@nalvietnam/avatar-cli 1.1.6 → 1.2.0

package/dist/index.js

@@ -3,6 +3,131 @@
 // src/index.ts
 import { Command } from "commander";
 
+// src/commands/ai.ts
+import { spawnSync as spawnSync4 } from "child_process";
+import { promises as fs4 } from "fs";
+import { join as join5 } from "path";
+import { confirm } from "@inquirer/prompts";
+
+// src/lib/filesystem-helpers.ts
+import { constants, promises as fs } from "fs";
+import { dirname, join, relative } from "path";
+async function pathExists(path) {
+  try {
+    await fs.access(path, constants.F_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function ensureDir(path) {
+  await fs.mkdir(path, { recursive: true });
+}
+async function readText(path) {
+  return await fs.readFile(path, "utf8");
+}
+async function readJson(path) {
+  return JSON.parse(await readText(path));
+}
+async function writeTextAtomic(path, content, mode) {
+  await ensureDir(dirname(path));
+  const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
+  await fs.writeFile(tmp, content, "utf8");
+  if (mode !== void 0) {
+    await fs.chmod(tmp, mode);
+  }
+  await fs.rename(tmp, path);
+}
+async function writeJsonAtomic(path, data, mode) {
+  await writeTextAtomic(path, `${JSON.stringify(data, null, 2)}
+`, mode);
+}
+
+// src/lib/audit-log-appender.ts
+import { promises as fs2 } from "fs";
+
+// src/lib/user-config-store.ts
+import { homedir } from "os";
+import { join as join2 } from "path";
+
+// src/types/config-schema.ts
+import { z } from "zod";
+var userConfigSchema = z.object({
+  email: z.string().email(),
+  name: z.string(),
+  access_token: z.string().min(1),
+  refresh_token: z.string().min(1),
+  expires_at: z.string().datetime(),
+  id_token: z.string().min(1)
+});
+var userStateSchema = z.object({
+  installed_tools: z.record(
+    z.string(),
+    z.object({
+      version: z.string().optional(),
+      installed_at: z.string().datetime(),
+      install_method: z.string()
+    })
+  ).default({}),
+  tool_inputs: z.record(z.string(), z.unknown()).default({})
+});
+var projectSettingsSchema = z.object({
+  allowedTools: z.array(z.string()),
+  hooks: z.object({
+    PostToolUse: z.array(z.unknown()).optional()
+  }).partial().optional(),
+  env: z.record(z.string(), z.string()).default({})
+});
+var initModeSchema = z.enum(["internal", "client", "library"]);
+
+// src/lib/user-config-store.ts
+var AVATAR_HOME = join2(homedir(), ".avatar");
+var USER_CONFIG_PATH = join2(AVATAR_HOME, "config.json");
+var USER_STATE_PATH = join2(AVATAR_HOME, "state.json");
+var AUDIT_LOG_PATH = join2(AVATAR_HOME, "audit.log");
+var BACKUPS_DIR = join2(AVATAR_HOME, "backups");
+var SECRET_FILE_MODE = 384;
+async function ensureAvatarHome() {
+  await ensureDir(AVATAR_HOME);
+}
+async function readUserConfig() {
+  if (!await pathExists(USER_CONFIG_PATH)) return null;
+  const raw = await readJson(USER_CONFIG_PATH);
+  const parsed = userConfigSchema.safeParse(raw);
+  if (!parsed.success) return null;
+  return parsed.data;
+}
+async function writeUserConfig(config) {
+  await ensureAvatarHome();
+  await writeJsonAtomic(USER_CONFIG_PATH, config, SECRET_FILE_MODE);
+}
+async function clearUserConfig() {
+  if (await pathExists(USER_CONFIG_PATH)) {
+    const { promises: fs9 } = await import("fs");
+    await fs9.unlink(USER_CONFIG_PATH);
+  }
+}
+function isTokenExpired(config) {
+  const expiresAt = Date.parse(config.expires_at);
+  return Number.isNaN(expiresAt) || expiresAt - Date.now() < 6e4;
+}
+
+// src/lib/audit-log-appender.ts
+async function appendAuditEntry(action, detail) {
+  await ensureAvatarHome();
+  const entry = {
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    action,
+    ...detail ? { detail } : {}
+  };
+  const line = `${JSON.stringify(entry)}
+`;
+  await fs2.appendFile(AUDIT_LOG_PATH, line, "utf8");
+}
+
+// src/lib/check-claude-code-subscription-and-quota.ts
+import { spawnSync } from "child_process";
+
 // src/lib/terminal-logger.ts
 import chalk from "chalk";
 import ora from "ora";
@@ -28,6 +153,574 @@ function spinner(text) {
   }).start();
 }
 
+// src/lib/check-claude-code-subscription-and-quota.ts
+var QUOTA_VERIFY_TIMEOUT_MS = 3e4;
+var QUOTA_VERIFY_PROMPT = "ok";
+function checkClaudeCodeSubscriptionAuth() {
+  const result = spawnSync("claude", ["auth", "status"], { stdio: "ignore" });
+  if (result.error || result.status !== 0) return "not-authenticated";
+  return "authenticated";
+}
+function triggerClaudeCodeAuthLogin() {
+  log.info("Kh\u1EDFi \u0111\u1ED9ng \u0111\u0103ng nh\u1EADp Claude Code (browser s\u1EBD m\u1EDF)...");
+  const result = spawnSync("claude", ["auth", "login"], { stdio: "inherit" });
+  if (result.status !== 0) {
+    throw new Error(
+      `claude auth login th\u1EA5t b\u1EA1i (exit ${result.status}). Th\u1EED 'claude auth login' tay r\u1ED3i ch\u1EA1y l\u1EA1i.`
+    );
+  }
+  log.success("\u0110\xE3 \u0111\u0103ng nh\u1EADp Claude Code");
+}
+function classifyQuotaError(combinedOutput) {
+  const text = combinedOutput.toLowerCase();
+  if (text.includes("credit_balance_too_low") || text.includes("credit balance too low")) {
+    return "credit_balance_too_low";
+  }
+  if (text.includes("insufficient_quota") || text.includes("insufficient quota")) {
+    return "insufficient_quota";
+  }
+  if (text.includes("invalid_api_key") || text.includes("invalid api key")) {
+    return "invalid_api_key";
+  }
+  if (text.includes("rate_limit") || text.includes("rate limit")) {
+    return "rate_limit";
+  }
+  return "unknown";
+}
+function verifyClaudeCodeQuota() {
+  const result = spawnSync("claude", ["--print", QUOTA_VERIFY_PROMPT], {
+    encoding: "utf8",
+    timeout: QUOTA_VERIFY_TIMEOUT_MS
+  });
+  if (result.signal === "SIGTERM") {
+    return { ok: false, reason: "timeout", detail: "claude --print > 30s" };
+  }
+  const stderr = result.stderr || "";
+  const stdout = result.stdout || "";
+  if (result.status === 0) {
+    return { ok: true };
+  }
+  const reason = classifyQuotaError(`${stderr}
+${stdout}`);
+  return { ok: false, reason, detail: stderr.slice(0, 500) };
+}
+
+// src/lib/detect-claude-code-installation.ts
+import { spawnSync as spawnSync2 } from "child_process";
+
+// src/lib/detect-host-platform.ts
+import { platform } from "os";
+function detectHostPlatform() {
+  const p = platform();
+  if (p === "darwin" || p === "linux" || p === "win32") return p;
+  return "unsupported";
+}
+
+// src/lib/detect-claude-code-installation.ts
+var VERSION_PROBE_TIMEOUT_MS = 5e3;
+var SEMVER_REGEX = /(\d+\.\d+\.\d+)/;
+function probeClaudeBinaryPath() {
+  const isWindows = detectHostPlatform() === "win32";
+  const probeCmd = isWindows ? "where" : "command";
+  const probeArgs = isWindows ? ["claude"] : ["-v", "claude"];
+  const result = spawnSync2(probeCmd, probeArgs, {
+    encoding: "utf8",
+    shell: !isWindows
+  });
+  if (result.error || result.status !== 0) return null;
+  const out = (result.stdout || "").trim();
+  if (!out) return null;
+  return out.split(/\r?\n/)[0].trim();
+}
+function probeClaudeVersion() {
+  const result = spawnSync2("claude", ["--version"], {
+    encoding: "utf8",
+    timeout: VERSION_PROBE_TIMEOUT_MS
+  });
+  if (result.error || result.status !== 0) return null;
+  const out = (result.stdout || "").trim();
+  const match = SEMVER_REGEX.exec(out);
+  return match ? match[1] : null;
+}
+function detectClaudeCodeInstallation() {
+  const path = probeClaudeBinaryPath();
+  if (!path) {
+    return { installed: false, version: null, path: null };
+  }
+  const version = probeClaudeVersion();
+  return { installed: true, version, path };
+}
+
+// src/lib/install-claude-code-via-npm.ts
+import { spawnSync as spawnSync3 } from "child_process";
+var NPM_INSTALL_TIMEOUT_MS = 5 * 60 * 1e3;
+var CLAUDE_CODE_PACKAGE = "@anthropic-ai/claude-code";
+var InstallClaudeCodeError = class extends Error {
+  reason;
+  exitCode;
+  constructor(reason, message, exitCode = null) {
+    super(message);
+    this.name = "InstallClaudeCodeError";
+    this.reason = reason;
+    this.exitCode = exitCode;
+  }
+};
+function classifyNpmFailure(exitCode, stderrSample) {
+  const stderr = stderrSample.toLowerCase();
+  if (stderr.includes("eacces") || stderr.includes("permission denied")) {
+    return new InstallClaudeCodeError(
+      "permission-denied",
+      `npm install -g c\u1EA7n quy\u1EC1n. Th\u1EED: sudo npm install -g ${CLAUDE_CODE_PACKAGE} ho\u1EB7c fix npm prefix (npm config set prefix ~/.npm-global).`,
+      exitCode
+    );
+  }
+  if (stderr.includes("enospc") || stderr.includes("no space")) {
+    return new InstallClaudeCodeError(
+      "disk-full",
+      "\u0110\u0129a \u0111\u1EA7y. Free disk space r\u1ED3i th\u1EED l\u1EA1i.",
+      exitCode
+    );
+  }
+  return new InstallClaudeCodeError(
+    "generic",
+    `npm install th\u1EA5t b\u1EA1i (exit ${exitCode ?? "null"}). Xem log npm ph\xEDa tr\xEAn.`,
+    exitCode
+  );
+}
+function installClaudeCodeViaNpm() {
+  log.info("\u0110ang c\xE0i Claude Code qua npm (c\xF3 th\u1EC3 m\u1EA5t 1-2 ph\xFAt)...");
+  const result = spawnSync3("npm", ["install", "-g", CLAUDE_CODE_PACKAGE], {
+    stdio: ["inherit", "inherit", "pipe"],
+    timeout: NPM_INSTALL_TIMEOUT_MS,
+    encoding: "utf8"
+  });
+  if (result.signal === "SIGTERM") {
+    throw new InstallClaudeCodeError(
+      "timeout",
+      `npm install timeout sau ${NPM_INSTALL_TIMEOUT_MS / 1e3}s. Check m\u1EA1ng r\u1ED3i th\u1EED l\u1EA1i.`,
+      null
+    );
+  }
+  if (result.status !== 0) {
+    if (result.stderr) process.stderr.write(result.stderr);
+    throw classifyNpmFailure(result.status, result.stderr || "");
+  }
+  const probe = detectClaudeCodeInstallation();
+  if (!probe.installed || !probe.path) {
+    throw new InstallClaudeCodeError(
+      "binary-not-in-path",
+      "npm c\xE0i xong nh\u01B0ng `claude` kh\xF4ng trong PATH. Reload shell (source ~/.zshrc) ho\u1EB7c th\xEAm npm global bin v\xE0o PATH.",
+      null
+    );
+  }
+  log.success(`\u0110\xE3 c\xE0i Claude Code${probe.version ? ` v${probe.version}` : ""} t\u1EA1i ${probe.path}`);
+  return { version: probe.version, path: probe.path };
+}
+
+// src/lib/prompt-ai-provider-choice.ts
+import { readFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+import { select } from "@inquirer/prompts";
+function getGlobalSettingsPath() {
+  return join3(homedir2(), ".claude", "settings.json");
+}
+function detectGlobalClaudeSettings() {
+  const path = getGlobalSettingsPath();
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    return { exists: false, hasBaseUrl: false, hasToken: false };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { exists: true, hasBaseUrl: false, hasToken: false };
+  }
+  const env = parsed.env || {};
+  const baseUrl = typeof env.ANTHROPIC_BASE_URL === "string" ? env.ANTHROPIC_BASE_URL : void 0;
+  const hasToken = typeof env.ANTHROPIC_AUTH_TOKEN === "string" && env.ANTHROPIC_AUTH_TOKEN.length > 0;
+  const model = typeof parsed.model === "string" ? parsed.model : void 0;
+  return {
+    exists: true,
+    hasBaseUrl: !!baseUrl,
+    baseUrl,
+    hasToken,
+    model,
+    rawSettings: parsed
+  };
+}
+async function promptAiProviderChoice(globalInfo = detectGlobalClaudeSettings()) {
+  if (globalInfo.exists && globalInfo.hasBaseUrl && globalInfo.hasToken) {
+    const choice = await select({
+      message: `Ph\xE1t hi\u1EC7n AI config global (base URL: ${globalInfo.baseUrl}). D\xF9ng cho project n\xE0y?`,
+      choices: [
+        {
+          name: "a. Yes \u2014 copy config global v\xE0o .claude/settings.json (per-project)",
+          value: "use-global"
+        },
+        {
+          name: "b. No \u2014 setup ri\xEAng (ch\u1ECDn provider kh\xE1c)",
+          value: "setup-fresh"
+        }
+      ]
+    });
+    if (choice === "use-global") return "use-global";
+  }
+  return await select({
+    message: "Ch\u1ECDn provider cho AI features:",
+    choices: [
+      {
+        name: "1. Claude Code Subscription (d\xF9ng quota c\xE1 nh\xE2n Anthropic)",
+        value: "subscription"
+      },
+      {
+        name: "2. LLMLite API key (llm.nal.vn \u2014 NAL c\u1EA5p)",
+        value: "llmlite"
+      }
+    ]
+  });
+}
+
+// src/lib/setup-llmlite-api-key-and-model.ts
+import { input, password, select as select2 } from "@inquirer/prompts";
+var DEFAULT_BASE_URL = "https://llm.nal.vn";
+var FETCH_TIMEOUT_MS = 1e4;
+function maskApiKey(key) {
+  if (key.length <= 8) return "sk-***";
+  return `${key.slice(0, 3)}...${key.slice(-4)}`;
+}
+async function promptApiKeyHidden() {
+  return await password({
+    message: "LLMLite API key (\u1EA9n input):",
+    mask: "*",
+    validate: (v) => v.trim().length > 0 ? true : "API key b\u1EAFt bu\u1ED9c"
+  });
+}
+async function promptBaseUrl(defaultUrl = DEFAULT_BASE_URL) {
+  const value = await input({
+    message: "LLMLite base URL:",
+    default: defaultUrl,
+    validate: (v) => /^https?:\/\//.test(v) ? true : "Ph\u1EA3i l\xE0 URL h\u1EE3p l\u1EC7 (http/https)"
+  });
+  return value.replace(/\/+$/, "");
+}
+async function fetchAvailableModels(baseUrl, apiKey) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetch(`${baseUrl}/v1/models`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        Accept: "application/json"
+      },
+      signal: controller.signal
+    });
+    if (res.status === 401 || res.status === 403) {
+      throw new Error(`API key invalid (HTTP ${res.status}).`);
+    }
+    if (res.status === 404) {
+      throw new Error(`Endpoint /v1/models kh\xF4ng t\u1ED3n t\u1EA1i tr\xEAn ${baseUrl}.`);
+    }
+    if (!res.ok) {
+      throw new Error(`Fetch models th\u1EA5t b\u1EA1i (HTTP ${res.status}).`);
+    }
+    const json = await res.json();
+    const models = (json.data || []).map((m) => typeof m.id === "string" ? m.id : null).filter((id) => id !== null);
+    if (models.length === 0) {
+      throw new Error("LLMLite tr\u1EA3 v\u1EC1 list r\u1ED7ng. Li\xEAn h\u1EC7 admin NAL.");
+    }
+    return models;
+  } catch (err) {
+    if (err.name === "AbortError") {
+      throw new Error(`Connect ${baseUrl} timeout sau ${FETCH_TIMEOUT_MS / 1e3}s.`);
+    }
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function promptModelChoice(models) {
+  const claudeAliases = models.filter((m) => m.toLowerCase().includes("claude"));
+  if (claudeAliases.length === 1) {
+    log.info(`Auto-pick model: ${claudeAliases[0]} (ch\u1EC9 1 claude alias tr\xEAn endpoint)`);
+    return claudeAliases[0];
+  }
+  const choiceList = claudeAliases.length > 0 ? claudeAliases : models;
+  return await select2({
+    message: "Ch\u1ECDn model m\u1EB7c \u0111\u1ECBnh cho project:",
+    choices: choiceList.map((m) => ({ name: m, value: m }))
+  });
+}
+async function setupLLMLiteApiKeyAndModel() {
+  const apiKey = await promptApiKeyHidden();
+  const baseUrl = await promptBaseUrl();
+  log.info(`Verify key (${maskApiKey(apiKey)}) qua ${baseUrl}/v1/models...`);
+  const models = await fetchAvailableModels(baseUrl, apiKey);
+  log.success(`Endpoint OK \u2014 ${models.length} models available`);
+  const model = await promptModelChoice(models);
+  return { apiKey, baseUrl, model };
+}
+
+// src/lib/write-claude-settings-json-per-project.ts
+import { promises as fs3 } from "fs";
+import { join as join4 } from "path";
+var SECRET_FILE_MODE2 = 384;
+function getClaudeSettingsPath(workspacePath) {
+  return join4(workspacePath, ".claude", "settings.json");
+}
+async function readExistingSettings(path) {
+  if (!await pathExists(path)) return {};
+  try {
+    return await readJson(path);
+  } catch (err) {
+    throw new Error(
+      `Kh\xF4ng parse \u0111\u01B0\u1EE3c ${path} (JSON l\u1ED7i): ${err.message}. Backup file r\u1ED3i x\xF3a \u0111\u1EC3 Avatar t\u1EA1o l\u1EA1i.`
+    );
+  }
+}
+function applySubscription(existing, model) {
+  const { env: existingEnv, ...rest } = existing;
+  const merged = { ...rest, model };
+  if (existingEnv) {
+    const { ANTHROPIC_BASE_URL: _b, ANTHROPIC_AUTH_TOKEN: _t, ...envRest } = existingEnv;
+    if (Object.keys(envRest).length > 0) {
+      merged.env = envRest;
+    }
+  }
+  return merged;
+}
+function applyLLMLite(existing, apiKey, baseUrl, model) {
+  return {
+    ...existing,
+    env: {
+      ...existing.env || {},
+      ANTHROPIC_BASE_URL: baseUrl,
+      ANTHROPIC_AUTH_TOKEN: apiKey
+    },
+    model
+  };
+}
+function applyUseGlobal(existing, source) {
+  const sourceEnv = source.env || {};
+  const sourceModel = typeof source.model === "string" ? source.model : void 0;
+  return {
+    ...existing,
+    env: {
+      ...existing.env || {},
+      ...sourceEnv
+    },
+    ...sourceModel ? { model: sourceModel } : {}
+  };
+}
+async function writeClaudeSettings(workspacePath, input3) {
+  const path = getClaudeSettingsPath(workspacePath);
+  const existing = await readExistingSettings(path);
+  let merged;
+  switch (input3.provider) {
+    case "subscription":
+      merged = applySubscription(existing, input3.model);
+      break;
+    case "llmlite":
+      merged = applyLLMLite(existing, input3.apiKey, input3.baseUrl, input3.model);
+      break;
+    case "use-global":
+      merged = applyUseGlobal(existing, input3.sourceSettings);
+      break;
+  }
+  await writeJsonAtomic(path, merged, SECRET_FILE_MODE2);
+  try {
+    await fs3.chmod(path, SECRET_FILE_MODE2);
+  } catch {
+  }
+  return { path, mode: SECRET_FILE_MODE2 };
+}
+
+// src/lib/run-ai-setup-phase.ts
+var SUBSCRIPTION_DEFAULT_MODEL = "sonnet";
+async function runAiSetupPhase(args) {
+  try {
+    log.info("Setup AI provider cho workspace...");
+    let info = detectClaudeCodeInstallation();
+    if (!info.installed) {
+      log.info("Ch\u01B0a c\xF3 Claude Code \u2014 s\u1EBD t\u1EF1 c\xE0i qua npm.");
+      installClaudeCodeViaNpm();
+      info = detectClaudeCodeInstallation();
+      if (!info.installed) {
+        throw new Error("C\xE0i Claude Code xong nh\u01B0ng v\u1EABn kh\xF4ng detect \u0111\u01B0\u1EE3c binary.");
+      }
+    } else {
+      log.success(`Claude Code \u0111\xE3 c\xF3${info.version ? ` v${info.version}` : ""}`);
+    }
+    const globalInfo = detectGlobalClaudeSettings();
+    const choice = await promptAiProviderChoice(globalInfo);
+    switch (choice) {
+      case "subscription": {
+        if (checkClaudeCodeSubscriptionAuth() !== "authenticated") {
+          triggerClaudeCodeAuthLogin();
+        }
+        const quota = verifyClaudeCodeQuota();
+        if (!quota.ok) {
+          await appendAuditEntry(
+            "ai_setup",
+            `provider=subscription,result=no-quota,reason=${quota.reason ?? "unknown"}`
+          );
+          log.warn(
+            `Subscription verify th\u1EA5t b\u1EA1i (${quota.reason ?? "unknown"}). Suggest LLMLite ho\u1EB7c upgrade plan.`
+          );
+          return { ok: false, reason: `subscription-${quota.reason ?? "unknown"}`, phase: "quota" };
+        }
+        await writeClaudeSettings(args.workspacePath, {
+          provider: "subscription",
+          model: SUBSCRIPTION_DEFAULT_MODEL
+        });
+        await appendAuditEntry("ai_setup", "provider=subscription,result=ok");
+        log.success(`AI ready \xB7 Subscription \xB7 model=${SUBSCRIPTION_DEFAULT_MODEL}`);
+        return { ok: true, provider: "subscription", model: SUBSCRIPTION_DEFAULT_MODEL };
+      }
+      case "llmlite": {
+        const llmConfig = await setupLLMLiteApiKeyAndModel();
+        await writeClaudeSettings(args.workspacePath, {
+          provider: "llmlite",
+          apiKey: llmConfig.apiKey,
+          baseUrl: llmConfig.baseUrl,
+          model: llmConfig.model
+        });
+        await appendAuditEntry(
+          "ai_setup",
+          `provider=llmlite,result=ok,model=${llmConfig.model},base=${llmConfig.baseUrl}`
+        );
+        log.success(`AI ready \xB7 LLMLite \xB7 model=${llmConfig.model} \xB7 ${llmConfig.baseUrl}`);
+        return { ok: true, provider: "llmlite", model: llmConfig.model };
+      }
+      case "use-global": {
+        if (!globalInfo.rawSettings) {
+          throw new Error("use-global ch\u1ECDn nh\u01B0ng kh\xF4ng \u0111\u1ECDc \u0111\u01B0\u1EE3c global settings.");
+        }
+        await writeClaudeSettings(args.workspacePath, {
+          provider: "use-global",
+          sourceSettings: globalInfo.rawSettings
+        });
+        await appendAuditEntry("ai_setup", "provider=use-global,result=ok");
+        log.success(`AI ready \xB7 Copy t\u1EEB global config (${globalInfo.baseUrl ?? "subscription"})`);
+        return { ok: true, provider: "use-global", model: globalInfo.model };
+      }
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    log.warn(`AI setup th\u1EA5t b\u1EA1i: ${message}`);
+    log.dim("Workspace v\u1EABn s\u1EB5n s\xE0ng. Setup AI sau qua: avatar ai setup");
+    await appendAuditEntry("ai_setup", `result=failed,error=${message.slice(0, 200)}`);
+    return { ok: false, reason: message };
+  }
+}
+
+// src/commands/ai.ts
+async function ensureWorkspaceCwd() {
+  const cwd = process.cwd();
+  const claudeDir = join5(cwd, ".claude");
+  if (!await pathExists(claudeDir)) {
+    log.error("Kh\xF4ng th\u1EA5y .claude/ trong th\u01B0 m\u1EE5c hi\u1EC7n t\u1EA1i. Ch\u1EA1y l\u1EC7nh n\xE0y trong workspace Avatar.");
+    process.exit(1);
+  }
+  return cwd;
+}
+async function readWorkspaceSettings(workspacePath) {
+  const settingsPath = join5(workspacePath, ".claude", "settings.json");
+  if (!await pathExists(settingsPath)) return {};
+  try {
+    return await readJson(settingsPath);
+  } catch {
+    return {};
+  }
+}
+async function runAiSetup() {
+  const workspacePath = await ensureWorkspaceCwd();
+  await runAiSetupPhase({ workspacePath });
+}
+async function runAiStatus() {
+  const workspacePath = await ensureWorkspaceCwd();
+  const settings = await readWorkspaceSettings(workspacePath);
+  const env = settings.env || {};
+  const baseUrl = typeof env.ANTHROPIC_BASE_URL === "string" ? env.ANTHROPIC_BASE_URL : void 0;
+  const token = typeof env.ANTHROPIC_AUTH_TOKEN === "string" ? env.ANTHROPIC_AUTH_TOKEN : void 0;
+  const model = typeof settings.model === "string" ? settings.model : void 0;
+  const provider = baseUrl ? "LLMLite" : token ? "Custom" : "Subscription (default)";
+  log.info(`Project:  ${workspacePath}`);
+  log.info(`Provider: ${provider}${baseUrl ? ` (${baseUrl})` : ""}`);
+  log.info(`Model:    ${model ?? "(default \u2014 Claude Code ch\u1ECDn)"}`);
+  log.info(`Token:    ${token ? maskApiKey(token) : "(kh\xF4ng set \u2014 d\xF9ng subscription auth)"}`);
+}
+async function runAiTest() {
+  await ensureWorkspaceCwd();
+  log.info("Calling provider v\u1EDBi prompt 'say ok'...");
+  const result = spawnSync4("claude", ["--print", "say ok"], {
+    encoding: "utf8",
+    timeout: 3e4
+  });
+  if (result.signal === "SIGTERM") {
+    log.error("Timeout sau 30s. Check m\u1EA1ng / endpoint.");
+    process.exit(1);
+  }
+  if (result.status !== 0) {
+    log.error(`Test th\u1EA5t b\u1EA1i (exit ${result.status}).`);
+    if (result.stderr) process.stderr.write(`${result.stderr}
+`);
+    process.exit(1);
+  }
+  log.success(`Response: ${(result.stdout || "").trim().slice(0, 200)}`);
+  log.success("AI provider working");
+}
+async function runAiReset(opts) {
+  const workspacePath = await ensureWorkspaceCwd();
+  const settingsPath = join5(workspacePath, ".claude", "settings.json");
+  const settings = await readWorkspaceSettings(workspacePath);
+  if (!opts.yes) {
+    const ok = await confirm({
+      message: "X\xF3a AI config (v\u1EC1 d\xF9ng Claude Code Subscription default)?",
+      default: false
+    });
+    if (!ok) {
+      log.dim("\u0110\xE3 h\u1EE7y.");
+      return;
+    }
+  }
+  const { env: existingEnv, ...rest } = settings;
+  const reset = { ...rest };
+  if (existingEnv) {
+    const { ANTHROPIC_BASE_URL: _b, ANTHROPIC_AUTH_TOKEN: _t, ...envRest } = existingEnv;
+    if (Object.keys(envRest).length > 0) {
+      reset.env = envRest;
+    }
+  }
+  if (Object.keys(reset).length === 0) {
+    await fs4.unlink(settingsPath).catch(() => {
+    });
+    log.success("\u0110\xE3 x\xF3a .claude/settings.json (clean state)");
+  } else {
+    await writeJsonAtomic(settingsPath, reset, 384);
+    log.success("\u0110\xE3 reset env block trong .claude/settings.json");
+  }
+}
+function registerAiCommand(program2) {
+  const ai = program2.command("ai").description("Qu\u1EA3n l\xFD AI provider config (M12)");
+  ai.command("setup").description("Wizard setup/re-config AI provider cho workspace hi\u1EC7n t\u1EA1i").action(async () => {
+    await runAiSetup();
+  });
+  ai.command("status").description("Show AI config hi\u1EC7n t\u1EA1i (mask token)").action(async () => {
+    await runAiStatus();
+  });
+  ai.command("test").description("Verify AI provider qua cheap prompt").action(async () => {
+    await runAiTest();
+  });
+  ai.command("reset").description("X\xF3a env.ANTHROPIC_* kh\u1ECFi settings.json (v\u1EC1 Subscription default)").option("--yes", "Skip confirm").action(async (opts) => {
+    await runAiReset(opts);
+  });
+}
+
 // src/lib/not-implemented-stub.ts
 function notImplementedYet(commandName, milestone) {
   return () => {
@@ -50,59 +743,25 @@ function registerCommitCommand(program2) {
 }
 
 // src/commands/doctor.ts
-import { spawnSync } from "child_process";
-import { promises as fs3 } from "fs";
-import { join as join6 } from "path";
+import { spawnSync as spawnSync5 } from "child_process";
+import { promises as fs6 } from "fs";
+import { join as join9 } from "path";
 import boxen from "boxen";
 
-// src/lib/filesystem-helpers.ts
-import { constants, promises as fs } from "fs";
-import { dirname, join, relative } from "path";
-async function pathExists(path) {
-  try {
-    await fs.access(path, constants.F_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function ensureDir(path) {
-  await fs.mkdir(path, { recursive: true });
-}
-async function readText(path) {
-  return await fs.readFile(path, "utf8");
-}
-async function readJson(path) {
-  return JSON.parse(await readText(path));
-}
-async function writeTextAtomic(path, content, mode) {
-  await ensureDir(dirname(path));
-  const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
-  await fs.writeFile(tmp, content, "utf8");
-  if (mode !== void 0) {
-    await fs.chmod(tmp, mode);
-  }
-  await fs.rename(tmp, path);
-}
-async function writeJsonAtomic(path, data, mode) {
-  await writeTextAtomic(path, `${JSON.stringify(data, null, 2)}
-`, mode);
-}
-
 // src/lib/git-operations.ts
-import { join as join2 } from "path";
+import { join as join6 } from "path";
 import { simpleGit } from "simple-git";
 function git(cwd = process.cwd()) {
   return simpleGit({ baseDir: cwd, binary: "git" });
 }
 async function isGitRepo(cwd = process.cwd()) {
-  return await pathExists(join2(cwd, ".git"));
+  return await pathExists(join6(cwd, ".git"));
 }
 async function addSubmodule(repoUrl, destPath, cwd = process.cwd()) {
   await git(cwd).subModule(["add", repoUrl, destPath]);
 }
 async function checkoutTagInSubmodule(submodulePath, tag, cwd = process.cwd()) {
-  const submoduleCwd = join2(cwd, submodulePath);
+  const submoduleCwd = join6(cwd, submodulePath);
   await git(submoduleCwd).fetch(["--tags"]);
   await git(submoduleCwd).checkout(tag);
 }
@@ -120,12 +779,12 @@ async function currentCommitSha(cwd = process.cwd()) {
 }
 
 // src/lib/project-tree-scaffolder.ts
-import { promises as fs2 } from "fs";
-import { join as join4 } from "path";
+import { promises as fs5 } from "fs";
+import { join as join8 } from "path";
 
 // src/lib/template-bundle-loader.ts
 import { existsSync } from "fs";
-import { dirname as dirname2, join as join3 } from "path";
+import { dirname as dirname2, join as join7 } from "path";
 import { fileURLToPath } from "url";
 
 // src/lib/mustache-template-engine.ts
@@ -141,12 +800,12 @@ function renderTemplate(source, variables) {
 // src/lib/template-bundle-loader.ts
 var HERE = dirname2(fileURLToPath(import.meta.url));
 var PACKAGE_ROOT = findPackageRoot(HERE);
-var TEMPLATES_ROOT = join3(PACKAGE_ROOT, "src", "templates");
-var HOOKS_ROOT = join3(PACKAGE_ROOT, "src", "hooks");
+var TEMPLATES_ROOT = join7(PACKAGE_ROOT, "src", "templates");
+var HOOKS_ROOT = join7(PACKAGE_ROOT, "src", "hooks");
 function findPackageRoot(startDir) {
   let dir = startDir;
   while (true) {
-    if (existsSync(join3(dir, "package.json"))) return dir;
+    if (existsSync(join7(dir, "package.json"))) return dir;
     const parent = dirname2(dir);
     if (parent === dir) {
       throw new Error(`Cannot locate package root from ${startDir}`);
@@ -155,14 +814,14 @@ function findPackageRoot(startDir) {
   }
 }
 async function loadTemplate(name) {
-  return await readText(join3(TEMPLATES_ROOT, `${name}.tpl`));
+  return await readText(join7(TEMPLATES_ROOT, `${name}.tpl`));
 }
 async function renderTemplateByName(name, variables) {
   const source = await loadTemplate(name);
   return renderTemplate(source, variables);
 }
 async function loadHook(name) {
-  return await readText(join3(HOOKS_ROOT, `${name}.sh.tpl`));
+  return await readText(join7(HOOKS_ROOT, `${name}.sh.tpl`));
 }
 
 // src/lib/project-tree-scaffolder.ts
@@ -179,7 +838,7 @@ async function backupIfExists(path) {
       throw new Error(`Could not find free backup name for ${path}`);
     }
   }
-  await fs2.rename(path, backupPath);
+  await fs5.rename(path, backupPath);
   return backupPath;
 }
 async function writeWithBackup(path, content, mode) {
@@ -196,12 +855,12 @@ var PROJECT_KNOWLEDGE_TEMPLATES = [
   "project/gotchas.md"
 ];
 async function createClaudeDirTree(projectRoot) {
-  const claudeRoot = join4(projectRoot, ".claude");
+  const claudeRoot = join8(projectRoot, ".claude");
   await ensureDir(claudeRoot);
   for (const sub of CLAUDE_SUBDIRS) {
-    const dir = join4(claudeRoot, sub);
+    const dir = join8(claudeRoot, sub);
     await ensureDir(dir);
-    await writeTextAtomic(join4(dir, ".gitkeep"), "");
+    await writeTextAtomic(join8(dir, ".gitkeep"), "");
   }
 }
 async function writeProjectKnowledgeFiles(projectRoot, vars) {
@@ -232,7 +891,7 @@ async function writeProjectKnowledgeFiles(projectRoot, vars) {
   for (const tpl of PROJECT_KNOWLEDGE_TEMPLATES) {
     const content = await renderTemplateByName(tpl, baseVars);
     const relative4 = tpl.replace(/^project\//, "");
-    const outPath = join4(projectRoot, ".claude", "project", relative4);
+    const outPath = join8(projectRoot, ".claude", "project", relative4);
     const backup = await writeWithBackup(outPath, content);
     if (backup) backups.push(backup);
   }
@@ -240,19 +899,19 @@ async function writeProjectKnowledgeFiles(projectRoot, vars) {
 }
 async function writeRootClaudeMd(projectRoot, vars) {
   const content = await renderTemplateByName("CLAUDE.md", vars);
-  return await writeWithBackup(join4(projectRoot, "CLAUDE.md"), content);
+  return await writeWithBackup(join8(projectRoot, "CLAUDE.md"), content);
 }
 async function writeProjectSettings(projectRoot, vars) {
   const content = await renderTemplateByName("settings.json", vars);
-  return await writeWithBackup(join4(projectRoot, ".claude", "settings.json"), content);
+  return await writeWithBackup(join8(projectRoot, ".claude", "settings.json"), content);
 }
 async function appendGitignoreEntries(projectRoot) {
-  const path = join4(projectRoot, ".gitignore");
+  const path = join8(projectRoot, ".gitignore");
   const tpl = await renderTemplateByName("gitignore", {});
   const marker = "# Avatar \u2014 git-ignored entries injected on `avatar init`";
   let existing = "";
   if (await pathExists(path)) {
-    existing = await fs2.readFile(path, "utf8");
+    existing = await fs5.readFile(path, "utf8");
     if (existing.includes(marker)) return;
   }
   const separator = existing.endsWith("\n") || existing.length === 0 ? "" : "\n";
@@ -261,78 +920,12 @@ ${tpl}`);
 }
 async function installGitHook(gitDir, hookName) {
   const content = await loadHook(hookName);
-  const hooksDir = join4(gitDir, "hooks");
+  const hooksDir = join8(gitDir, "hooks");
   await ensureDir(hooksDir);
-  const dest = join4(hooksDir, hookName);
+  const dest = join8(hooksDir, hookName);
   await writeTextAtomic(dest, content, 493);
 }
 
-// src/lib/user-config-store.ts
-import { homedir } from "os";
-import { join as join5 } from "path";
-
-// src/types/config-schema.ts
-import { z } from "zod";
-var userConfigSchema = z.object({
-  email: z.string().email(),
-  name: z.string(),
-  access_token: z.string().min(1),
-  refresh_token: z.string().min(1),
-  expires_at: z.string().datetime(),
-  id_token: z.string().min(1)
-});
-var userStateSchema = z.object({
-  installed_tools: z.record(
-    z.string(),
-    z.object({
-      version: z.string().optional(),
-      installed_at: z.string().datetime(),
-      install_method: z.string()
-    })
-  ).default({}),
-  tool_inputs: z.record(z.string(), z.unknown()).default({})
-});
-var projectSettingsSchema = z.object({
-  allowedTools: z.array(z.string()),
-  hooks: z.object({
-    PostToolUse: z.array(z.unknown()).optional()
-  }).partial().optional(),
-  env: z.record(z.string(), z.string()).default({})
-});
-var initModeSchema = z.enum(["internal", "client", "library"]);
-
-// src/lib/user-config-store.ts
-var AVATAR_HOME = join5(homedir(), ".avatar");
-var USER_CONFIG_PATH = join5(AVATAR_HOME, "config.json");
-var USER_STATE_PATH = join5(AVATAR_HOME, "state.json");
-var AUDIT_LOG_PATH = join5(AVATAR_HOME, "audit.log");
-var BACKUPS_DIR = join5(AVATAR_HOME, "backups");
-var SECRET_FILE_MODE = 384;
-async function ensureAvatarHome() {
-  await ensureDir(AVATAR_HOME);
-}
-async function readUserConfig() {
-  if (!await pathExists(USER_CONFIG_PATH)) return null;
-  const raw = await readJson(USER_CONFIG_PATH);
-  const parsed = userConfigSchema.safeParse(raw);
-  if (!parsed.success) return null;
-  return parsed.data;
-}
-async function writeUserConfig(config) {
-  await ensureAvatarHome();
-  await writeJsonAtomic(USER_CONFIG_PATH, config, SECRET_FILE_MODE);
-}
-async function clearUserConfig() {
-  if (await pathExists(USER_CONFIG_PATH)) {
-    const { promises: fs7 } = await import("fs");
-    await fs7.unlink(USER_CONFIG_PATH);
-  }
-}
-function isTokenExpired(config) {
-  const expiresAt = Date.parse(config.expires_at);
-  return Number.isNaN(expiresAt) || expiresAt - Date.now() < 6e4;
-}
-
 // src/commands/doctor.ts
 function registerDoctorCommand(program2) {
   program2.command("doctor").description("Ch\u1EA9n \u0111o\xE1n c\xE0i \u0111\u1EB7t Avatar: hooks, MCP, login, submodule, ...").option("--fix", "T\u1EF1 \u0111\u1ED9ng fix c\xE1c issue c\xF3 th\u1EC3 fix t\u1EF1 \u0111\u1ED9ng").action(async (opts) => {
@@ -387,7 +980,7 @@ async function runChecks(cwd) {
     detail: gitRepo ? cwd : "Kh\xF4ng ph\u1EA3i git repo (c\u1EA7n cho 'avatar init')",
     fixable: false
   });
-  const packPath = join6(cwd, ".claude", "pack");
+  const packPath = join9(cwd, ".claude", "pack");
   const hasPack = await pathExists(packPath);
   checks.push({
     name: "team-ai-pack submodule",
@@ -395,7 +988,7 @@ async function runChecks(cwd) {
     detail: hasPack ? packPath : "Avatar ch\u01B0a init \u2014 ch\u1EA1y 'avatar init'",
     fixable: false
   });
-  const claudeMdPath = join6(cwd, "CLAUDE.md");
+  const claudeMdPath = join9(cwd, "CLAUDE.md");
   const hasClaudeMd = await pathExists(claudeMdPath);
   checks.push({
     name: "CLAUDE.md",
@@ -403,7 +996,7 @@ async function runChecks(cwd) {
     detail: hasClaudeMd ? "t\u1ED3n t\u1EA1i \u1EDF project root" : "thi\u1EBFu \u2014 ch\u1EA1y 'avatar init'",
     fixable: false
   });
-  const hookPath = join6(cwd, ".git", "hooks", "post-merge");
+  const hookPath = join9(cwd, ".git", "hooks", "post-merge");
   const hasHook = await pathExists(hookPath);
   if (gitRepo && hasPack) {
     checks.push({
@@ -412,15 +1005,15 @@ async function runChecks(cwd) {
       detail: hasHook ? "installed" : "missing \u2014 fixable",
       fixable: !hasHook,
       fix: hasHook ? void 0 : async () => {
-        await installGitHook(join6(cwd, ".git"), "post-merge");
+        await installGitHook(join9(cwd, ".git"), "post-merge");
       }
     });
   }
-  const gitignorePath = join6(cwd, ".gitignore");
+  const gitignorePath = join9(cwd, ".gitignore");
   if (gitRepo) {
     let gitignoreOk = false;
     if (await pathExists(gitignorePath)) {
-      const content = await fs3.readFile(gitignorePath, "utf8");
+      const content = await fs6.readFile(gitignorePath, "utf8");
       gitignoreOk = content.includes(".claude/_pending/");
     }
     checks.push({
@@ -430,7 +1023,7 @@ async function runChecks(cwd) {
       fixable: false
     });
   }
-  const which = spawnSync("which", ["claude"]);
+  const which = spawnSync5("which", ["claude"]);
   const hasClaudeCli = which.status === 0;
   checks.push({
     name: "Claude Code CLI",
@@ -478,24 +1071,10 @@ async function applyFixes(checks) {
 }
 
 // src/commands/init.ts
-import { basename, join as join13, relative as relative2, resolve } from "path";
-import { confirm, input, select } from "@inquirer/prompts";
+import { basename, join as join16, relative as relative2, resolve } from "path";
+import { confirm as confirm2, input as input2, select as select4 } from "@inquirer/prompts";
 import boxen2 from "boxen";
 
-// src/lib/audit-log-appender.ts
-import { promises as fs4 } from "fs";
-async function appendAuditEntry(action, detail) {
-  await ensureAvatarHome();
-  const entry = {
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    action,
-    ...detail ? { detail } : {}
-  };
-  const line = `${JSON.stringify(entry)}
-`;
-  await fs4.appendFile(AUDIT_LOG_PATH, line, "utf8");
-}
-
 // src/lib/avatar-ascii-banner.ts
 import chalk2 from "chalk";
 var BANNER_LINES = [
@@ -558,27 +1137,27 @@ ${renderAvatarBanner(opts)}
 }
 
 // src/lib/execute-gh-repo-create.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync6 } from "child_process";
 var RepoAlreadyExistsError = class extends Error {
   constructor(fullName) {
     super(`Repo "${fullName}" \u0111\xE3 t\u1ED3n t\u1EA1i tr\xEAn GitHub. \u0110\u1ED5i t\xEAn ho\u1EB7c x\xF3a repo c\u0169.`);
     this.name = "RepoAlreadyExistsError";
   }
 };
-function executeGhRepoCreate(input2) {
-  const fullName = `${input2.org}/${input2.name}`;
+function executeGhRepoCreate(input3) {
+  const fullName = `${input3.org}/${input3.name}`;
   const args = [
     "repo",
     "create",
     fullName,
-    `--${input2.visibility}`,
+    `--${input3.visibility}`,
     "--source",
-    input2.folder,
+    input3.folder,
     "--remote",
     "origin",
     "--push"
   ];
-  const r = spawnSync2("gh", args, { stdio: "inherit" });
+  const r = spawnSync6("gh", args, { stdio: "inherit" });
   if (r.status !== 0) {
     if (r.status === 1) {
       throw new RepoAlreadyExistsError(fullName);
@@ -592,9 +1171,9 @@ function executeGhRepoCreate(input2) {
 }
 
 // src/lib/resolve-github-username-default.ts
-import { spawnSync as spawnSync3 } from "child_process";
+import { spawnSync as spawnSync7 } from "child_process";
 function resolveGithubUsernameDefault() {
-  const r = spawnSync3("gh", ["api", "user", "--jq", ".login"], {
+  const r = spawnSync7("gh", ["api", "user", "--jq", ".login"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -626,28 +1205,28 @@ function validateRepoVisibility(v) {
 }
 
 // src/lib/create-github-remote-from-folder.ts
-function createGithubRemoteFromFolder(input2) {
-  validateRepoName(input2.name);
-  validateRepoVisibility(input2.visibility);
-  const org = input2.org ?? resolveGithubUsernameDefault();
-  log.info(`T\u1EA1o GitHub repo ${org}/${input2.name} (${input2.visibility})...`);
+function createGithubRemoteFromFolder(input3) {
+  validateRepoName(input3.name);
+  validateRepoVisibility(input3.visibility);
+  const org = input3.org ?? resolveGithubUsernameDefault();
+  log.info(`T\u1EA1o GitHub repo ${org}/${input3.name} (${input3.visibility})...`);
   const urls = executeGhRepoCreate({
-    folder: input2.folder,
+    folder: input3.folder,
     org,
-    name: input2.name,
-    visibility: input2.visibility
+    name: input3.name,
+    visibility: input3.visibility
   });
   log.success(`\u0110\xE3 t\u1EA1o: ${urls.sshUrl}`);
   return urls;
 }
 
 // src/lib/create-workspace-remote-via-gh.ts
-import { spawnSync as spawnSync10 } from "child_process";
+import { spawnSync as spawnSync14 } from "child_process";
 
 // src/lib/check-gh-cli-auth-status.ts
-import { spawnSync as spawnSync4 } from "child_process";
+import { spawnSync as spawnSync8 } from "child_process";
 function checkGhCliAuthStatus() {
-  const r = spawnSync4("gh", ["auth", "status"], { stdio: "ignore" });
+  const r = spawnSync8("gh", ["auth", "status"], { stdio: "ignore" });
   if (r.error && r.error.code === "ENOENT") {
     return "not-installed";
   }
@@ -655,22 +1234,12 @@ function checkGhCliAuthStatus() {
 }
 
 // src/lib/detect-package-manager.ts
-import { spawnSync as spawnSync5 } from "child_process";
-
-// src/lib/detect-host-platform.ts
-import { platform } from "os";
-function detectHostPlatform() {
-  const p = platform();
-  if (p === "darwin" || p === "linux" || p === "win32") return p;
-  return "unsupported";
-}
-
-// src/lib/detect-package-manager.ts
+import { spawnSync as spawnSync9 } from "child_process";
 function hasBinary(name) {
   const platform2 = detectHostPlatform();
   const probe = platform2 === "win32" ? "where" : "command";
   const args = platform2 === "win32" ? [name] : ["-v", name];
-  const r = spawnSync5(probe, args, {
+  const r = spawnSync9(probe, args, {
     shell: platform2 !== "win32",
     stdio: "ignore"
   });
@@ -686,7 +1255,7 @@ function detectPackageManager() {
 }
 
 // src/lib/install-gh-cli-via-package-manager.ts
-import { spawnSync as spawnSync6 } from "child_process";
+import { spawnSync as spawnSync10 } from "child_process";
 var INSTALL_COMMANDS = {
   brew: { cmd: "brew", args: ["install", "gh"] },
   apt: { cmd: "sudo", args: ["apt-get", "install", "-y", "gh"] },
@@ -697,7 +1266,7 @@ var INSTALL_COMMANDS = {
 function installGhCliViaPackageManager(pm) {
   const spec = INSTALL_COMMANDS[pm];
   log.info(`\u0110ang c\xE0i gh CLI qua ${pm}...`);
-  const r = spawnSync6(spec.cmd, spec.args, { stdio: "inherit" });
+  const r = spawnSync10(spec.cmd, spec.args, { stdio: "inherit" });
   if (r.status !== 0) {
     throw new Error(`C\xE0i gh CLI th\u1EA5t b\u1EA1i qua ${pm} (exit ${r.status}). C\xE0i tay r\u1ED3i ch\u1EA1y l\u1EA1i.`);
   }
@@ -705,9 +1274,9 @@ function installGhCliViaPackageManager(pm) {
 }
 
 // src/lib/setup-git-credential-via-gh.ts
-import { spawnSync as spawnSync7 } from "child_process";
+import { spawnSync as spawnSync11 } from "child_process";
 function setupGitCredentialViaGh() {
-  const r = spawnSync7("gh", ["auth", "setup-git"], { stdio: "ignore" });
+  const r = spawnSync11("gh", ["auth", "setup-git"], { stdio: "ignore" });
   if (r.status !== 0) {
     log.warn("gh auth setup-git fail (non-fatal). N\u1EBFu git clone l\u1ED7i 128 \u2192 ch\u1EA1y th\u1EE7 c\xF4ng.");
     return;
@@ -716,10 +1285,10 @@ function setupGitCredentialViaGh() {
 }
 
 // src/lib/trigger-gh-cli-auth-login.ts
-import { spawnSync as spawnSync8 } from "child_process";
+import { spawnSync as spawnSync12 } from "child_process";
 function triggerGhCliAuthLogin() {
   log.info("Kh\u1EDFi \u0111\u1ED9ng \u0111\u0103ng nh\u1EADp GitHub qua gh CLI (browser s\u1EBD m\u1EDF)...");
-  const r = spawnSync8(
+  const r = spawnSync12(
     "gh",
     ["auth", "login", "--hostname", "github.com", "--web", "--git-protocol", "ssh"],
     { stdio: "inherit" }
@@ -731,7 +1300,7 @@ function triggerGhCliAuthLogin() {
 }
 
 // src/lib/verify-git-remote-accessible.ts
-import { spawnSync as spawnSync9 } from "child_process";
+import { spawnSync as spawnSync13 } from "child_process";
 var TIMEOUT_MS = 5e3;
 var RemoteNotAccessibleError = class extends Error {
   constructor(url, reason) {
@@ -740,7 +1309,7 @@ var RemoteNotAccessibleError = class extends Error {
   }
 };
 function verifyGitRemoteAccessible(url) {
-  const r = spawnSync9("git", ["ls-remote", "--exit-code", url, "HEAD"], {
+  const r = spawnSync13("git", ["ls-remote", "--exit-code", url, "HEAD"], {
     stdio: "ignore",
     timeout: TIMEOUT_MS
   });
@@ -780,22 +1349,22 @@ async function ensureGitHubReady(remoteUrl) {
 }
 
 // src/lib/create-workspace-remote-via-gh.ts
-async function createWorkspaceRemoteViaGh(input2) {
-  validateRepoName(input2.workspaceName);
-  validateRepoVisibility(input2.visibility);
+async function createWorkspaceRemoteViaGh(input3) {
+  validateRepoName(input3.workspaceName);
+  validateRepoVisibility(input3.visibility);
   await ensureGitHubReady();
-  const org = input2.org ?? resolveGithubUsernameDefault();
-  const fullName = `${org}/${input2.workspaceName}`;
-  log.info(`T\u1EA1o GitHub repo cho workspace: ${fullName} (${input2.visibility})...`);
-  const r = spawnSync10(
+  const org = input3.org ?? resolveGithubUsernameDefault();
+  const fullName = `${org}/${input3.workspaceName}`;
+  log.info(`T\u1EA1o GitHub repo cho workspace: ${fullName} (${input3.visibility})...`);
+  const r = spawnSync14(
     "gh",
     [
       "repo",
       "create",
       fullName,
-      `--${input2.visibility}`,
+      `--${input3.visibility}`,
       "--source",
-      input2.workspacePath,
+      input3.workspacePath,
       "--remote",
       "origin",
       "--push"
@@ -804,7 +1373,7 @@ async function createWorkspaceRemoteViaGh(input2) {
   );
   if (r.status !== 0) {
     throw new Error(
-      `T\u1EA1o workspace remote th\u1EA5t b\u1EA1i (exit ${r.status}). Workspace v\u1EABn d\xF9ng \u0111\u01B0\u1EE3c local. Setup remote sau qua: gh repo create ${fullName} --${input2.visibility} --source=. --remote=origin --push`
+      `T\u1EA1o workspace remote th\u1EA5t b\u1EA1i (exit ${r.status}). Workspace v\u1EABn d\xF9ng \u0111\u01B0\u1EE3c local. Setup remote sau qua: gh repo create ${fullName} --${input3.visibility} --source=. --remote=origin --push`
     );
   }
   const sshUrl = `git@github.com:${fullName}.git`;
@@ -813,11 +1382,16 @@ async function createWorkspaceRemoteViaGh(input2) {
   return { sshUrl, httpsUrl };
 }
 
+// src/lib/safe-bootstrap-for-dirty-folder.ts
+import { readdirSync } from "fs";
+import { select as select3 } from "@inquirer/prompts";
+import { simpleGit as simpleGit3 } from "simple-git";
+
 // src/lib/check-folder-has-git.ts
 import { existsSync as existsSync2, statSync } from "fs";
-import { join as join7 } from "path";
+import { join as join10 } from "path";
 function checkFolderHasGit(folderPath) {
-  const gitPath = join7(folderPath, ".git");
+  const gitPath = join10(folderPath, ".git");
   if (!existsSync2(gitPath)) return false;
   const stat = statSync(gitPath);
   return stat.isDirectory() || stat.isFile();
@@ -849,7 +1423,7 @@ async function createInitialGitCommit(folderPath) {
 
 // src/lib/detect-folder-tech-stack.ts
 import { existsSync as existsSync3 } from "fs";
-import { join as join8 } from "path";
+import { join as join11 } from "path";
 var SIGNATURES = {
   node: ["package.json"],
   python: ["pyproject.toml", "requirements.txt", "setup.py", "Pipfile"],
@@ -861,7 +1435,7 @@ var SIGNATURES = {
 function detectFolderTechStack(folderPath) {
   const matched = [];
   for (const [stack, files] of Object.entries(SIGNATURES)) {
-    if (files.some((f) => existsSync3(join8(folderPath, f)))) {
+    if (files.some((f) => existsSync3(join11(folderPath, f)))) {
       matched.push(stack);
     }
   }
@@ -869,20 +1443,20 @@ function detectFolderTechStack(folderPath) {
 }
 
 // src/lib/gitignore-template-loader.ts
-import { readFileSync } from "fs";
-import { dirname as dirname3, join as join9 } from "path";
+import { readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname3, join as join12 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var __dirname = dirname3(fileURLToPath2(import.meta.url));
 var CANDIDATE_DIRS = [
-  join9(__dirname, "..", "templates", "gitignore"),
-  join9(__dirname, "..", "..", "src", "templates", "gitignore")
+  join12(__dirname, "..", "templates", "gitignore"),
+  join12(__dirname, "..", "..", "src", "templates", "gitignore")
 ];
 var AVATAR_MARKER_START = "# === avatar ===";
 var AVATAR_MARKER_END = "# === /avatar ===";
 function readTemplate(stack) {
   for (const dir of CANDIDATE_DIRS) {
     try {
-      return readFileSync(join9(dir, `${stack}.txt`), "utf8");
+      return readFileSync2(join12(dir, `${stack}.txt`), "utf8");
     } catch {
     }
   }
@@ -896,15 +1470,15 @@ ${readTemplate(s).trim()}`);
 }
 
 // src/lib/write-or-merge-gitignore.ts
-import { existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync } from "fs";
+import { join as join13 } from "path";
 function writeOrMergeGitignore(folderPath, avatarBlock) {
-  const path = join10(folderPath, ".gitignore");
+  const path = join13(folderPath, ".gitignore");
   if (!existsSync4(path)) {
     writeFileSync(path, avatarBlock, "utf8");
     return;
   }
-  const existing = readFileSync2(path, "utf8");
+  const existing = readFileSync3(path, "utf8");
   const startIdx = existing.indexOf(AVATAR_MARKER_START);
   const endIdx = existing.indexOf(AVATAR_MARKER_END);
   if (startIdx !== -1 && endIdx !== -1 && endIdx > startIdx) {
@@ -920,24 +1494,162 @@ ${avatarBlock}${after.trimStart()}`, "utf8");
 ${avatarBlock}`, "utf8");
 }
 
-// src/lib/git-bootstrap-orchestrator.ts
-async function bootstrapGitInFolder(folderPath) {
-  const hadGit = checkFolderHasGit(folderPath);
+// src/lib/safe-bootstrap-for-dirty-folder.ts
+var InitAbortedByUserError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InitAbortedByUserError";
+  }
+};
+async function detectFolderGitState(folderPath) {
+  const hasGit = checkFolderHasGit(folderPath);
+  if (!hasGit) {
+    const entries = readdirSync(folderPath).filter((e) => e !== ".git");
+    return entries.length === 0 ? "empty" : "untracked-only";
+  }
+  const g = simpleGit3({ baseDir: folderPath });
+  const status = await g.status();
+  return status.isClean() ? "clean" : "dirty";
+}
+async function promptBootstrapStrategy(state, opts) {
+  if (opts.presetStrategy) return opts.presetStrategy;
+  if (opts.autoYes) return "stash";
+  if (state === "empty" || state === "clean") return "commit-all";
+  return await select3({
+    message: state === "dirty" ? "Folder c\xF3 changes ch\u01B0a commit. C\xE1ch x\u1EED l\xFD:" : "Folder c\xF3 file ch\u01B0a version. C\xE1ch x\u1EED l\xFD:",
+    choices: [
+      {
+        value: "stash",
+        name: "1. Stash changes \u2192 bootstrap \u2192 restore (KHUY\u1EBEN NGH\u1ECA)"
+      },
+      {
+        value: "commit-all",
+        name: "2. Commit to\xE0n b\u1ED9 v\xE0o initial commit (legacy v1.1.6)"
+      },
+      {
+        value: "skip",
+        name: "3. Skip \u2014 t\xF4i commit th\u1EE7 c\xF4ng r\u1ED3i ch\u1EA1y l\u1EA1i"
+      },
+      {
+        value: "branch",
+        name: "4. Commit v\xE0o branch ri\xEAng `avatar/init` (main gi\u1EEF s\u1EA1ch)"
+      }
+    ],
+    default: "stash"
+  });
+}
+async function stashUserChanges(g, stashName) {
+  const status = await g.status();
+  if (status.isClean() && status.not_added.length === 0) return false;
+  await g.stash(["push", "--include-untracked", "-m", stashName]);
+  log.info(`Stashed changes: ${stashName}`);
+  return true;
+}
+async function restoreStash(g, stashName) {
+  try {
+    await g.stash(["pop"]);
+    log.success(`Restored stash: ${stashName}`);
+  } catch (err) {
+    log.warn(
+      "Restore stash conflict \u2014 files c\xF3 Avatar t\u1EA1o v\xE0 stash c\u1EE7a user xung \u0111\u1ED9t. Stash gi\u1EEF t\u1EA1i ref stash@{0}."
+    );
+    log.warn("Resolve: git stash show -p stash@{0} \u2192 fix conflict \u2192 git stash drop");
+    log.dim(`Detail: ${err.message}`);
+  }
+}
+async function getCurrentBranch(g) {
+  try {
+    const result = await g.revparse(["--abbrev-ref", "HEAD"]);
+    const branch = result.trim();
+    return branch === "HEAD" ? "main" : branch;
+  } catch {
+    return "main";
+  }
+}
+async function writeAvatarGitignore(folderPath) {
   const stacks = detectFolderTechStack(folderPath);
-  log.info(`Tech stack detected: ${stacks.join(", ")}`);
+  log.info(`Tech stack: ${stacks.join(", ")}`);
   writeOrMergeGitignore(folderPath, composeGitignoreContent(stacks));
   log.success(".gitignore \u0111\xE3 ghi (Avatar block)");
-  if (!hadGit) {
-    log.info(`Bootstrap git cho ${folderPath}...`);
-    await createInitialGitCommit(folderPath);
-    log.success("\u0110\xE3 git init + initial commit");
-  } else {
-    log.dim("Folder \u0111\xE3 c\xF3 .git \u2014 skip init.");
+}
+async function executeBootstrapWithStrategy(folderPath, strategy) {
+  const g = simpleGit3({ baseDir: folderPath });
+  switch (strategy) {
+    case "skip":
+      throw new InitAbortedByUserError(
+        "Init aborted. Commit th\u1EE7 c\xF4ng changes hi\u1EC7n t\u1EA1i r\u1ED3i ch\u1EA1y l\u1EA1i `avatar init`."
+      );
+    case "stash": {
+      const stashName = `avatar-init-backup-${Date.now()}`;
+      const hadGit = checkFolderHasGit(folderPath);
+      if (!hadGit) {
+        await g.init();
+        await g.branch(["-M", "main"]).catch(() => void 0);
+      }
+      const hasCommit = (await g.raw(["rev-list", "-n", "1", "--all"]).catch(() => "")).trim();
+      if (!hasCommit) {
+        await g.commit("chore: avatar baseline (pre-stash)", void 0, { "--allow-empty": null });
+      }
+      const stashed = await stashUserChanges(g, stashName);
+      try {
+        await writeAvatarGitignore(folderPath);
+        await createInitialGitCommit(folderPath);
+      } finally {
+        if (stashed) await restoreStash(g, stashName);
+      }
+      break;
+    }
+    case "commit-all": {
+      await writeAvatarGitignore(folderPath);
+      await createInitialGitCommit(folderPath);
+      break;
+    }
+    case "branch": {
+      const hadGit = checkFolderHasGit(folderPath);
+      if (!hadGit) {
+        await g.init();
+        await g.branch(["-M", "main"]);
+      }
+      const originalBranch = await getCurrentBranch(g);
+      try {
+        await g.checkoutLocalBranch("avatar/init");
+      } catch {
+        await g.checkout("avatar/init");
+      }
+      await writeAvatarGitignore(folderPath);
+      await createInitialGitCommit(folderPath);
+      try {
+        await g.checkout(originalBranch);
+        log.info(
+          `Avatar init committed \u1EDF branch 'avatar/init'. Switch back v\u1EC1 '${originalBranch}'. Merge khi s\u1EB5n s\xE0ng: git merge avatar/init`
+        );
+      } catch {
+        log.warn(
+          `Kh\xF4ng switch v\u1EC1 '${originalBranch}' \u0111\u01B0\u1EE3c \u2014 \u1EDF l\u1EA1i branch 'avatar/init'. Switch tay sau.`
+        );
+      }
+      break;
+    }
   }
 }
+async function safeBootstrapGitInFolder(folderPath, opts = {}) {
+  const state = await detectFolderGitState(folderPath);
+  log.info(`Folder state: ${state}`);
+  if (state === "empty" || state === "clean") {
+    await writeAvatarGitignore(folderPath);
+    if (state === "empty") {
+      await createInitialGitCommit(folderPath);
+    }
+    await appendAuditEntry("bootstrap", `state=${state},strategy=auto`);
+    return;
+  }
+  const strategy = await promptBootstrapStrategy(state, opts);
+  await executeBootstrapWithStrategy(folderPath, strategy);
+  await appendAuditEntry("bootstrap", `state=${state},strategy=${strategy}`);
+}
 
 // src/lib/team-pack-submodule-manager.ts
-import { join as join11 } from "path";
+import { join as join14 } from "path";
 
 // src/lib/resolve-team-pack-repo-url.ts
 var LEGACY_FALLBACK = "https://github.com/LukeNALS/team-ai-pack.git";
@@ -975,7 +1687,7 @@ async function addTeamPackSubmodule(projectRoot, tag) {
   }
   let target = tag ?? null;
   if (!target) {
-    target = await latestTag(join11(projectRoot, TEAM_PACK_RELATIVE_PATH));
+    target = await latestTag(join14(projectRoot, TEAM_PACK_RELATIVE_PATH));
   }
   if (target) {
     await checkoutTagInSubmodule(TEAM_PACK_RELATIVE_PATH, target, projectRoot);
@@ -983,7 +1695,7 @@ async function addTeamPackSubmodule(projectRoot, tag) {
   return { pinnedTag: target };
 }
 async function readPinnedPackVersion(projectRoot) {
-  const submoduleRoot = join11(projectRoot, TEAM_PACK_RELATIVE_PATH);
+  const submoduleRoot = join14(projectRoot, TEAM_PACK_RELATIVE_PATH);
   const tag = await latestTag(submoduleRoot);
   if (tag) return tag;
   const sha = await currentCommitSha(submoduleRoot);
@@ -992,7 +1704,7 @@ async function readPinnedPackVersion(projectRoot) {
 
 // src/commands/init-conflict-detection-helpers.ts
 import { readdir } from "fs/promises";
-import { join as join12 } from "path";
+import { join as join15 } from "path";
 async function isEmptyOrMissing(path) {
   if (!await pathExists(path)) return true;
   try {
@@ -1005,7 +1717,7 @@ async function isEmptyOrMissing(path) {
 }
 async function findAlternativeWorkspaceName(parent, desiredName, maxAttempts = 10) {
   for (let i = 2; i < maxAttempts; i++) {
-    const candidate = join12(parent, `${desiredName}-${i}`);
+    const candidate = join15(parent, `${desiredName}-${i}`);
     if (await isEmptyOrMissing(candidate)) return candidate;
   }
   return null;
@@ -1031,11 +1743,29 @@ function buildScaffoldVariables(args) {
 }
 
 // src/commands/init.ts
+function parseBootstrapStrategyOpts(opts) {
+  if (opts.preserveUncommitted) return "stash";
+  if (!opts.bootstrapStrategy) return void 0;
+  const valid = ["stash", "commit-all", "skip", "branch"];
+  if (valid.includes(opts.bootstrapStrategy)) {
+    return opts.bootstrapStrategy;
+  }
+  throw new Error(
+    `--bootstrap-strategy kh\xF4ng h\u1EE3p l\u1EC7: ${opts.bootstrapStrategy}. Ch\u1ECDn: ${valid.join(" | ")}`
+  );
+}
 function registerInitCommand(program2) {
-  program2.command("init").description("Kh\u1EDFi t\u1EA1o Avatar \u2014 3 flow t\u1EF1 nh\u1EADn di\u1EC7n (repo / folder / new)").option("--project-status <val>", "existing-remote | existing-folder | new-project").option("--folder-path <path>", "\u0110\u01B0\u1EDDng d\u1EABn folder hi\u1EC7n c\xF3 (flow existing-folder)").option("--create-remote", "Force t\u1EA1o remote qua gh (flow existing-folder ho\u1EB7c new-project)").option("--repo-visibility <val>", "private (m\u1EB7c \u0111\u1ECBnh) | public").option("--repo-org <name>", "GitHub org/owner cho repo m\u1EDBi").option("--client-repo <url>", "URL git remote (flow existing-remote)").option("--workspace-name <name>", "T\xEAn workspace").option("--workspace-parent <path>", "Th\u01B0 m\u1EE5c cha t\u1EA1o workspace (m\u1EB7c \u0111\u1ECBnh . \u2014 CWD)").option("--pack-version <tag>", "Pin team-ai-pack v\xE0o tag c\u1EE5 th\u1EC3").option("--team-owner <email>", "Email team owner (b\u1ECF qua prompt)").option("--description <text>", "M\xF4 t\u1EA3 1 d\xF2ng c\u1EE7a d\u1EF1 \xE1n").option("--skip-scan", "B\u1ECF qua project-scanner sau scaffold").option("--skip-team-pack", "B\u1ECF qua submodule team-ai-pack (test mode)").option("--force", "B\u1ECF qua prompt khi workspace path \u0111\xE3 t\u1ED3n t\u1EA1i").option("--yes", "Auto-confirm t\u1EA5t c\u1EA3 prompt").option("--no-commit", "Skip commit workspace initial state (m\u1EB7c \u0111\u1ECBnh LU\xD4N commit)").option("--workspace-remote", "T\u1EA1o GitHub remote cho workspace root (default: prompt)").option("--mode <mode>", "[DEPRECATED] D\xF9ng --project-status thay th\u1EBF").action(async (opts) => {
+  program2.command("init").description("Kh\u1EDFi t\u1EA1o Avatar \u2014 3 flow t\u1EF1 nh\u1EADn di\u1EC7n (repo / folder / new)").option("--project-status <val>", "existing-remote | existing-folder | new-project").option("--folder-path <path>", "\u0110\u01B0\u1EDDng d\u1EABn folder hi\u1EC7n c\xF3 (flow existing-folder)").option("--create-remote", "Force t\u1EA1o remote qua gh (flow existing-folder ho\u1EB7c new-project)").option("--repo-visibility <val>", "private (m\u1EB7c \u0111\u1ECBnh) | public").option("--repo-org <name>", "GitHub org/owner cho repo m\u1EDBi").option("--client-repo <url>", "URL git remote (flow existing-remote)").option("--workspace-name <name>", "T\xEAn workspace").option("--workspace-parent <path>", "Th\u01B0 m\u1EE5c cha t\u1EA1o workspace (m\u1EB7c \u0111\u1ECBnh . \u2014 CWD)").option("--pack-version <tag>", "Pin team-ai-pack v\xE0o tag c\u1EE5 th\u1EC3").option("--team-owner <email>", "Email team owner (b\u1ECF qua prompt)").option("--description <text>", "M\xF4 t\u1EA3 1 d\xF2ng c\u1EE7a d\u1EF1 \xE1n").option("--skip-scan", "B\u1ECF qua project-scanner sau scaffold").option("--skip-team-pack", "B\u1ECF qua submodule team-ai-pack (test mode)").option("--force", "B\u1ECF qua prompt khi workspace path \u0111\xE3 t\u1ED3n t\u1EA1i").option("--yes", "Auto-confirm t\u1EA5t c\u1EA3 prompt").option("--no-commit", "Skip commit workspace initial state (m\u1EB7c \u0111\u1ECBnh LU\xD4N commit)").option("--workspace-remote", "T\u1EA1o GitHub remote cho workspace root (default: prompt)").option("--ai-skip", "B\u1ECF qua phase AI setup (CI/test mode \u2014 ch\u1EA1y `avatar ai setup` sau)").option(
+    "--bootstrap-strategy <s>",
+    "X\u1EED l\xFD folder dirty: stash | commit-all | skip | branch (default: prompt)"
+  ).option("--preserve-uncommitted", "Alias cho --bootstrap-strategy=stash (gi\u1EEF changes user)").option("--mode <mode>", "[DEPRECATED] D\xF9ng --project-status thay th\u1EBF").action(async (opts) => {
     try {
       await runInit(opts);
     } catch (err) {
+      if (err instanceof InitAbortedByUserError) {
+        log.dim(err.message);
+        process.exit(0);
+      }
       log.error(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
@@ -1065,7 +1795,7 @@ async function runInit(opts) {
   }
 }
 async function promptProjectStatus() {
-  return await select({
+  return await select4({
     message: "T\xECnh tr\u1EA1ng d\u1EF1 \xE1n c\u1EE7a b\u1EA1n?",
     choices: [
       { name: "1. \u0110\xE3 c\xF3 repo git remote (URL c\xF3 s\u1EB5n)", value: "existing-remote" },
@@ -1075,14 +1805,14 @@ async function promptProjectStatus() {
   });
 }
 async function runInitFromExistingRemote(opts, ownerEmail) {
-  const remoteUrl = opts.clientRepo ?? await input({
+  const remoteUrl = opts.clientRepo ?? await input2({
     message: "URL git c\u1EE7a repo:",
     validate: (v) => v.length > 0 ? true : "URL b\u1EAFt bu\u1ED9c"
   });
   await ensureGitHubReady(remoteUrl);
   const teamOwner = opts.teamOwner ?? await promptTeamOwner(ownerEmail);
   const inferredName = inferWorkspaceName(remoteUrl);
-  const workspaceName = opts.workspaceName ?? await input({ message: "T\xEAn workspace:", default: inferredName });
+  const workspaceName = opts.workspaceName ?? await input2({ message: "T\xEAn workspace:", default: inferredName });
   const workspaceParent = resolve(opts.workspaceParent ?? ".");
   const workspacePath = await resolveWorkspacePath(workspaceParent, workspaceName, opts.force);
   await scaffoldWorkspaceWithSrcSubmodule({
@@ -1098,21 +1828,25 @@ async function runInitFromExistingRemote(opts, ownerEmail) {
     createWorkspaceRemote: opts.workspaceRemote,
     repoVisibility: opts.repoVisibility,
     repoOrg: opts.repoOrg,
-    flow: "existing-remote"
+    flow: "existing-remote",
+    aiSkip: opts.aiSkip
   });
 }
 async function runInitFromExistingFolder(opts, ownerEmail) {
   const folderPath = resolve(
-    opts.folderPath ?? await input({
+    opts.folderPath ?? await input2({
       message: "\u0110\u01B0\u1EDDng d\u1EABn folder hi\u1EC7n c\xF3:",
       validate: (v) => v.length > 0 ? true : "Path b\u1EAFt bu\u1ED9c"
     })
   );
-  await bootstrapGitInFolder(folderPath);
+  await safeBootstrapGitInFolder(folderPath, {
+    presetStrategy: parseBootstrapStrategyOpts(opts),
+    autoYes: opts.yes
+  });
   const remoteUrl = await getOrCreateOriginRemote(folderPath, opts);
   const teamOwner = opts.teamOwner ?? await promptTeamOwner(ownerEmail);
   const inferredName = opts.workspaceName ?? `${basename(folderPath)}-avatar-workspace`;
-  const workspaceName = opts.workspaceName ?? await input({ message: "T\xEAn workspace:", default: inferredName });
+  const workspaceName = opts.workspaceName ?? await input2({ message: "T\xEAn workspace:", default: inferredName });
   const workspaceParent = resolve(opts.workspaceParent ?? ".");
   const workspacePath = await resolveWorkspacePath(workspaceParent, workspaceName, opts.force);
   await scaffoldWorkspaceWithSrcSubmodule({
@@ -1129,16 +1863,17 @@ async function runInitFromExistingFolder(opts, ownerEmail) {
     createWorkspaceRemote: opts.workspaceRemote,
     repoVisibility: opts.repoVisibility,
     repoOrg: opts.repoOrg,
-    flow: "existing-folder"
+    flow: "existing-folder",
+    aiSkip: opts.aiSkip
   });
 }
 async function runInitFromScratch(opts, ownerEmail) {
   await ensureGitHubReady();
-  const projectName = opts.workspaceName ?? await input({
+  const projectName = opts.workspaceName ?? await input2({
     message: "T\xEAn d\u1EF1 \xE1n:",
     validate: (v) => v.length > 0 ? true : "T\xEAn b\u1EAFt bu\u1ED9c"
   });
-  const visibility = opts.repoVisibility ?? await select({
+  const visibility = opts.repoVisibility ?? await select4({
     message: "Visibility?",
     choices: [
       { name: "private (m\u1EB7c \u0111\u1ECBnh)", value: "private" },
@@ -1148,10 +1883,10 @@ async function runInitFromScratch(opts, ownerEmail) {
   const teamOwner = opts.teamOwner ?? await promptTeamOwner(ownerEmail);
   const workspaceParent = resolve(opts.workspaceParent ?? ".");
   const workspacePath = await resolveWorkspacePath(workspaceParent, projectName, opts.force);
-  const srcPath = join13(workspacePath, "src");
+  const srcPath = join16(workspacePath, "src");
   await ensureDir(workspacePath);
   await ensureDir(srcPath);
-  await bootstrapGitInFolder(srcPath);
+  await safeBootstrapGitInFolder(srcPath, { autoYes: true });
   const urls = createGithubRemoteFromFolder({
     folder: srcPath,
     name: projectName,
@@ -1183,7 +1918,8 @@ async function runInitFromScratch(opts, ownerEmail) {
       createWorkspaceRemote: opts.workspaceRemote,
       repoVisibility: opts.repoVisibility,
       repoOrg: opts.repoOrg,
-      flow: "new-project"
+      flow: "new-project",
+      aiSkip: opts.aiSkip
     });
   } catch (err) {
     sp.fail("Init workspace th\u1EA5t b\u1EA1i");
@@ -1197,7 +1933,7 @@ async function getOrCreateOriginRemote(folderPath, opts) {
     log.success(`Folder \u0111\xE3 c\xF3 remote origin: ${origin.refs.push}`);
     return origin.refs.push;
   }
-  const shouldCreate = opts.createRemote ?? await confirm({
+  const shouldCreate = opts.createRemote ?? await confirm2({
     message: "Folder ch\u01B0a c\xF3 remote. T\u1EA1o GitHub repo ngay \u0111\u1EC3 share team?",
     default: true
   });
@@ -1206,14 +1942,14 @@ async function getOrCreateOriginRemote(folderPath, opts) {
     return void 0;
   }
   await ensureGitHubReady();
-  const visibility = opts.repoVisibility ?? await select({
+  const visibility = opts.repoVisibility ?? await select4({
     message: "Visibility?",
     choices: [
       { name: "private (m\u1EB7c \u0111\u1ECBnh)", value: "private" },
       { name: "public", value: "public" }
     ]
   });
-  const repoName = await input({
+  const repoName = await input2({
     message: "T\xEAn repo:",
     default: basename(folderPath)
   });
@@ -1252,7 +1988,8 @@ async function scaffoldWorkspaceWithSrcSubmodule(args) {
       createWorkspaceRemote: args.createWorkspaceRemote,
       repoVisibility: args.repoVisibility,
       repoOrg: args.repoOrg,
-      flow: args.flow
+      flow: args.flow,
+      aiSkip: args.aiSkip
     });
   } catch (err) {
     sp.fail("Init workspace th\u1EA5t b\u1EA1i");
@@ -1272,15 +2009,21 @@ async function finalizeWorkspaceScaffold(args) {
   await writeRootClaudeMd(args.workspacePath, vars);
   await writeProjectSettings(args.workspacePath, vars);
   await appendGitignoreEntries(args.workspacePath);
-  await ensureDir(join13(args.workspacePath, "notes"));
-  await ensureDir(join13(args.workspacePath, "scripts"));
-  await installGitHook(join13(args.workspacePath, ".git"), "post-merge");
-  await installGitHook(join13(args.workspacePath, ".git", "modules", "src"), "pre-push");
+  await ensureDir(join16(args.workspacePath, "notes"));
+  await ensureDir(join16(args.workspacePath, "scripts"));
+  await installGitHook(join16(args.workspacePath, ".git"), "post-merge");
+  await installGitHook(join16(args.workspacePath, ".git", "modules", "src"), "pre-push");
   log.success("C\xE0i post-merge (workspace) + pre-push (src/)");
   await appendAuditEntry("init", `flow=${args.flow},workspace=${args.workspaceName}`);
   await maybeCommitWorkspace(args.workspacePath, args.skipCommit);
   await maybeCreateWorkspaceRemote(args);
-  printInitSuccessBox(args.workspacePath, args.flow);
+  let aiResult = null;
+  if (args.aiSkip) {
+    log.dim("B\u1ECF qua AI setup (--ai-skip). Setup sau qua: avatar ai setup");
+  } else {
+    aiResult = await runAiSetupPhase({ workspacePath: args.workspacePath });
+  }
+  printInitSuccessBox(args.workspacePath, args.flow, aiResult);
 }
 async function maybeCreateWorkspaceRemote(args) {
   if (args.skipCommit) {
@@ -1290,13 +2033,13 @@ async function maybeCreateWorkspaceRemote(args) {
   let shouldCreate = args.createWorkspaceRemote;
   if (shouldCreate === void 0) {
     if (args.autoYes) return;
-    shouldCreate = await confirm({
+    shouldCreate = await confirm2({
       message: "T\u1EA1o remote GitHub cho workspace \u0111\u1EC3 share team? (Avatar state)",
       default: false
     });
   }
   if (!shouldCreate) return;
-  const visibility = args.repoVisibility ?? (args.autoYes ? "private" : await select({
+  const visibility = args.repoVisibility ?? (args.autoYes ? "private" : await select4({
     message: "Workspace visibility?",
     choices: [
       { name: "private (m\u1EB7c \u0111\u1ECBnh, an to\xE0n)", value: "private" },
@@ -1316,7 +2059,7 @@ async function maybeCreateWorkspaceRemote(args) {
   }
 }
 async function resolveWorkspacePath(parent, desiredName, force) {
-  const desired = join13(parent, desiredName);
+  const desired = join16(parent, desiredName);
   if (await isEmptyOrMissing(desired)) return desired;
   const alternative = await findAlternativeWorkspaceName(parent, desiredName);
   if (!alternative) {
@@ -1327,12 +2070,12 @@ async function resolveWorkspacePath(parent, desiredName, force) {
     log.info(`--force: d\xF9ng ${alternative}`);
     return alternative;
   }
-  const useAlt = await confirm({ message: `D\xF9ng "${alternative}" thay th\u1EBF?`, default: true });
+  const useAlt = await confirm2({ message: `D\xF9ng "${alternative}" thay th\u1EBF?`, default: true });
   if (!useAlt) throw new Error("H\u1EE7y init. Ch\u1EA1y l\u1EA1i v\u1EDBi --workspace-name kh\xE1c.");
   return alternative;
 }
 async function promptTeamOwner(currentUserEmail) {
-  return await input({ message: "Team owner email:", default: currentUserEmail });
+  return await input2({ message: "Team owner email:", default: currentUserEmail });
 }
 async function maybeCommitWorkspace(workspacePath, skipCommit) {
   if (skipCommit) {
@@ -1344,10 +2087,21 @@ async function maybeCommitWorkspace(workspacePath, skipCommit) {
   await g.commit("chore: initialize Avatar workspace");
   log.success("\u0110\xE3 commit workspace");
 }
-function printInitSuccessBox(rootPath, flow) {
+function formatAiStatusLine(aiResult) {
+  if (aiResult === null) {
+    return `  ${chalk.yellow("AI:")} skipped \xB7 ${chalk.cyan("avatar ai setup")} \u0111\u1EC3 config sau`;
+  }
+  if (aiResult.ok) {
+    const modelPart = aiResult.model ? ` \xB7 model=${aiResult.model}` : "";
+    return `  ${chalk.green("AI:")} ready \xB7 ${aiResult.provider}${modelPart}`;
+  }
+  return `  ${chalk.yellow("AI:")} failed (${aiResult.reason.slice(0, 60)}) \xB7 th\u1EED ${chalk.cyan("avatar ai setup")}`;
+}
+function printInitSuccessBox(rootPath, flow, aiResult = null) {
   const lines = [
     `${chalk.green("\u2713")} Workspace s\u1EB5n s\xE0ng: ${relative2(process.cwd(), rootPath) || rootPath}`,
     `  ${chalk.dim(`(flow: ${flow})`)}`,
+    formatAiStatusLine(aiResult),
     "",
     `  ${chalk.cyan(`cd ${rootPath}`)}`,
     `  ${chalk.cyan("claude")}                    M\u1EDF Claude Code \u1EDF workspace root`,
@@ -1582,18 +2336,18 @@ function registerSecretsCommand(program2) {
 }
 
 // src/commands/status.ts
-import { promises as fs6 } from "fs";
-import { join as join15 } from "path";
+import { promises as fs8 } from "fs";
+import { join as join18 } from "path";
 import boxen4 from "boxen";
 
 // src/lib/pack-backup-manager.ts
-import { promises as fs5 } from "fs";
-import { join as join14 } from "path";
+import { promises as fs7 } from "fs";
+import { join as join17 } from "path";
 var BACKUP_DIR_NAME = "_backup";
 async function listBackups(projectRoot) {
-  const dir = join14(projectRoot, ".claude", BACKUP_DIR_NAME);
+  const dir = join17(projectRoot, ".claude", BACKUP_DIR_NAME);
   if (!await pathExists(dir)) return [];
-  const entries = await fs5.readdir(dir, { withFileTypes: true });
+  const entries = await fs7.readdir(dir, { withFileTypes: true });
   return entries.filter((e) => e.isDirectory()).map((e) => e.name).sort().reverse();
 }
 
@@ -1617,7 +2371,7 @@ function registerStatusCommand(program2) {
 }
 async function gatherStatus(cwd) {
   const projectName = cwd.split("/").filter(Boolean).pop() ?? "unknown";
-  const claudeRoot = join15(cwd, ".claude");
+  const claudeRoot = join18(cwd, ".claude");
   const hasAvatar = await pathExists(claudeRoot);
   if (!hasAvatar) {
     return {
@@ -1630,9 +2384,9 @@ async function gatherStatus(cwd) {
       hasAvatar: false
     };
   }
-  const packVersion = await isGitRepo(join15(claudeRoot, "pack")) ? await readPinnedPackVersion(cwd).catch(() => null) : null;
-  const pendingDir = join15(claudeRoot, "_pending");
-  const pendingCount = await pathExists(pendingDir) ? (await fs6.readdir(pendingDir)).filter((n) => n.endsWith(".diff.md")).length : 0;
+  const packVersion = await isGitRepo(join18(claudeRoot, "pack")) ? await readPinnedPackVersion(cwd).catch(() => null) : null;
+  const pendingDir = join18(claudeRoot, "_pending");
+  const pendingCount = await pathExists(pendingDir) ? (await fs8.readdir(pendingDir)).filter((n) => n.endsWith(".diff.md")).length : 0;
   const backupCount = (await listBackups(cwd)).length;
   const techStackSummary = await readTechStackFirstLine(claudeRoot);
   return {
@@ -1646,7 +2400,7 @@ async function gatherStatus(cwd) {
   };
 }
 async function readTechStackFirstLine(claudeRoot) {
-  const techStackPath = join15(claudeRoot, "project", "tech-stack.md");
+  const techStackPath = join18(claudeRoot, "project", "tech-stack.md");
   if (!await pathExists(techStackPath)) return "(no tech-stack.md)";
   const content = await readText(techStackPath);
   const firstNonHeaderLine = content.split("\n").find((l) => l.trim() && !l.startsWith("#") && !l.startsWith(">"));
@@ -1681,33 +2435,33 @@ function registerToolsCommand(program2) {
 
 // src/commands/uninstall.ts
 import { relative as relative3 } from "path";
-import { confirm as confirm2 } from "@inquirer/prompts";
+import { confirm as confirm3 } from "@inquirer/prompts";
 import boxen5 from "boxen";
 
 // src/lib/create-uninstall-backup-snapshot.ts
 import { cp, mkdir, writeFile } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { basename as basename2, join as join16 } from "path";
-var UNINSTALL_BACKUPS_DIR = join16(homedir2(), ".avatar", "uninstall-backups");
+import { homedir as homedir3 } from "os";
+import { basename as basename2, join as join19 } from "path";
+var UNINSTALL_BACKUPS_DIR = join19(homedir3(), ".avatar", "uninstall-backups");
 async function createUninstallBackupSnapshot(projectRoot, artifacts, avatarVersion) {
   const projectName = basename2(projectRoot);
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const backupDir = join16(UNINSTALL_BACKUPS_DIR, `${projectName}-${timestamp}`);
+  const backupDir = join19(UNINSTALL_BACKUPS_DIR, `${projectName}-${timestamp}`);
   await mkdir(backupDir, { recursive: true, mode: 448 });
   if (artifacts.claudeDir) {
-    await cp(artifacts.claudeDir, join16(backupDir, ".claude"), { recursive: true });
+    await cp(artifacts.claudeDir, join19(backupDir, ".claude"), { recursive: true });
   }
   if (artifacts.claudeMd) {
-    await cp(artifacts.claudeMd, join16(backupDir, "CLAUDE.md"));
+    await cp(artifacts.claudeMd, join19(backupDir, "CLAUDE.md"));
   }
   if (artifacts.postMergeHook || artifacts.prePushHook) {
-    const hooksBackupDir = join16(backupDir, "hooks");
+    const hooksBackupDir = join19(backupDir, "hooks");
     await mkdir(hooksBackupDir, { recursive: true });
     if (artifacts.postMergeHook) {
-      await cp(artifacts.postMergeHook, join16(hooksBackupDir, "post-merge"));
+      await cp(artifacts.postMergeHook, join19(hooksBackupDir, "post-merge"));
     }
     if (artifacts.prePushHook) {
-      await cp(artifacts.prePushHook, join16(hooksBackupDir, "pre-push"));
+      await cp(artifacts.prePushHook, join19(hooksBackupDir, "pre-push"));
     }
   }
   const manifest = {
@@ -1722,27 +2476,27 @@ async function createUninstallBackupSnapshot(projectRoot, artifacts, avatarVersi
       prePushHook: !!artifacts.prePushHook
     }
   };
-  await writeFile(join16(backupDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf8");
+  await writeFile(join19(backupDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf8");
   return backupDir;
 }
 
 // src/lib/detect-avatar-project-artifacts.ts
 import { existsSync as existsSync5 } from "fs";
-import { join as join17 } from "path";
+import { join as join20 } from "path";
 function existsOrNull(path) {
   return existsSync5(path) ? path : null;
 }
 function detectAvatarProjectArtifacts(projectRoot) {
-  const claudeDir = existsOrNull(join17(projectRoot, ".claude"));
-  const claudeMd = existsOrNull(join17(projectRoot, "CLAUDE.md"));
-  const postMergeHook = existsOrNull(join17(projectRoot, ".git", "hooks", "post-merge"));
+  const claudeDir = existsOrNull(join20(projectRoot, ".claude"));
+  const claudeMd = existsOrNull(join20(projectRoot, "CLAUDE.md"));
+  const postMergeHook = existsOrNull(join20(projectRoot, ".git", "hooks", "post-merge"));
   const prePushHook = existsOrNull(
-    join17(projectRoot, ".git", "modules", "src", "hooks", "pre-push")
+    join20(projectRoot, ".git", "modules", "src", "hooks", "pre-push")
   );
-  const gitignorePath = existsOrNull(join17(projectRoot, ".gitignore"));
-  const gitmodulesPath = existsOrNull(join17(projectRoot, ".gitmodules"));
-  const notesDir = existsOrNull(join17(projectRoot, "notes"));
-  const scriptsDir = existsOrNull(join17(projectRoot, "scripts"));
+  const gitignorePath = existsOrNull(join20(projectRoot, ".gitignore"));
+  const gitmodulesPath = existsOrNull(join20(projectRoot, ".gitmodules"));
+  const notesDir = existsOrNull(join20(projectRoot, "notes"));
+  const scriptsDir = existsOrNull(join20(projectRoot, "scripts"));
   const hasAnyArtifact = !!(claudeDir || claudeMd || postMergeHook || prePushHook);
   return {
     hasAnyArtifact,
@@ -1763,11 +2517,11 @@ async function executeUninstallDeletion(artifacts, flags) {
   if (artifacts.claudeDir) {
     if (flags.keepSubmodule) {
       const { readdir: readdir2 } = await import("fs/promises");
-      const { join: join18 } = await import("path");
+      const { join: join21 } = await import("path");
       const entries = await readdir2(artifacts.claudeDir);
       for (const entry of entries) {
         if (entry === "pack") continue;
-        await rm(join18(artifacts.claudeDir, entry), { recursive: true, force: true });
+        await rm(join21(artifacts.claudeDir, entry), { recursive: true, force: true });
       }
     } else {
       await rm(artifacts.claudeDir, { recursive: true, force: true });
@@ -1836,7 +2590,7 @@ async function removeSubmoduleEntry(gitmodulesPath, submodulePath) {
 }
 
 // src/commands/uninstall.ts
-var CLI_VERSION = "1.1.6";
+var CLI_VERSION = "1.2.0";
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("G\u1EE1 Avatar kh\u1ECFi project \u2014 backup t\u1EF1 \u0111\u1ED9ng (M11)").option("--yes", "Skip confirm prompt").option("--no-backup", "Kh\xF4ng t\u1EA1o backup tr\u01B0\u1EDBc khi x\xF3a (nguy hi\u1EC3m)").option("--keep-submodule", "Gi\u1EEF submodule .claude/pack/").option("--keep-hooks", "Gi\u1EEF git hooks post-merge, pre-push").option("--dry-run", "Hi\u1EC3n th\u1ECB danh s\xE1ch s\u1EBD x\xF3a, kh\xF4ng th\u1EF1c thi").action(async (opts) => {
     try {
@@ -1860,7 +2614,7 @@ async function runUninstall(opts) {
     return;
   }
   if (!opts.yes) {
-    const ok = await confirm2({
+    const ok = await confirm3({
       message: "Ti\u1EBFp t\u1EE5c g\u1EE1 Avatar?",
       default: false
     });
@@ -1918,7 +2672,7 @@ function printUninstallSuccessBox(backupPath) {
 }
 
 // src/index.ts
-var CLI_VERSION2 = "1.1.6";
+var CLI_VERSION2 = "1.2.0";
 var program = new Command();
 program.name("avatar").description("AI harness CLI for NAL Vietnam engineering").version(CLI_VERSION2, "-v, --version", "Hi\u1EC3n th\u1ECB phi\xEAn b\u1EA3n Avatar CLI").addHelpText(
   "beforeAll",
@@ -1944,6 +2698,7 @@ registerCommitCommand(program);
 registerToolsCommand(program);
 registerSecretsCommand(program);
 registerMcpRunCommand(program);
+registerAiCommand(program);
 registerUninstallCommand(program);
 program.parseAsync(process.argv).catch((err) => {
   const msg = err instanceof Error ? err.message : String(err);