@fitlab-ai/agent-infra 0.8.4 → 0.9.0

package/templates/.agents/skills/update-agent-infra/scripts/sync-templates.js

@@ -13,12 +13,17 @@
  * Output: JSON report to stdout.
  */
 
-import childProcess from 'node:child_process';
+import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+import {
+  formatAgentInfraPackageError,
+  resolveAgentInfraPackage
+} from '../../../scripts/lib/agent-infra-package.js';
+
 const DEFAULTS = {
   "platform": {
     "type": "github"
@@ -63,10 +68,19 @@ const DEFAULTS = {
       ".claude/commands/",
       ".codex/hooks.json",
       ".gemini/commands/",
+      ".git-hooks/check-large-files.cjs",
       ".git-hooks/check-version-format.sh",
       ".github/scripts/",
+      ".github/workflows/metadata-sync.yml",
+      ".github/workflows/pr-label.yml",
+      ".github/workflows/status-label.yml",
       ".opencode/commands/"
     ],
+    "guardedManaged": [
+      ".github/workflows/metadata-sync.yml",
+      ".github/workflows/pr-label.yml",
+      ".github/workflows/status-label.yml"
+    ],
     "merged": [
       "**/post-release.*",
       "**/release.*",
@@ -88,12 +102,11 @@ const DEFAULTS = {
   }
 };
 
-const PACKAGE_NAME = '@fitlab-ai/agent-infra';
 const AGENT_INFRA_SANDBOX_TOOL = 'agent-infra';
 const LEGACY_DEFAULT_SANDBOX_TOOLS = ['claude-code', 'codex', 'gemini-cli', 'opencode'];
 const DEFAULT_SANDBOX_TOOLS = [AGENT_INFRA_SANDBOX_TOOL, ...LEGACY_DEFAULT_SANDBOX_TOOLS];
 // Add a new identifier here only after shipping matching .{platform}. template variants.
-const KNOWN_PLATFORMS = new Set(['github']);
+const KNOWN_PLATFORMS = new Set(['github', 'none']);
 const KNOWN_LANGUAGES = new Set(['en', 'zh-CN']);
 
 // Single source of truth for built-in TUI ids and owned path prefixes.
@@ -151,6 +164,14 @@ function migrateSandboxTools(cfg) {
 
 function norm(p) { return p.replace(/\\/g, '/'); }
 
+function sha256(content) {
+  return `sha256:${crypto.createHash('sha256').update(content).digest('hex')}`;
+}
+
+function trustedBaseline(value) {
+  return typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value) ? value : null;
+}
+
 function normDir(p) {
   return norm(p).replace(/^\.\//, '').replace(/\/+$/, '');
 }
@@ -839,117 +860,6 @@ function stripLangVariant(relativePath) {
   return relativePath;
 }
 
-function isTemplateDir(dir) {
-  try {
-    return fs.statSync(dir).isDirectory();
-  } catch {
-    return false;
-  }
-}
-
-function verifyPackageDir(dir) {
-  const pkgPath = path.join(dir, 'package.json');
-  if (!fs.existsSync(pkgPath)) {
-    return { templateRoot: null, reason: `package.json not found at ${pkgPath}` };
-  }
-
-  let pkg;
-  try {
-    pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-  } catch {
-    return { templateRoot: null, reason: `invalid package.json at ${pkgPath}` };
-  }
-
-  if (pkg.name !== PACKAGE_NAME) {
-    const packageName = typeof pkg.name === 'string' && pkg.name ? pkg.name : 'an unknown package';
-    return { templateRoot: null, reason: `${pkgPath} belongs to ${packageName}` };
-  }
-
-  const templateRoot = path.join(dir, 'templates');
-  if (!isTemplateDir(templateRoot)) {
-    return { templateRoot: null, reason: `templates/ not found at ${templateRoot}` };
-  }
-
-  return { templateRoot, reason: null };
-}
-
-function resolveUnixTemplateRoot(name) {
-  let linkPath;
-  try {
-    linkPath = childProcess.execSync(`command -v ${name}`, {
-      encoding: 'utf8',
-      stdio: ['pipe', 'pipe', 'pipe']
-    }).trim();
-  } catch {
-    return { templateRoot: null, reason: 'not found in PATH' };
-  }
-
-  if (!linkPath) {
-    return { templateRoot: null, reason: 'not found in PATH' };
-  }
-
-  let realPath;
-  try {
-    realPath = fs.realpathSync(linkPath);
-  } catch {
-    return { templateRoot: null, reason: `cannot resolve symlink target for ${linkPath}` };
-  }
-
-  let dir = path.dirname(realPath);
-  while (true) {
-    const pkgPath = path.join(dir, 'package.json');
-    if (fs.existsSync(pkgPath)) {
-      return verifyPackageDir(dir);
-    }
-
-    const parentDir = path.dirname(dir);
-    if (parentDir === dir) {
-      break;
-    }
-    dir = parentDir;
-  }
-
-  return { templateRoot: null, reason: `no package.json found above ${realPath}` };
-}
-
-function resolveWindowsTemplateRoot(name) {
-  let output;
-  try {
-    output = childProcess.execSync(`where ${name}`, {
-      encoding: 'utf8',
-      stdio: ['pipe', 'pipe', 'pipe']
-    }).trim();
-  } catch {
-    return { templateRoot: null, reason: 'not found in PATH' };
-  }
-
-  const wrapperPaths = output.split(/\r?\n/).map(line => line.trim()).filter(Boolean);
-  if (wrapperPaths.length === 0) {
-    return { templateRoot: null, reason: 'not found in PATH' };
-  }
-
-  const wrapperPath = wrapperPaths.find(line => /\.cmd$/i.test(line)) || wrapperPaths[0];
-  const packageDir = path.join(path.dirname(wrapperPath), 'node_modules', '@fitlab-ai', 'agent-infra');
-  return verifyPackageDir(packageDir);
-}
-
-function resolveTemplateRoot() {
-  const resolver = process.platform === 'win32'
-    ? resolveWindowsTemplateRoot
-    : resolveUnixTemplateRoot;
-  const errors = [];
-
-  for (const name of ['ai', 'agent-infra']) {
-    const result = resolver(name);
-    if (result.templateRoot) {
-      return result.templateRoot;
-    }
-    errors.push({ name, reason: result.reason });
-  }
-
-  return { templateRoot: null, errors };
-}
-
 function isBinary(fp) {
   const fd = fs.openSync(fp, 'r');
   const buf = Buffer.alloc(8192);
@@ -960,14 +870,6 @@ function isBinary(fp) {
   return false;
 }
 
-function gitUrl(dir) {
-  try {
-    return childProcess.execSync('git remote get-url origin', {
-      cwd: dir, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe']
-    }).trim();
-  } catch { return null; }
-}
-
 function langSelect(rels, lang, allSet, project) {
   const sel = new Map();
 
@@ -1037,25 +939,14 @@ function syncTemplates(projectRoot, templateRootOverride) {
   const configPathRel = norm(path.relative(projectRoot, cfgPath));
   let templateRoot = templateRootOverride;
   if (!templateRoot) {
-    const resolvedTemplateRoot = resolveTemplateRoot();
-    if (typeof resolvedTemplateRoot === 'string') {
-      templateRoot = resolvedTemplateRoot;
+    const packageResolution = resolveAgentInfraPackage({
+      startPath: path.join(projectRoot, '.agents', 'scripts', 'lib', 'agent-infra-package.js')
+    });
+    if (packageResolution.templateRoot && fs.existsSync(packageResolution.templateRoot)) {
+      templateRoot = packageResolution.templateRoot;
     } else {
-      const details = resolvedTemplateRoot.errors
-        .map(({ name, reason }) => `  - ${name}: ${reason}`)
-        .join('\n');
       return {
-        error: [
-          'Template source not found.',
-          '',
-          'Attempted binary lookups:',
-          details,
-          '',
-          'Please ensure agent-infra is installed and available on PATH.',
-          'If already installed, upgrade to the latest version or reinstall:',
-          '  npm install -g @fitlab-ai/agent-infra',
-          '  brew upgrade fitlab-ai/agent-infra/agent-infra || brew install fitlab-ai/agent-infra/agent-infra'
-        ].join('\n')
+        error: formatAgentInfraPackageError(packageResolution)
       };
     }
   }
@@ -1073,6 +964,19 @@ function syncTemplates(projectRoot, templateRootOverride) {
   const managed = [...(cfg.files.managed || [])];
   const merged  = [...(cfg.files.merged  || [])];
   const ejected = [...(cfg.files.ejected || [])];
+  const guardedManaged = new Set((DEFAULTS.files.guardedManaged || []).map(norm));
+  const managedBaselines = cfg.files.managedBaselines && typeof cfg.files.managedBaselines === 'object'
+    && !Array.isArray(cfg.files.managedBaselines)
+    ? { ...cfg.files.managedBaselines }
+    : {};
+  let baselinesChanged = false;
+
+  for (const target of Object.keys(managedBaselines)) {
+    if (!guardedManaged.has(norm(target))) {
+      delete managedBaselines[target];
+      baselinesChanged = true;
+    }
+  }
 
   const report = {
     templateVersion: version,
@@ -1085,7 +989,17 @@ function syncTemplates(projectRoot, templateRootOverride) {
       errors: [],
       conflicts: []
     },
-    managed: { written: [], created: [], unchanged: [], skippedMerged: [], skippedPlatform: [], skippedTUI: [], removed: [] },
+    managed: {
+      written: [],
+      created: [],
+      unchanged: [],
+      protected: [],
+      conflicts: [],
+      skippedMerged: [],
+      skippedPlatform: [],
+      skippedTUI: [],
+      removed: []
+    },
     custom: {
       detected: [],
       generated: [],
@@ -1098,8 +1012,7 @@ function syncTemplates(projectRoot, templateRootOverride) {
     },
     ejected: { created: [], skipped: [] },
     merged:  { pending: [] },
-    configUpdated: false,
-    selfUpdate: false
+    configUpdated: false
   };
   const customTUIs = validateCustomTUIs(projectRoot, customTUIsConfig, report);
   const customTUICommandTargets = buildCustomTUICommandTargets(
@@ -1127,6 +1040,22 @@ function syncTemplates(projectRoot, templateRootOverride) {
   const allRels = mergedRels;
   const allSet = new Set(allRels);
 
+  function renderedTemplate(entry) {
+    const target = norm(renderPathname(entry, project));
+    const selected = platformSelect(
+      langSelect(entryVariantRels(entry, allSet, platformType), lang, allSet, project),
+      platformType,
+      project
+    );
+    const src = selected.get(target);
+    if (!src) return null;
+    const srcRoot = sourceMap.get(src) || templateRoot;
+    const srcFull = path.join(srcRoot, src);
+    return isBinary(srcFull)
+      ? fs.readFileSync(srcFull)
+      : renderContent(fs.readFileSync(srcFull, 'utf8'), vars);
+  }
+
   for (const entry of [...managed, ...merged, ...ejected]) {
     if (!isPathOwnedByOtherPlatform(entry, platformType)) continue;
 
@@ -1135,17 +1064,49 @@ function syncTemplates(projectRoot, templateRootOverride) {
       if (!fs.existsSync(dir)) continue;
 
       for (const filePath of walkDir(dir)) {
+        const relativeFile = norm(path.relative(projectRoot, filePath));
+        if (guardedManaged.has(relativeFile)) continue;
         fs.unlinkSync(filePath);
-        report.managed.removed.push(norm(path.relative(projectRoot, filePath)));
+        report.managed.removed.push(relativeFile);
       }
       removeEmptyDirs(dir);
       continue;
     }
 
-    const target = path.join(projectRoot, renderPathname(entry, project));
-    if (!fs.existsSync(target)) continue;
-    fs.unlinkSync(target);
-    report.managed.removed.push(norm(path.relative(projectRoot, target)));
+    const renderedTarget = norm(renderPathname(entry, project));
+    const target = path.join(projectRoot, renderedTarget);
+    if (!guardedManaged.has(renderedTarget)) {
+      if (!fs.existsSync(target)) continue;
+      fs.unlinkSync(target);
+      report.managed.removed.push(renderedTarget);
+      continue;
+    }
+
+    const baseline = trustedBaseline(managedBaselines[renderedTarget]);
+    const templateContent = renderedTemplate(entry);
+    const templateHash = templateContent === null ? null : sha256(templateContent);
+    const localHash = fs.existsSync(target) ? sha256(fs.readFileSync(target)) : null;
+    const safeToRemove = localHash !== null && (localHash === baseline || (!baseline && localHash === templateHash));
+
+    if (safeToRemove) {
+      fs.unlinkSync(target);
+      report.managed.removed.push(renderedTarget);
+      if (Object.prototype.hasOwnProperty.call(managedBaselines, renderedTarget)) {
+        delete managedBaselines[renderedTarget];
+        baselinesChanged = true;
+      }
+      continue;
+    }
+
+    if (localHash !== null || baseline !== null) {
+      report.managed.conflicts.push({
+        target: renderedTarget,
+        reason: localHash === null ? 'platform-switch-deleted' : 'platform-switch-modified',
+        baseline,
+        local: localHash,
+        template: templateHash
+      });
+    }
   }
 
   // Cleanup files owned by disabled built-in TUIs. Iterates managed + merged
@@ -1230,6 +1191,68 @@ function syncTemplates(projectRoot, templateRootOverride) {
         : renderContent(fs.readFileSync(srcFull, 'utf8'), vars);
 
       const exists = fs.existsSync(dstFull);
+      if (guardedManaged.has(tgt)) {
+        const rawBaseline = managedBaselines[tgt];
+        const baseline = trustedBaseline(rawBaseline);
+        const templateHash = sha256(content);
+        const localHash = exists ? sha256(fs.readFileSync(dstFull)) : null;
+
+        if (rawBaseline !== undefined && baseline === null) {
+          delete managedBaselines[tgt];
+          baselinesChanged = true;
+        }
+
+        if (baseline === null && localHash !== null && localHash !== templateHash) {
+          report.managed.conflicts.push({
+            target: tgt,
+            reason: 'unknown-origin',
+            baseline: null,
+            local: localHash,
+            template: templateHash
+          });
+          continue;
+        }
+
+        if (baseline !== null && templateHash === baseline && localHash !== baseline) {
+          report.managed.protected.push({
+            target: tgt,
+            reason: localHash === null ? 'user-deleted' : 'user-modified',
+            baseline,
+            local: localHash,
+            template: templateHash
+          });
+          continue;
+        }
+
+        if (baseline !== null && localHash !== baseline && templateHash !== baseline && localHash !== templateHash) {
+          report.managed.conflicts.push({
+            target: tgt,
+            reason: 'both-modified',
+            baseline,
+            local: localHash,
+            template: templateHash
+          });
+          continue;
+        }
+
+        if (localHash === templateHash) {
+          report.managed.unchanged.push(tgt);
+          if (managedBaselines[tgt] !== templateHash) {
+            managedBaselines[tgt] = templateHash;
+            baselinesChanged = true;
+          }
+          continue;
+        }
+
+        const dir = path.dirname(dstFull);
+        if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(dstFull, content);
+        managedBaselines[tgt] = templateHash;
+        baselinesChanged = true;
+        (exists ? report.managed.written : report.managed.created).push(tgt);
+        continue;
+      }
+
       if (exists) {
         const cur = bin ? fs.readFileSync(dstFull) : fs.readFileSync(dstFull, 'utf8');
         if (bin ? content.equals(cur) : content === cur) {
@@ -1333,9 +1356,6 @@ function syncTemplates(projectRoot, templateRootOverride) {
     ([target, template]) => ({ target, template })
   );
 
-  const projUrl = gitUrl(projectRoot);
-  report.selfUpdate = !!(projUrl && /fitlab-ai\/agent-infra/.test(projUrl));
-
   const hasChanges = (
     report.managed.written.length +
     report.managed.created.length +
@@ -1355,10 +1375,16 @@ function syncTemplates(projectRoot, templateRootOverride) {
   cfg.files.managed = managed;
   cfg.files.merged  = merged;
   cfg.files.ejected = ejected;
+  if (Object.keys(managedBaselines).length > 0) {
+    cfg.files.managedBaselines = managedBaselines;
+  } else {
+    if (Object.prototype.hasOwnProperty.call(cfg.files, 'managedBaselines')) baselinesChanged = true;
+    delete cfg.files.managedBaselines;
+  }
   cfg.templateVersion = version;
   delete cfg.templateSource;
 
-  report.configUpdated = hasChanges || prevVersion !== version || hadTemplateSource || sandboxToolsMigrated;
+  report.configUpdated = hasChanges || baselinesChanged || prevVersion !== version || hadTemplateSource || sandboxToolsMigrated;
 
   fs.writeFileSync(cfgPath, JSON.stringify(cfg, null, 2) + '\n', 'utf8');
 

package/templates/.agents/skills/watch-pr/SKILL.en.md

@@ -12,16 +12,16 @@ After `create-pr`, continuously watch the PR's required CI checks: when everythi
 ## Behavior Boundaries / Key Rules
 
 - Only watch + self-heal the current PR's required checks; make no changes unrelated to the failing check.
-- Self-heal modifies code and `git push`es to the PR branch, but **local tests for the affected area must pass before pushing**; fix attempts have a hard cap (default 2); only self-heal locatable code-layer failures (lint / format / test / type / build), and always route non-code failures (network / permission / external service / flaky) to the help exit.
+- Self-heal publishes through Git workflow intents, but **affected tests must pass first**; the attempt cap and code-layer authorization remain unchanged.
 - The help exit is "produce-then-stop": end this round, output the blocker explanation, and wait for the user to trigger the next step — **never** ask mid-flow.
-- Bare numbers / `#NN` / `TASK-id` arguments are always resolved as task short ids (see `.agents/rules/task-short-id.md`); a PR number is passed only via `--pr <number>` / a PR URL / omission (current branch), never reusing the bare-number syntax.
+- Bare numbers / `NN` / `TASK-id` arguments are always resolved as task short ids (see `.agents/rules/task-short-id.md`); a PR number is passed only via `--pr <number>` / a PR URL / omission (current branch), never reusing the bare-number syntax.
 - After running this skill (task-anchored path), you must update task.md.
 
 Version stamp rule: before creating or updating `task.md` frontmatter, read `.agents/rules/version-stamp.md` and write or refresh `agent_infra_version`.
 
-## Task Argument Short-ID Alias
+## Task Context Resolution
 
-> If the `{task-id}` argument matches `^[#]?[0-9]+$` (a bare number or `#`-prefixed), first read the "SKILL argument parsing" section of `.agents/rules/task-short-id.md` to resolve it; subsequent commands treat `{task-id}` as the resolved full `TASK-YYYYMMDD-HHMMSS` form.
+> Keep `--pr <number>` and PR URLs on the existing PR-anchored path. Otherwise, the task path may omit the task ref and also accepts a legacy positional ref or `--task <ref>` / `-t <ref>`. Separate task scope from the full arguments, then call `agent-infra-internal task-context resolve {task-scope}` and bind `{task-id}` to the returned full `taskId`. A PR anchor and task scope are mutually exclusive.
 
 ## Step Start: Write the started Marker
 
@@ -39,22 +39,22 @@ After prerequisites pass and before this round's first artifact action, append a
 
 Resolve the target PR number `{pr#}` and an optional `{task-id}` via these deterministic branches:
 
-- Scenario A (argument omitted): use the current branch's PR number per `.agents/rules/pr-checks-commands.md`; then determine `{task-id}` via "Reverse-lookup task" below.
-- Scenario B (`#NN` / bare number / `TASK-id`, **task-anchored primary path**): when matching `^[#]?[0-9]+$`, resolve to the full `{task-id}` via "Task Argument Short-ID Alias" (on failure pass through the exit code; do not rewrite error handling); a `TASK-id` is used directly. Read `.agents/workspace/active/{task-id}/task.md` for `pr_number` as `{pr#}`; if `pr_number` is empty, follow "Error Handling" to prompt running `create-pr` first, then stop.
+- Scenario A (argument omitted): reverse-lookup the active task from the current branch, then read its `pr_number`.
+- Scenario B (omitted task ref, positional task ref, or `--task/-t`, **task-anchored primary path**): resolve the full `{task-id}` via "Task Context Resolution" and read `.agents/workspace/active/{task-id}/task.md` for `pr_number` as `{pr#}`; if `pr_number` is empty, follow "Error Handling" to prompt running `create-pr` first, then stop.
 - Scenario C (`--pr <number>` or a PR URL): use that PR number directly as `{pr#}`; then determine `{task-id}` via "Reverse-lookup task".
-- Reverse-lookup task (scenarios A / C): search `.agents/workspace/active/*/task.md` for a task whose `pr_number == {pr#}`; on a hit, take that `{task-id}` (task-anchored); on a miss, enter the "watch-only" degraded path (no `{task-id}`, skip steps 5/6).
+- Reverse-lookup task (scenarios A / C): use task context/query capabilities to find the unique active task bound to `{pr#}`. If none exists, stop and request binding first; the typed checks intent does not create a second taskless state machine.
 
 ### 2. Watch Required Checks
 
 Before running this step, read `reference/monitor-and-heal.md` and `.agents/rules/pr-checks-commands.md`.
 
-Using the watch command in `.agents/rules/pr-checks-commands.md`, poll `{pr#}`'s required checks (with an overall time cap, default 30 minutes), and classify the outcome per the "Outcome Classification" of `reference/monitor-and-heal.md` into the "all green" / "failure" / "pending" scenarios, routing to step 7 (green exit), step 3 (self-heal), or step 4 (help exit) respectively.
+Initialize the in-memory list `repairCommits=[]` for this run. Run `agent-infra-internal platform-checks watch {task-id} --interval-seconds 30 --deadline-seconds 1800`, then route its structured `checks.state` to the all-green, failure, or pending path.
 
 ### 3. Failure Self-Heal Loop
 
 Before running this step, read the "Self-Heal Decision Tree" of `reference/monitor-and-heal.md` and "Resolve a Failing Run id and Pull Logs" of `.agents/rules/pr-checks-commands.md`.
 
-For a failing check: first deterministically resolve its failing run and pull the failure logs per the rule, then classify the failure; before making any local fix, read `.agents/rules/debugging-guide.md` and locate the root cause via its four-phase flow, never blindly patching and retrying; only when it is a locatable code-layer failure, make a minimal local fix, run the relevant tests until they pass, then **stage, commit, and push the fix** (`git add` only the related files → `git commit` per `.agents/rules/commit-and-pr.md` → `git push` to the current PR branch, recording the commit SHA), and return to step 2 to re-watch. Count fix attempts; on reaching the hard cap (default 2) or when the run is unlocatable, go to step 4.
+For a locatable code-layer failure, make the minimum fix and run relevant tests. Then call `git-workflow commit` and `git-workflow push`; append only a remotely verified SHA to `repairCommits`.
 
 ### 4. Help Exit (Produce-Then-Stop)
 
@@ -77,7 +77,7 @@ Update `.agents/workspace/active/{task-id}/task.md`:
 - **Do not change** `pr_status` (keep `created`) or `current_step`
 - **Append** to `## Activity Log` (do not overwrite prior entries; `{N}` = number of existing Watch PR entries for this task + 1):
   ```
-  - {YYYY-MM-DD HH:mm:ss±HH:MM} — **Watch PR (Round {N})** by {agent} — {green: all required checks green / blocked: blocked: {summary}}
+  - {YYYY-MM-DD HH:mm:ss±HH:MM} — **Watch PR (Round {N})** by {agent} — {green: all required checks green, repair commits: {k} [{SHA summary}] / blocked: blocked: {summary}}
   ```
 
 ### 6. Verification Gate
@@ -87,7 +87,7 @@ Update `.agents/workspace/active/{task-id}/task.md`:
 Run the verification gate:
 
 ```bash
-node .agents/scripts/validate-artifact.js gate watch-pr .agents/workspace/active/{task-id} --format text
+agent-infra-internal task-verify {task-id} watch-pr.completed --format text
 ```
 
 Handle the result:
@@ -101,10 +101,12 @@ Keep the gate output in your reply as the verification evidence. Without current
 
 > On the task-anchored path, execute this step only after the gate passes.
 
-> **IMPORTANT**: All TUI command formats listed below must be output in full. Do not show only the format for the current AI agent. If `.agents/.airc.json` configures custom TUIs (via `customTUIs`), read each tool's `name` and `invoke`, then add the matching command line in the same format (`${skillName}` becomes the skill name and `${projectName}` becomes the project name). Before rendering the final output, read `.agents/rules/next-step-output.md` and apply both of its rules: (1) render `{task-ref}` in the "Next steps" commands as the short id `#NN` (falling back to the full TASK-id when unallocated or released); (2) append the `Completed at` line as the very last line of the user-facing output (this applies to every user-facing output — success, error, and early-return paths alike, not only the success path).
+> **IMPORTANT**: All TUI command formats listed below must be output in full. Do not show only the format for the current AI agent. If `.agents/.airc.json` configures custom TUIs (via `customTUIs`), read each tool's `name` and `invoke`, then add the matching command line in the same format (`${skillName}` becomes the skill name and `${projectName}` becomes the project name). Before rendering the final output, read `.agents/rules/next-step-output.md` and apply both of its rules: (1) render `{task-ref}` in the "Next steps" commands as the short id `NN` (falling back to the full TASK-id when unallocated or released); (2) append the `Completed at` line as the very last line of the user-facing output (this applies to every user-facing output — success, error, and early-return paths alike, not only the success path).
 
 Output per scenario:
-- "All green" + task-anchored: state that all required checks passed and the PR is ready to merge, then render the next step from the template below (`{task-ref}` becomes the short id):
+- "All green" + task-anchored: state that all required checks passed, then render exactly one exit based on whether this run created repair commits (`{task-ref}` becomes the short id):
+
+  `repairCommits.length == 0`:
 
   ```
   Next step - Complete and archive the task:
@@ -113,7 +115,15 @@ Output per scenario:
     - Codex CLI: $complete-task {task-ref}
   ```
 
-- "All green" + watch-only: state the PR is ready to merge; there is no linked task this run, so run `complete-task` against the relevant task (do not force a short-id command block when no `{task-ref}` is available).
+  `repairCommits.length > 0`:
+
+  ```
+  Next step - Re-run code review:
+    - Claude Code / OpenCode: /review-code {task-ref}
+    - Gemini CLI: /{{project}}:review-code {task-ref}
+    - Codex CLI: $review-code {task-ref}
+  ```
+
 - "Blocked": output only the step 4 blocker explanation; do not recommend a next-step command.
 
 ## Completion Checklist