解析等）：不回滚 task.md；不追加额外 Activity Log；先调用 `node .agents/scripts/workflow-warnings.js add .agents/workspace/active/{task-id} --step create-task --severity ACTION_REQUIRED --code ISSUE_CREATE_FAILED --target issue --message "{error_code}: {error_message}" --action "修复认证/网络/模板问题后手动重试 Issue 创建，或手动创建/找到 Issue 后写入 issue_number"` 记录通用告警；再按"场景 C：Issue 创建失败"输出向用户透出 `error_code` 与 `error_message`
 - 规则为 no-op（自定义或空平台）：不创建评论，不阻塞后续工作流，不写 Activity Log
 - task.md 已存在 `issue_number`：规则中的前置检查会跳过；`create-task` 直接进入步骤 5
 
@@ -230,6 +230,9 @@ Issue 创建失败：
   - Codex CLI：$analyze-task {task-ref}
 
 后续如需平台同步：修复认证/网络/模板问题后，可按 `.agents/rules/create-issue.md` 对当前任务手动执行一次 Issue 创建；或手动创建/查找 Issue，并把 `issue_number` 写入 task.md，后续技能会接管级联同步。
+
+[ACTION REQUIRED] Workflow warnings are open:
+  - WW-N ISSUE_CREATE_FAILED (issue): 修复认证/网络/模板问题后手动重试 Issue 创建，或手动创建/找到 Issue 后写入 issue_number
 ```
 
 

package/templates/.agents/skills/update-agent-infra/scripts/sync-templates.js

@@ -29,11 +29,13 @@ const DEFAULTS = {
       "node22"
     ],
     "tools": [
+      "agent-infra",
       "claude-code",
       "codex",
       "gemini-cli",
       "opencode"
     ],
+    "refreshIntervalDays": 7,
     "dockerfile": null,
     "vm": {
       "cpu": null,
@@ -86,6 +88,9 @@ const DEFAULTS = {
 };
 
 const PACKAGE_NAME = '@fitlab-ai/agent-infra';
+const AGENT_INFRA_SANDBOX_TOOL = 'agent-infra';
+const LEGACY_DEFAULT_SANDBOX_TOOLS = ['claude-code', 'codex', 'gemini-cli', 'opencode'];
+const DEFAULT_SANDBOX_TOOLS = [AGENT_INFRA_SANDBOX_TOOL, ...LEGACY_DEFAULT_SANDBOX_TOOLS];
 // Add a new identifier here only after shipping matching .{platform}. template variants.
 const KNOWN_PLATFORMS = new Set(['github']);
 const KNOWN_LANGUAGES = new Set(['en', 'zh-CN']);
@@ -123,6 +128,26 @@ function isPathOwnedByDisabledTUI(rel, enabledSet) {
   return false;
 }
 
+function isLegacyDefaultSandboxTools(value) {
+  if (!Array.isArray(value) || value.length !== LEGACY_DEFAULT_SANDBOX_TOOLS.length) {
+    return false;
+  }
+  const tools = new Set(value);
+  return LEGACY_DEFAULT_SANDBOX_TOOLS.every(tool => tools.has(tool));
+}
+
+function migrateSandboxTools(cfg) {
+  const tools = cfg.sandbox?.tools;
+  if (!isLegacyDefaultSandboxTools(tools)) {
+    return false;
+  }
+  cfg.sandbox = {
+    ...cfg.sandbox,
+    tools: [...DEFAULT_SANDBOX_TOOLS]
+  };
+  return true;
+}
+
 function norm(p) { return p.replace(/\\/g, '/'); }
 
 function normDir(p) {
@@ -236,6 +261,12 @@ function listTemplateSkillNames(templateRoot) {
   return new Set(
     fs.readdirSync(templateSkillsDir, { withFileTypes: true })
       .filter((entry) => entry.isDirectory())
+      .filter((entry) => {
+        const skillDir = path.join(templateSkillsDir, entry.name);
+        return ['SKILL.md', 'SKILL.en.md', 'SKILL.zh-CN.md'].some((file) =>
+          fs.existsSync(path.join(skillDir, file))
+        );
+      })
       .map((entry) => entry.name)
   );
 }
@@ -1296,6 +1327,7 @@ function syncTemplates(projectRoot, templateRootOverride) {
   ) > 0;
 
   const prevVersion = cfg.templateVersion;
+  const sandboxToolsMigrated = migrateSandboxTools(cfg);
 
   cfg.files.managed = managed;
   cfg.files.merged  = merged;
@@ -1303,7 +1335,7 @@ function syncTemplates(projectRoot, templateRootOverride) {
   cfg.templateVersion = version;
   delete cfg.templateSource;
 
-  report.configUpdated = hasChanges || prevVersion !== version || hadTemplateSource;
+  report.configUpdated = hasChanges || prevVersion !== version || hadTemplateSource || sandboxToolsMigrated;
 
   fs.writeFileSync(cfgPath, JSON.stringify(cfg, null, 2) + '\n', 'utf8');
 

package/templates/.agents/templates/task.en.md

@@ -64,6 +64,13 @@ pr_status: pending             # PR status: pending (default) | created (PR crea
 
 <!-- Humans record rulings for needs-human-decision decisions here and flip matching HD- rows in the Review Disagreement Ledger to human-decided. -->
 
+## Workflow Warnings
+
+<!-- Workflow degradation, platform sync failures, permission gaps, and related events. Keep the header when empty. -->
+
+| id | time | step | severity | code | status | target | message | action | resolved_at | resolution |
+|----|------|------|----------|------|--------|--------|---------|--------|-------------|------------|
+
 ## Activity Log
 
 <!-- Append a new entry for each workflow step. Do NOT overwrite previous entries. -->

package/templates/.agents/templates/task.zh-CN.md

@@ -64,6 +64,13 @@ pr_status: pending             # PR 状态：pending（默认）| created（已
 
 <!-- 人类在此记录对 needs-human-decision 决策的裁定，并把 ## 审查分歧账本 对应 HD- 行翻为 human-decided。 -->
 
+## 工作流告警
+
+<!-- 工作流降级、平台同步失败、权限不足等需要后续注意的事件写入此段。无告警时保留表头即可。 -->
+
+| id | time | step | severity | code | status | target | message | action | resolved_at | resolution |
+|----|------|------|----------|------|--------|--------|---------|--------|-------------|------------|
+
 ## 活动日志
 
 <!-- 每个工作流步骤追加一条新记录，不要覆盖之前的记录。 -->

package/templates/.claude/commands/complete-manual-validation.en.md

@@ -0,0 +1,9 @@
+---
+description: "Mark PR manual validation as completed and update the summary comment"
+usage: "/complete-manual-validation <task-id> [pr-ref] <verification-summary>"
+disable-model-invocation: true
+---
+
+Read and execute the complete-manual-validation skill from `.agents/skills/complete-manual-validation/SKILL.md`.
+
+Follow all steps defined in the skill exactly.

package/templates/.claude/commands/complete-manual-validation.zh-CN.md

@@ -0,0 +1,9 @@
+---
+description: "标记 PR 人工验证已完成并更新摘要评论"
+usage: "/complete-manual-validation <task-id> [pr-ref] <verification-summary>"
+disable-model-invocation: true
+---
+
+读取并执行 `.agents/skills/complete-manual-validation/SKILL.md` 中的 complete-manual-validation 技能。
+
+严格按照技能中定义的所有步骤执行。

package/templates/.gemini/commands/_project_/complete-manual-validation.en.toml

@@ -0,0 +1,8 @@
+description = "Mark PR manual validation as completed and update the summary comment"
+prompt = """
+Complete manual validation: {{args}}
+
+Read and execute the complete-manual-validation skill from `.agents/skills/complete-manual-validation/SKILL.md`.
+
+Follow all steps defined in the skill exactly.
+"""

package/templates/.gemini/commands/_project_/complete-manual-validation.zh-CN.toml

@@ -0,0 +1,8 @@
+description = "标记 PR 人工验证已完成并更新摘要评论"
+prompt = """
+完成人工验证：{{args}}
+
+读取并执行 `.agents/skills/complete-manual-validation/SKILL.md` 中的 complete-manual-validation 技能。
+
+严格按照技能中定义的所有步骤执行。
+"""

package/templates/.github/workflows/metadata-sync.yml

@@ -87,6 +87,11 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           TYPE: ${{ steps.metadata.outputs.type }}
         run: |
+          OWNER_TYPE=$(gh api "repos/$GITHUB_REPOSITORY" --jq '.owner.type // empty' 2>/dev/null || true)
+          if [ "$OWNER_TYPE" != "Organization" ]; then
+            exit 0
+          fi
+
           case "$TYPE" in
             bug|bugfix)          ISSUE_TYPE="Bug" ;;
             feature|enhancement) ISSUE_TYPE="Feature" ;;

package/templates/.opencode/commands/complete-manual-validation.en.md

@@ -0,0 +1,11 @@
+---
+description: "Mark PR manual validation as completed and update the summary comment"
+agent: general
+subtask: false
+---
+
+Complete manual validation: $ARGUMENTS
+
+Read and execute the complete-manual-validation skill from `.agents/skills/complete-manual-validation/SKILL.md`.
+
+Follow all steps defined in the skill exactly.

package/templates/.opencode/commands/complete-manual-validation.zh-CN.md

@@ -0,0 +1,11 @@
+---
+description: "标记 PR 人工验证已完成并更新摘要评论"
+agent: general
+subtask: false
+---
+
+完成人工验证：$ARGUMENTS
+
+读取并执行 `.agents/skills/complete-manual-validation/SKILL.md` 中的 complete-manual-validation 技能。
+
+严格按照技能中定义的所有步骤执行。