@fitlab-ai/agent-infra 0.8.1 → 0.8.3

package/lib/task/commands/status.ts

@@ -6,7 +6,9 @@ import { resolveTaskRef } from '../resolve-ref.ts';
 import { enumerateArtifacts, type Artifact } from '../artifacts.ts';
 import { parseTaskFrontmatter, extractTitle, type Frontmatter } from '../frontmatter.ts';
 import { loadShortIdByTaskId } from '../short-id.ts';
+import { getOpenWorkflowWarnings, formatWorkflowWarningSummary, type WorkflowWarning } from '../workflow-warnings.ts';
 import { parseActivityLog, pairEntries } from './log.ts';
+import { statusCard, type DisplayMessage } from '../../server/display.ts';
 
 const USAGE = `Usage: ai task status <N | #N | TASK-id>
 
@@ -322,12 +324,28 @@ type StatusModel = {
   shortId: string;
   title: string;
   metadata: [string, string][];
+  workflowWarnings: WorkflowWarning[];
   artifacts: { count: number; groups: { stage: string; files: string[] }[] };
   workflow: WorkflowInfo;
   runtime: RuntimeInfo;
   git: GitInfo;
 };
 
+type BuildStatusModelInput = {
+  taskId: string;
+  taskDir: string;
+  taskMdPath: string;
+  repoRoot: string;
+  shortId?: string;
+  run?: Runner;
+  now?: Date;
+};
+
+type BuildStatusModelOptions = {
+  run?: Runner;
+  now?: Date;
+};
+
 // Indent each label/value pair by two spaces and pad labels to a common width so
 // every section reads as an aligned "key   value" block.
 function renderPairs(rows: [string, string][]): string[] {
@@ -343,6 +361,14 @@ function renderStatus(model: StatusModel): string[] {
 
   lines.push('', 'Metadata', ...renderPairs(model.metadata));
 
+  if (model.workflowWarnings.length > 0) {
+    lines.push(
+      '',
+      `Workflow Warnings (${model.workflowWarnings.length} open)`,
+      ...formatWorkflowWarningSummary(model.workflowWarnings).map((line) => `  ${line}`)
+    );
+  }
+
   lines.push('', `Artifacts (${model.artifacts.count})`);
   if (model.artifacts.groups.length === 0) {
     lines.push('  (none)');
@@ -394,36 +420,89 @@ function renderStatus(model: StatusModel): string[] {
   return lines;
 }
 
-function status(args: string[] = []): void {
-  if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
-    process.stdout.write(USAGE);
-    if (args.length === 0) process.exitCode = 1;
-    return;
-  }
-
-  const resolved = resolveTaskRef(args[0]!);
-  if (!resolved.ok) {
-    process.stderr.write(`ai task status: ${resolved.message}\n`);
-    process.exitCode = 1;
-    return;
+function modelTone(model: StatusModel): 'info' | 'success' | 'warning' | 'danger' | 'running' {
+  if (model.workflow.state === 'in-progress') return model.workflow.stale === 'yes' ? 'warning' : 'running';
+  if (model.metadata.some(([key, value]) => key === 'status' && value === 'completed')) return 'success';
+  if (model.metadata.some(([key, value]) => key === 'status' && (value === 'blocked' || value === 'cancelled'))) {
+    return 'danger';
   }
+  return 'info';
+}
 
-  const content = fs.readFileSync(resolved.taskMdPath, 'utf8');
+function buildFromResolved(input: BuildStatusModelInput): StatusModel {
+  const content = fs.readFileSync(input.taskMdPath, 'utf8');
   const fm = parseTaskFrontmatter(content);
-  const run = makeRunner(resolved.repoRoot);
-  const artifacts = enumerateArtifacts(resolved.taskDir);
-  const workflow = collectWorkflow(content);
+  const run = input.run ?? makeRunner(input.repoRoot);
+  const artifacts = enumerateArtifacts(input.taskDir);
+  const workflow = collectWorkflow(content, input.now);
 
-  const model: StatusModel = {
-    taskId: resolved.taskId,
-    shortId: loadShortIdByTaskId(resolved.repoRoot).get(resolved.taskId) ?? DASH,
+  return {
+    taskId: input.taskId,
+    shortId: input.shortId ?? loadShortIdByTaskId(input.repoRoot).get(input.taskId) ?? DASH,
     title: extractTitle(content),
     metadata: collectMetadata(fm),
+    workflowWarnings: getOpenWorkflowWarnings(content),
     artifacts: { count: artifacts.length, groups: groupArtifacts(artifacts) },
     workflow,
-    runtime: collectRuntime(resolved.taskDir, workflow, run),
+    runtime: collectRuntime(input.taskDir, workflow, run),
     git: collectGit(fm.branch ?? '', run)
   };
+}
+
+function buildStatusModel(ref: string, options?: BuildStatusModelOptions): StatusModel;
+function buildStatusModel(input: BuildStatusModelInput): StatusModel;
+function buildStatusModel(
+  refOrInput: string | BuildStatusModelInput,
+  options: BuildStatusModelOptions = {}
+): StatusModel {
+  if (typeof refOrInput !== 'string') {
+    return buildFromResolved(refOrInput);
+  }
+
+  const resolved = resolveTaskRef(refOrInput);
+  if (!resolved.ok) {
+    throw new Error(resolved.message);
+  }
+
+  return buildFromResolved({
+    taskId: resolved.taskId,
+    taskDir: resolved.taskDir,
+    taskMdPath: resolved.taskMdPath,
+    repoRoot: resolved.repoRoot,
+    run: options.run,
+    now: options.now
+  });
+}
+
+function statusModelToDisplay(model: StatusModel): DisplayMessage {
+  return statusCard(
+    `Task ${model.taskId} (${model.shortId})`,
+    modelTone(model),
+    [
+      ['workflow', model.workflow.state],
+      ['step', model.workflow.step],
+      ['runtime', model.runtime.status],
+      ['git', model.git.uncommitted]
+    ],
+    renderStatus(model).join('\n')
+  );
+}
+
+function status(args: string[] = []): void {
+  if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
+    process.stdout.write(USAGE);
+    if (args.length === 0) process.exitCode = 1;
+    return;
+  }
+
+  let model: StatusModel;
+  try {
+    model = buildStatusModel(args[0]!);
+  } catch (error) {
+    process.stderr.write(`ai task status: ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+    return;
+  }
 
   for (const line of renderStatus(model)) {
     process.stdout.write(`${line}\n`);
@@ -433,12 +512,14 @@ function status(args: string[] = []): void {
 export {
   status,
   makeRunner,
+  buildStatusModel,
   collectMetadata,
   groupArtifacts,
   collectGit,
   collectWorkflow,
   collectRuntime,
   renderStatus,
+  statusModelToDisplay,
   METADATA_KEYS
 };
-export type { Runner, GitInfo, WorkflowInfo, RuntimeInfo, StatusModel };
+export type { Runner, GitInfo, WorkflowInfo, RuntimeInfo, StatusModel, BuildStatusModelInput };

package/lib/task/workflow-warnings.ts

@@ -0,0 +1,121 @@
+import { extractSection } from './sections.ts';
+
+const WORKFLOW_WARNING_HEADINGS = ['工作流告警', 'Workflow Warnings'];
+const WORKFLOW_WARNING_STATUSES = new Set(['open', 'resolved', 'ignored']);
+const WORKFLOW_WARNING_SEVERITIES = new Set(['IMPORTANT', 'ACTION_REQUIRED']);
+
+type WorkflowWarning = {
+  id: string;
+  time: string;
+  step: string;
+  severity: string;
+  code: string;
+  status: string;
+  target: string;
+  message: string;
+  action: string;
+  resolvedAt: string;
+  resolution: string;
+};
+
+function splitTableRow(line: string): string[] {
+  let value = line.trim();
+  if (!value.startsWith('|')) return [];
+  value = value.replace(/^\|/, '').replace(/\|$/, '');
+
+  const cells: string[] = [];
+  let cell = '';
+  for (let index = 0; index < value.length; index += 1) {
+    const char = value[index]!;
+    if (char === '|' && !isEscapedAt(value, index)) {
+      cells.push(unescapeTableCell(cell.trim()));
+      cell = '';
+      continue;
+    }
+    cell += char;
+  }
+  cells.push(unescapeTableCell(cell.trim()));
+  return cells;
+}
+
+function unescapeTableCell(value: string): string {
+  let output = '';
+  for (let index = 0; index < value.length; index += 1) {
+    const char = value[index]!;
+    const next = value[index + 1];
+    if (char === '\\' && (next === '\\' || next === '|')) {
+      output += next;
+      index += 1;
+      continue;
+    }
+    output += char;
+  }
+  return output;
+}
+
+function isEscapedAt(value: string, index: number): boolean {
+  let backslashes = 0;
+  for (let cursor = index - 1; cursor >= 0 && value[cursor] === '\\'; cursor -= 1) {
+    backslashes += 1;
+  }
+  return backslashes % 2 === 1;
+}
+
+function isSeparatorRow(cells: string[]): boolean {
+  return cells.length > 0 && cells.every((cell) => /^:?-{3,}:?$/.test(cell));
+}
+
+/**
+ * Parses well-formed workflow warning rows. Malformed rows are intentionally
+ * ignored here; validate-artifact is responsible for reporting structure errors.
+ */
+function parseWorkflowWarnings(content: string): WorkflowWarning[] {
+  const section = extractSection(content, WORKFLOW_WARNING_HEADINGS);
+  if (!section) return [];
+
+  const rows: WorkflowWarning[] = [];
+  for (const rawLine of section.split(/\r?\n/)) {
+    const cells = splitTableRow(rawLine);
+    if (cells.length === 0) continue;
+    if ((cells[0] ?? '').toLowerCase() === 'id') continue;
+    if (isSeparatorRow(cells)) continue;
+    if (cells.length < 11) continue;
+
+    rows.push({
+      id: cells[0] ?? '',
+      time: cells[1] ?? '',
+      step: cells[2] ?? '',
+      severity: cells[3] ?? '',
+      code: cells[4] ?? '',
+      status: cells[5] ?? '',
+      target: cells[6] ?? '',
+      message: cells[7] ?? '',
+      action: cells[8] ?? '',
+      resolvedAt: cells[9] ?? '',
+      resolution: cells[10] ?? ''
+    });
+  }
+  return rows;
+}
+
+function getOpenWorkflowWarnings(content: string): WorkflowWarning[] {
+  return parseWorkflowWarnings(content).filter((warning) => warning.status === 'open');
+}
+
+function formatWorkflowWarningSummary(warnings: readonly WorkflowWarning[]): string[] {
+  return warnings.map((warning) => {
+    const target = warning.target ? ` ${warning.target}` : '';
+    const action = warning.action ? ` - ${warning.action}` : '';
+    return `${warning.id} [${warning.severity}] ${warning.code}${target}${action}`;
+  });
+}
+
+export {
+  WORKFLOW_WARNING_HEADINGS,
+  WORKFLOW_WARNING_STATUSES,
+  WORKFLOW_WARNING_SEVERITIES,
+  parseWorkflowWarnings,
+  getOpenWorkflowWarnings,
+  formatWorkflowWarningSummary
+};
+export type { WorkflowWarning };

package/lib/update.ts

@@ -40,6 +40,9 @@ const defaults = JSON.parse(
 
 const CONFIG_DIR = '.agents';
 const CONFIG_PATH = path.join(CONFIG_DIR, '.airc.json');
+const AGENT_INFRA_SANDBOX_TOOL = 'agent-infra';
+const LEGACY_DEFAULT_SANDBOX_TOOLS = ['claude-code', 'codex', 'gemini-cli', 'opencode'];
+const DEFAULT_SANDBOX_TOOLS = [AGENT_INFRA_SANDBOX_TOOL, ...LEGACY_DEFAULT_SANDBOX_TOOLS];
 
 // One-time migration of the legacy project-level PR switch to the three-state
 // `prFlow` preference. `true` (the old default / "PR flow on") maps to the
@@ -60,6 +63,26 @@ function migratePrFlow(config: UpdateConfig): 'required' | 'disabled' | null {
   return null;
 }
 
+function isLegacyDefaultSandboxTools(value: unknown): value is string[] {
+  if (!Array.isArray(value) || value.length !== LEGACY_DEFAULT_SANDBOX_TOOLS.length) {
+    return false;
+  }
+  const tools = new Set(value);
+  return LEGACY_DEFAULT_SANDBOX_TOOLS.every((tool) => tools.has(tool));
+}
+
+function migrateSandboxTools(config: UpdateConfig): boolean {
+  const tools = config.sandbox?.tools;
+  if (!isLegacyDefaultSandboxTools(tools)) {
+    return false;
+  }
+  config.sandbox = {
+    ...config.sandbox,
+    tools: [...DEFAULT_SANDBOX_TOOLS]
+  };
+  return true;
+}
+
 function isPathOwnedByOtherPlatform(relativePath: string, platformType: string): boolean {
   const top = String(relativePath || '').replace(/\\/g, '/').replace(/^\.\//, '').split('/')[0] ?? '';
   if (!top.startsWith('.')) return false;
@@ -215,6 +238,7 @@ async function cmdUpdate(): Promise<void> {
   const taskAdded = !config.task;
   const labelsAdded = !config.labels;
   const prFlowMigrated = migratePrFlow(config);
+  const sandboxToolsMigrated = !sandboxAdded && migrateSandboxTools(config);
   let configChanged = changed;
 
   if (platformAdded) {
@@ -241,6 +265,10 @@ async function cmdUpdate(): Promise<void> {
     configChanged = true;
   }
 
+  if (sandboxToolsMigrated) {
+    configChanged = true;
+  }
+
   if (configChanged) {
     console.log('');
     if (hasNewEntries) {
@@ -267,6 +295,9 @@ async function cmdUpdate(): Promise<void> {
       if (prFlowMigrated) {
         info(`Migrated legacy requiresPullRequest to prFlow="${prFlowMigrated}" in ${CONFIG_PATH}.`);
       }
+      if (sandboxToolsMigrated) {
+        info(`Migrated default sandbox.tools to include ${AGENT_INFRA_SANDBOX_TOOL} in ${CONFIG_PATH}.`);
+      }
     } else {
       info(`File registry changed in ${CONFIG_PATH}.`);
     }
@@ -285,6 +316,9 @@ async function cmdUpdate(): Promise<void> {
     if (hasNewEntries && prFlowMigrated) {
       info(`Migrated legacy requiresPullRequest to prFlow="${prFlowMigrated}" in ${CONFIG_PATH}.`);
     }
+    if (hasNewEntries && sandboxToolsMigrated) {
+      info(`Migrated default sandbox.tools to include ${AGENT_INFRA_SANDBOX_TOOL} in ${CONFIG_PATH}.`);
+    }
     fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2) + '\n', 'utf8');
     ok(`Updated ${CONFIG_PATH}`);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fitlab-ai/agent-infra",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "description": "Bootstrap tool for AI multi-tool collaboration infrastructure — works with Claude Code, Codex, Gemini CLI, and OpenCode",
   "license": "MIT",
   "type": "module",
@@ -29,7 +29,7 @@
     "templates/"
   ],
   "engines": {
-    "node": ">=22"
+    "node": ">=22.9.0"
   },
   "keywords": [
     "ai",
@@ -67,7 +67,7 @@
     "@types/cross-spawn": "^6.0.6",
     "@types/node": "^22.20.0",
     "@types/semver": "^7.7.1",
-    "typescript": "~6.0"
+    "typescript": "~7.0"
   },
   "optionalDependencies": {
     "@lydell/node-pty": "^1.2.0-beta.12"

package/templates/.agents/README.en.md

@@ -260,7 +260,7 @@ Supported `invoke` placeholders:
 | Placeholder | Replaced with | Example |
 |-------------|---------------|---------|
 | `${skillName}` | The skill command name, such as `review-code` or `commit`. | `<your-cli> ${skillName}` -> `<your-cli> review-code` |
-| `${projectName}` | The `.airc.json` `project` value. Use this for namespaced commands. | `/${projectName}:${skillName}` -> `/agent-infra:review-code` |
+| `${projectName}` | The `.airc.json` `project` value. Use this for namespaced commands. | `/${projectName}:${skillName}` -> `/your-project:review-code` |
 
 Non-namespaced custom TUI:
 
@@ -280,7 +280,7 @@ Namespaced custom TUI:
 
 ```json
 {
-  "project": "agent-infra",
+  "project": "your-project",
   "customTUIs": [
     {
       "name": "<your-tui-name>",
@@ -295,7 +295,7 @@ Namespaced custom TUI:
 
 ## Sandbox Custom Tools
 
-`customTUIs` (above) generates slash-command files but does not change the sandbox image. To install a non-npm TUI (pip / cargo / curl-based / pre-built binary) into the sandbox image and live-mount its credentials, declare it under `sandbox.customTools` in `.agents/.airc.json`. Built-in tools (`claude-code`, `codex`, `opencode`, `gemini-cli`) keep working unchanged.
+`customTUIs` generates slash-command files but does not change the sandbox image. To install a non-npm CLI or tool (pip / cargo / curl-based / pre-built binary) into the sandbox image and live-mount its credentials, declare it under `sandbox.customTools` in `.agents/.airc.json`. Built-in sandbox tools (`claude-code`, `codex`, `opencode`, `gemini-cli`, `agent-infra`) keep working unchanged; `agent-infra` only provides the in-sandbox `ai` / `agent-infra` CLI and is not part of `tuis` or `customTUIs`.
 
 ### Required fields
 

package/templates/.agents/README.zh-CN.md

@@ -260,7 +260,7 @@ args: "<task-id>"   # 可选
 | 占位符 | 替换为 | 示例 |
 |--------|--------|------|
 | `${skillName}` | skill 命令名，例如 `review-code` 或 `commit`。 | `<your-cli> ${skillName}` -> `<your-cli> review-code` |
-| `${projectName}` | `.airc.json` 中的 `project` 值，适用于带命名空间的命令。 | `/${projectName}:${skillName}` -> `/agent-infra:review-code` |
+| `${projectName}` | `.airc.json` 中的 `project` 值，适用于带命名空间的命令。 | `/${projectName}:${skillName}` -> `/your-project:review-code` |
 
 不带命名空间的自定义 TUI：
 
@@ -280,7 +280,7 @@ args: "<task-id>"   # 可选
 
 ```json
 {
-  "project": "agent-infra",
+  "project": "your-project",
   "customTUIs": [
     {
       "name": "<your-tui-name>",
@@ -295,7 +295,7 @@ args: "<task-id>"   # 可选
 
 ## 沙箱自定义工具（Sandbox Custom Tools）
 
-上文 `customTUIs` 只负责生成 slash-command 文件，**不影响沙箱镜像**。如果要把一个非 npm 分发的 TUI（pip / cargo / curl 脚本 / 裸二进制）装进沙箱镜像、并 live-mount 它的凭证目录，需要在 `.agents/.airc.json` 的 `sandbox.customTools` 中声明。内建的四个工具（`claude-code` / `codex` / `opencode` / `gemini-cli`）行为保持不变。
+`customTUIs` 只负责生成 slash-command 文件，**不影响沙箱镜像**。如果要把一个非 npm 分发的 CLI 或工具（pip / cargo / curl 脚本 / 裸二进制）装进沙箱镜像、并 live-mount 它的凭证目录，需要在 `.agents/.airc.json` 的 `sandbox.customTools` 中声明。内建 sandbox 工具（`claude-code` / `codex` / `opencode` / `gemini-cli` / `agent-infra`）行为保持不变；其中 `agent-infra` 只提供沙箱内 `ai` / `agent-infra` CLI，不属于 `tuis` 或 `customTUIs` 配置。
 
 ### 必填字段
 

package/templates/.agents/rules/create-issue.github.en.md

@@ -101,7 +101,7 @@ If the final label set is empty, omit the `--label` argument.
 | `feature`, `enhancement` | `Feature` |
 | `task`, `documentation`, `dependency-upgrade`, `chore`, `docs`, `refactor`, `refactoring`, others | `Task` |
 
-When applying the Issue Type, follow the "Set Issue Type" command in `.agents/rules/issue-pr-commands.md`; first call `gh api orgs/{owner}/issue-types` to list the org's actually available Types, and only set the inferred value when it is present in that list. Failure to set is non-blocking.
+When applying the Issue Type, follow the "Set Issue Type" command in `.agents/rules/issue-pr-commands.md`; only when the owner type is `Organization`, first call `gh api orgs/{owner}/issue-types` to list the org's actually available Types, and only set the inferred value when it is present in that list. User repositories, failed owner type probes, and failed writes are non-blocking.
 
 #### milestone
 
@@ -149,7 +149,7 @@ After success, parse the Issue number from the output (match only the `https://.
 
 ### 6. Set Issue Type (Optional)
 
-Execute only when `has_push=true` and the Issue Type inferred in §4 is in the org's actually available list:
+Execute only when `has_push=true`, the owner type is `Organization`, and the Issue Type inferred in §4 is in the org's actually available list:
 
 ```bash
 gh api "repos/$upstream_repo/issues/{issue-number}" -X PATCH \
@@ -188,4 +188,4 @@ Hand the following back to the caller `create-task`:
 - Auth failure / command unavailable: return a structured `{code: "AUTH_FAILED", message}` to `create-task`; do not modify task.md
 - Network timeout / DNS failure: `{code: "NETWORK", message}`
 - Template parsing failure, Issue number parsing failure, other anomalies: `{code: "VALIDATION", message}`
-- All failures keep task.md untouched; `create-task` takes the "Scenario C: failure fallback" output branch and prompts the user to retry manually or fill `issue_number` later
+- All failures keep task.md untouched; `create-task` must record the structured error in `## Workflow Warnings` (`severity=ACTION_REQUIRED`, `code=ISSUE_CREATE_FAILED`, `target=issue`) before taking the "Scenario C: failure fallback" output branch and prompting the user to retry manually or fill `issue_number` later

package/templates/.agents/rules/create-issue.github.zh-CN.md

@@ -101,7 +101,7 @@ ai task issue-body {task-id} > "{body-file}"
 | `feature`, `enhancement` | `Feature` |
 | `task`, `documentation`, `dependency-upgrade`, `chore`, `docs`, `refactor`, `refactoring` 及其它 | `Task` |
 
-实际设置时按 `.agents/rules/issue-pr-commands.md` 的 "设置 Issue Type" 命令；先调 `gh api orgs/{owner}/issue-types` 列出 org 实际可用的 Type，仅当推断值在列表中时才设置；设置失败不阻断流程。
+实际设置时按 `.agents/rules/issue-pr-commands.md` 的 "设置 Issue Type" 命令；仅当 owner type 为 `Organization` 时，先调 `gh api orgs/{owner}/issue-types` 列出 org 实际可用的 Type，并且仅当推断值在列表中时才设置；个人仓库、owner type 探测失败或设置失败都不阻断流程。
 
 #### milestone
 
@@ -149,7 +149,7 @@ gh issue create -R "$upstream_repo" \
 
 ### 6. 设置 Issue Type（可选）
 
-仅当 `has_push=true` 且 §4 推断的 Issue Type 在 org 实际可用列表中时执行：
+仅当 `has_push=true`、owner type 为 `Organization`，且 §4 推断的 Issue Type 在 org 实际可用列表中时执行：
 
 ```bash
 gh api "repos/$upstream_repo/issues/{issue-number}" -X PATCH \
@@ -188,4 +188,4 @@ gh api "repos/$upstream_repo/issues/{issue-number}" -X PATCH \
 - 认证失败 / 命令不可用：返回结构化错误 `{code: "AUTH_FAILED", message}` 给 `create-task`，不修改 task.md
 - 网络超时 / DNS 失败：`{code: "NETWORK", message}`
 - 模板解析失败、Issue 编号解析失败、其它异常：`{code: "VALIDATION", message}`
-- 任意失败均不回滚 task.md；`create-task` 走"场景 C 失败兜底"输出，提示用户手动重试或在事后写入 `issue_number`
+- 任意失败均不回滚 task.md；`create-task` 必须把结构化错误写入 `## 工作流告警`（`severity=ACTION_REQUIRED`，`code=ISSUE_CREATE_FAILED`，`target=issue`），再走"场景 C 失败兜底"输出，提示用户手动重试或在事后写入 `issue_number`

package/templates/.agents/rules/issue-pr-commands.github.en.md

@@ -83,11 +83,16 @@ gh issue create -R "$upstream_repo" --title "{title}" --body "{body}" --assignee
 Set the Issue Type:
 
 ```bash
-gh api "orgs/{owner}/issue-types" --jq '.[].name'
-gh api "repos/$upstream_repo/issues/{issue-number}" -X PATCH -f type="{issue-type}" --silent
+owner_type=$(gh api "repos/$upstream_repo" --jq '.owner.type // empty' 2>/dev/null || true)
+if [ "$owner_type" = "Organization" ]; then
+  owner=${upstream_repo%%/*}
+  gh api "orgs/$owner/issue-types" --jq '.[].name'
+  gh api "repos/$upstream_repo/issues/{issue-number}" -X PATCH -f type="{issue-type}" --silent
+fi
 ```
 
 - set the Issue Type only when `has_push=true`; otherwise skip and continue
+- query and set Issue Type only when the owner type is `Organization`; skip and continue for user repositories or failed owner type probes
 - when changing an existing Issue Type, read `.agents/rules/issue-fields.md` and use Flow B so same-name pinned fields are migrated and fields absent from the new type are cleared
 
 ## Update Issues

package/templates/.agents/rules/issue-pr-commands.github.zh-CN.md

@@ -83,11 +83,16 @@ gh issue create -R "$upstream_repo" --title "{title}" --body "{body}" --assignee
 设置 Issue Type：
 
 ```bash
-gh api "orgs/{owner}/issue-types" --jq '.[].name'
-gh api "repos/$upstream_repo/issues/{issue-number}" -X PATCH -f type="{issue-type}" --silent
+owner_type=$(gh api "repos/$upstream_repo" --jq '.owner.type // empty' 2>/dev/null || true)
+if [ "$owner_type" = "Organization" ]; then
+  owner=${upstream_repo%%/*}
+  gh api "orgs/$owner/issue-types" --jq '.[].name'
+  gh api "repos/$upstream_repo/issues/{issue-number}" -X PATCH -f type="{issue-type}" --silent
+fi
 ```
 
 - 仅当 `has_push=true` 时执行 Issue Type 设置；否则跳过并继续
+- 仅当 owner type 为 `Organization` 时查询和设置 Issue Type；个人仓库或 owner type 探测失败时跳过并继续
 - 变更现有 Issue Type 时，先读取 `.agents/rules/issue-fields.md` 并使用流程 B，确保同名 pinned fields 迁移，且新 type 不包含的字段被清空
 
 ## Issue 更新

package/templates/.agents/rules/issue-sync.github.en.md

@@ -66,6 +66,17 @@ Key rules:
 - insufficient permission only affects direct Issue metadata writes and must not stop the skill
 - keep the existing `2>/dev/null || true` error-tolerance pattern
 
+When the caller has a `{task-id}` / task directory, permission degradation or critical sync failure must be recorded in `## Workflow Warnings`:
+
+```bash
+node .agents/scripts/workflow-warnings.js add .agents/workspace/active/{task-id} \
+  --step issue-sync --severity IMPORTANT --code PERMISSION_DEGRADED \
+  --target "{operation}" --message "{reason}" \
+  --action "Wait for the bot/maintainer to backfill, or rerun the workflow step after permissions are available"
+```
+
+Comment create/update failures and exhausted network retries that affect reviewer visibility use `severity=ACTION_REQUIRED` with `code=COMMENT_SYNC_FAILED` or `NETWORK_RETRY_EXHAUSTED`.
+
 ## External Contributor Locking
 
 Maintainers (`has_triage=true`) are never blocked. External contributors (`has_triage=false`) must check whether the current task already has a `task` comment author on the Issue before they start.
@@ -210,6 +221,8 @@ EOF
 
 Comment publishing is not gated by `has_triage` or `has_push`.
 
+If comment lookup, creation, or update fails and the caller has a task directory, record a Workflow Warning (`step=issue-sync`, `severity=ACTION_REQUIRED`, `code=COMMENT_SYNC_FAILED`, `target={file-stem}`) and surface it in the final Workflow Warnings output block.
+
 ## task.md Comment Sync
 
 Hidden marker:

package/templates/.agents/rules/issue-sync.github.zh-CN.md

@@ -66,6 +66,17 @@ has_push=$(printf '%s' "$repo_perms" | grep -q '"push":true' 2>/dev/null && echo
 - 权限不足只影响直接写 Issue 元数据的步骤，不中断整个技能
 - 现有 `2>/dev/null || true` 容错模式保持不变
 
+当调用方存在 `{task-id}` / task 目录时，权限降级或关键同步失败必须写入 `## 工作流告警`：
+
+```bash
+node .agents/scripts/workflow-warnings.js add .agents/workspace/active/{task-id} \
+  --step issue-sync --severity IMPORTANT --code PERMISSION_DEGRADED \
+  --target "{operation}" --message "{reason}" \
+  --action "等待 bot/维护者补位，或在具备权限后重跑对应 workflow 步骤"
+```
+
+评论创建 / 更新失败、网络重试耗尽等影响后续 reviewer 可见性的失败使用 `severity=ACTION_REQUIRED` 和 `code=COMMENT_SYNC_FAILED` 或 `NETWORK_RETRY_EXHAUSTED`。
+
 ## 外部开发者锁定机制
 
 维护者（`has_triage=true`）不受限制。外部开发者（`has_triage=false`）在开始任务前，必须先检查 Issue 上是否已有当前任务的 `task` 留言作者。
@@ -210,6 +221,8 @@ EOF
 
 评论发布不受 `has_triage` / `has_push` 限制，认证用户可正常执行。
 
+若评论查询、创建或更新失败且调用方有关联任务目录，记录 Workflow Warning（`step=issue-sync`、`severity=ACTION_REQUIRED`、`code=COMMENT_SYNC_FAILED`、`target={file-stem}`），并在最终输出的 Workflow Warnings 块提示人工处理。
+
 ## task.md 评论同步
 
 隐藏标记：

package/templates/.agents/rules/next-step-output.en.md

@@ -1,10 +1,11 @@
 # Next-Step Output Rule
 
-This file defines three **independent** rules for a skill's "notify-user / Next steps" output (the 3rd applies to review-* only); read this file before rendering the final output and apply whichever rules apply:
+This file defines four **independent** rules for a skill's "notify-user / Next steps" output (the 3rd applies to review-* only); read this file before rendering the final output and apply whichever rules apply:
 
 1. **Next-step output structure**: how "Next steps" commands and the "Task info" block present the task ID (placeholders / short-id lookup / fallback).
 2. **Agent output trailing line (Completed at)**: the **very last line** of user-facing output, **independent of the "Next steps" block**, applying to normal / error / early-return paths alike.
 3. **Pending human-decision pre-block**: applies only to `review-analysis` / `review-plan` / `review-code` when this stage has pending rulings (`{h} > 0`) — expand the pending items before the "Next steps" commands and prompt to resolve them first.
+4. **Workflow Warnings output block**: applies when task.md has `status=open` rows in `## Workflow Warnings` — print the warning summary after all normal information and "Next steps" commands, and before `Completed at`.
 
 ## Placeholder semantics
 
@@ -62,6 +63,19 @@ Completed at: YYYY-MM-DD HH:mm:ss
 - Position: it must be the last line of the entire user-facing output, after all "Next steps" commands. If a scenario has a conditional reminder line after the commands (e.g. the manual-validation reminder), the completion line goes after that reminder.
 - This line is for terminal scanning only; it is never written to any artifact file or Issue/PR comment. The single source of truth for completion time remains the Activity Log in task.md.
 
+## Workflow Warnings Output Block
+
+If the current task's `## Workflow Warnings` / `## 工作流告警` table has any `status=open` row, the skill's final user output must append a summary block after all normal information and "Next steps" commands, and before `Completed at`. When no open warning exists, do not render this block.
+
+Format:
+
+```text
+[ACTION REQUIRED] Workflow warnings are open:
+  - WW-N {code} ({target}): {action}
+```
+
+Use `[ACTION REQUIRED]` when any open row has `severity=ACTION_REQUIRED`; otherwise use `[IMPORTANT]`. `{code}`, `{target}`, and `{action}` come directly from the warning table columns.
+
 ## Pending human-decision pre-block (review-* only, when {h} > 0)
 
 This section is a **third standalone rule, co-equal with the two above**, used only by the "notify-user / report conclusion" step of `review-analysis` / `review-plan` / `review-code`.