@nalvietnam/avatar-cli 1.2.10 → 1.3.0

package/dist/index.js

@@ -546,19 +546,19 @@ function applyUseGlobal(existing, source) {
     ...sourceModel ? { model: sourceModel } : {}
   };
 }
-async function writeClaudeSettings(workspacePath, input5) {
+async function writeClaudeSettings(workspacePath, input6) {
   const path = getClaudeSettingsPath(workspacePath);
   const existing = await readExistingSettings(path);
   let merged;
-  switch (input5.provider) {
+  switch (input6.provider) {
     case "subscription":
-      merged = applySubscription(existing, input5.model);
+      merged = applySubscription(existing, input6.model);
       break;
     case "llmlite":
-      merged = applyLLMLite(existing, input5.apiKey, input5.baseUrl, input5.model);
+      merged = applyLLMLite(existing, input6.apiKey, input6.baseUrl, input6.model);
       break;
     case "use-global":
-      merged = applyUseGlobal(existing, input5.sourceSettings);
+      merged = applyUseGlobal(existing, input6.sourceSettings);
       break;
   }
   await writeJsonAtomic(path, merged, SECRET_FILE_MODE2);
@@ -843,47 +843,186 @@ function registerAiCommand(program2) {
   });
 }
 
-// src/lib/not-implemented-stub.ts
-function notImplementedYet(commandName, milestone) {
-  return () => {
-    process.stdout.write(
-      `${chalk.yellow("\u23F3")} ${chalk.bold(`avatar ${commandName}`)} \u2014 ch\u01B0a implement \u1EDF milestone hi\u1EC7n t\u1EA1i.
-`
+// src/commands/commit.ts
+import { input as input2 } from "@inquirer/prompts";
+
+// src/lib/execute-commit-with-target-selection.ts
+import { spawnSync as spawnSync5 } from "child_process";
+import { existsSync } from "fs";
+import { join as join6 } from "path";
+function assertAvatarWorkspaceRoot(cwd) {
+  const srcGit = join6(cwd, "src", ".git");
+  const workspaceGit = join6(cwd, ".git");
+  const claudeDir = join6(cwd, ".claude");
+  if (!existsSync(workspaceGit)) {
+    throw new Error(
+      `Kh\xF4ng ph\u1EA3i workspace root: ${cwd}
+  Ch\u1EA1y 'avatar commit' trong workspace dir (c\xF3 .git v\xE0 .claude/).`
     );
-    if (milestone) {
-      process.stdout.write(`   D\u1EF1 ki\u1EBFn: ${chalk.cyan(milestone)}
-`);
-    }
-    process.stdout.write("   Spec \u0111\xE3 c\xF3 trong avatar-cli-implementation_4.html.\n");
-    process.exit(0);
-  };
+  }
+  if (!existsSync(claudeDir)) {
+    throw new Error(
+      `Kh\xF4ng th\u1EA5y .claude/ trong ${cwd}.
+  Ch\u1EA1y 'avatar commit' trong Avatar workspace, kh\xF4ng ph\u1EA3i project b\xECnh th\u01B0\u1EDDng.`
+    );
+  }
+  if (!existsSync(srcGit)) {
+    throw new Error(
+      `Kh\xF4ng th\u1EA5y src/.git trong ${cwd}.
+  Workspace thi\u1EBFu submodule src/. Ch\u1EA1y 'avatar init' l\u1EA1i?`
+    );
+  }
+}
+function gitExec(cwd, args) {
+  const r = spawnSync5("git", ["-C", cwd, ...args], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (r.status !== 0) {
+    const stderr = (r.stderr || "").trim();
+    throw new Error(`git ${args.join(" ")} (in ${cwd}) failed:
+${stderr}`);
+  }
+  return (r.stdout || "").trim();
+}
+function isDirty(cwd) {
+  const status = gitExec(cwd, ["status", "--porcelain"]);
+  return status.length > 0;
+}
+async function commitSrc(workspaceRoot, opts) {
+  const srcPath = join6(workspaceRoot, "src");
+  if (!isDirty(srcPath)) {
+    log.dim("src/: nothing to commit (clean)");
+    return {};
+  }
+  log.info("Committing src/ ...");
+  gitExec(srcPath, ["add", "."]);
+  gitExec(srcPath, ["commit", "-m", opts.message]);
+  const sha = gitExec(srcPath, ["rev-parse", "HEAD"]);
+  log.success(`src/ committed: ${sha.slice(0, 7)}`);
+  let pushed = false;
+  if (opts.push) {
+    log.info("Pushing src/ ...");
+    gitExec(srcPath, ["push"]);
+    log.success("src/ pushed");
+    pushed = true;
+  }
+  return { sha, pushed };
+}
+async function commitWorkspace(workspaceRoot, opts) {
+  if (!isDirty(workspaceRoot)) {
+    log.dim("workspace: nothing to commit (clean)");
+    return {};
+  }
+  log.info("Committing workspace root ...");
+  gitExec(workspaceRoot, ["add", "."]);
+  gitExec(workspaceRoot, ["commit", "-m", opts.message]);
+  const sha = gitExec(workspaceRoot, ["rev-parse", "HEAD"]);
+  log.success(`workspace committed: ${sha.slice(0, 7)}`);
+  let pushed = false;
+  if (opts.push) {
+    log.info("Pushing workspace ...");
+    gitExec(workspaceRoot, ["push"]);
+    log.success("workspace pushed");
+    pushed = true;
+  }
+  return { sha, pushed };
+}
+function warnIfOtherTargetDirty(workspaceRoot, requestedTarget) {
+  if (requestedTarget === "all") return;
+  const srcDirty = isDirty(join6(workspaceRoot, "src"));
+  const workspaceDirty = isDirty(workspaceRoot);
+  if (requestedTarget === "src" && workspaceDirty) {
+    log.warn(
+      "Workspace c\u0169ng c\xF3 changes ch\u01B0a commit. Ch\u1EA1y 'avatar commit workspace' (ho\u1EB7c 'avatar commit all') \u0111\u1EC3 commit lu\xF4n."
+    );
+  }
+  if (requestedTarget === "workspace" && srcDirty) {
+    log.warn(
+      "src/ c\u0169ng c\xF3 changes ch\u01B0a commit. Ch\u1EA1y 'avatar commit src' (ho\u1EB7c 'avatar commit all') \u0111\u1EC3 commit lu\xF4n."
+    );
+  }
+}
+async function executeCommitWithTargetSelection(args) {
+  assertAvatarWorkspaceRoot(args.workspaceRoot);
+  warnIfOtherTargetDirty(args.workspaceRoot, args.target);
+  const result = { target: args.target, skipped: [] };
+  if (args.target === "src" || args.target === "all") {
+    const srcOutcome = await commitSrc(args.workspaceRoot, args.options);
+    result.srcCommitSha = srcOutcome.sha;
+    result.srcPushed = srcOutcome.pushed;
+    if (!srcOutcome.sha) result.skipped?.push("src");
+  }
+  if (args.target === "workspace" || args.target === "all") {
+    const wsOutcome = await commitWorkspace(args.workspaceRoot, args.options);
+    result.workspaceCommitSha = wsOutcome.sha;
+    result.workspacePushed = wsOutcome.pushed;
+    if (!wsOutcome.sha) result.skipped?.push("workspace");
+  }
+  return result;
 }
 
 // src/commands/commit.ts
 function registerCommitCommand(program2) {
-  program2.command("commit").description("Commit code kh\xE1ch (src/) ho\u1EB7c Avatar state ri\xEAng \u2014 ch\u1EC9 client mode (M07)").option("--src", "Commit src/ \u2192 client remote").option("--avatar", "Commit Avatar state \u2192 workspace remote").option("--both", "Commit c\u1EA3 hai (src tr\u01B0\u1EDBc, avatar sau)").option("-m, --message <msg>", "Commit message").option("--push", "T\u1EF1 \u0111\u1ED9ng push sau khi commit").action(notImplementedYet("commit", "Milestone 07"));
+  const commit = program2.command("commit").description("Commit code (src/) ho\u1EB7c Avatar state (workspace) \u2014 split-aware (M07)");
+  commit.command("src").description("Commit src/ \u2192 push l\xEAn client repo remote").option("-m, --message <msg>", "Commit message").option("--push", "Auto push sau commit (default: ch\u1EC9 commit)").action(async (opts) => {
+    await runCommit("src", opts);
+  });
+  commit.command("workspace").description("Commit workspace root \u2192 push l\xEAn team remote (Avatar state)").option("-m, --message <msg>", "Commit message").option("--push", "Auto push sau commit (default: ch\u1EC9 commit)").action(async (opts) => {
+    await runCommit("workspace", opts);
+  });
+  commit.command("all").description("Commit c\u1EA3 src/ v\xE0 workspace (src tr\u01B0\u1EDBc, gitlink update, workspace sau)").option("-m, --message <msg>", "Commit message").option("--push", "Auto push sau commit (default: ch\u1EC9 commit)").action(async (opts) => {
+    await runCommit("all", opts);
+  });
+}
+async function runCommit(target, opts) {
+  try {
+    const message = opts.message ?? await input2({
+      message: "Commit message:",
+      validate: (v) => v.trim().length > 0 ? true : "Message b\u1EAFt bu\u1ED9c"
+    });
+    const result = await executeCommitWithTargetSelection({
+      workspaceRoot: process.cwd(),
+      target,
+      options: { message, push: opts.push }
+    });
+    if (result.srcCommitSha) {
+      log.success(`src/: ${result.srcCommitSha.slice(0, 7)}${result.srcPushed ? " (pushed)" : ""}`);
+    }
+    if (result.workspaceCommitSha) {
+      log.success(
+        `workspace: ${result.workspaceCommitSha.slice(0, 7)}${result.workspacePushed ? " (pushed)" : ""}`
+      );
+    }
+    if (result.skipped && result.skipped.length > 0) {
+      log.dim(`Skipped (nothing to commit): ${result.skipped.join(", ")}`);
+    }
+  } catch (err) {
+    log.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
 }
 
 // src/commands/doctor.ts
-import { spawnSync as spawnSync5 } from "child_process";
+import { spawnSync as spawnSync6 } from "child_process";
 import { promises as fs6 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 import boxen from "boxen";
 
 // src/lib/git-operations.ts
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { simpleGit } from "simple-git";
 function git(cwd = process.cwd()) {
   return simpleGit({ baseDir: cwd, binary: "git" });
 }
 async function isGitRepo(cwd = process.cwd()) {
-  return await pathExists(join6(cwd, ".git"));
+  return await pathExists(join7(cwd, ".git"));
 }
 async function addSubmodule(repoUrl, destPath, cwd = process.cwd()) {
   await git(cwd).subModule(["add", repoUrl, destPath]);
 }
 async function checkoutTagInSubmodule(submodulePath, tag, cwd = process.cwd()) {
-  const submoduleCwd = join6(cwd, submodulePath);
+  const submoduleCwd = join7(cwd, submodulePath);
   await git(submoduleCwd).fetch(["--tags"]);
   await git(submoduleCwd).checkout(tag);
 }
@@ -902,11 +1041,11 @@ async function currentCommitSha(cwd = process.cwd()) {
 
 // src/lib/project-tree-scaffolder.ts
 import { promises as fs5 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 
 // src/lib/template-bundle-loader.ts
-import { existsSync } from "fs";
-import { dirname as dirname2, join as join7 } from "path";
+import { existsSync as existsSync2 } from "fs";
+import { dirname as dirname2, join as join8 } from "path";
 import { fileURLToPath } from "url";
 
 // src/lib/mustache-template-engine.ts
@@ -922,12 +1061,12 @@ function renderTemplate(source, variables) {
 // src/lib/template-bundle-loader.ts
 var HERE = dirname2(fileURLToPath(import.meta.url));
 var PACKAGE_ROOT = findPackageRoot(HERE);
-var TEMPLATES_ROOT = join7(PACKAGE_ROOT, "src", "templates");
-var HOOKS_ROOT = join7(PACKAGE_ROOT, "src", "hooks");
+var TEMPLATES_ROOT = join8(PACKAGE_ROOT, "src", "templates");
+var HOOKS_ROOT = join8(PACKAGE_ROOT, "src", "hooks");
 function findPackageRoot(startDir) {
   let dir = startDir;
   while (true) {
-    if (existsSync(join7(dir, "package.json"))) return dir;
+    if (existsSync2(join8(dir, "package.json"))) return dir;
     const parent = dirname2(dir);
     if (parent === dir) {
       throw new Error(`Cannot locate package root from ${startDir}`);
@@ -936,14 +1075,14 @@ function findPackageRoot(startDir) {
   }
 }
 async function loadTemplate(name) {
-  return await readText(join7(TEMPLATES_ROOT, `${name}.tpl`));
+  return await readText(join8(TEMPLATES_ROOT, `${name}.tpl`));
 }
 async function renderTemplateByName(name, variables) {
   const source = await loadTemplate(name);
   return renderTemplate(source, variables);
 }
 async function loadHook(name) {
-  return await readText(join7(HOOKS_ROOT, `${name}.sh.tpl`));
+  return await readText(join8(HOOKS_ROOT, `${name}.sh.tpl`));
 }
 
 // src/lib/project-tree-scaffolder.ts
@@ -977,12 +1116,12 @@ var PROJECT_KNOWLEDGE_TEMPLATES = [
   "project/gotchas.md"
 ];
 async function createClaudeDirTree(projectRoot) {
-  const claudeRoot = join8(projectRoot, ".claude");
+  const claudeRoot = join9(projectRoot, ".claude");
   await ensureDir(claudeRoot);
   for (const sub of CLAUDE_SUBDIRS) {
-    const dir = join8(claudeRoot, sub);
+    const dir = join9(claudeRoot, sub);
     await ensureDir(dir);
-    await writeTextAtomic(join8(dir, ".gitkeep"), "");
+    await writeTextAtomic(join9(dir, ".gitkeep"), "");
   }
 }
 async function writeProjectKnowledgeFiles(projectRoot, vars) {
@@ -1013,7 +1152,7 @@ async function writeProjectKnowledgeFiles(projectRoot, vars) {
   for (const tpl of PROJECT_KNOWLEDGE_TEMPLATES) {
     const content = await renderTemplateByName(tpl, baseVars);
     const relative4 = tpl.replace(/^project\//, "");
-    const outPath = join8(projectRoot, ".claude", "project", relative4);
+    const outPath = join9(projectRoot, ".claude", "project", relative4);
     const backup = await writeWithBackup(outPath, content);
     if (backup) backups.push(backup);
   }
@@ -1021,14 +1160,14 @@ async function writeProjectKnowledgeFiles(projectRoot, vars) {
 }
 async function writeRootClaudeMd(projectRoot, vars) {
   const content = await renderTemplateByName("CLAUDE.md", vars);
-  return await writeWithBackup(join8(projectRoot, "CLAUDE.md"), content);
+  return await writeWithBackup(join9(projectRoot, "CLAUDE.md"), content);
 }
 async function writeProjectSettings(projectRoot, vars) {
   const content = await renderTemplateByName("settings.json", vars);
-  return await writeWithBackup(join8(projectRoot, ".claude", "settings.json"), content);
+  return await writeWithBackup(join9(projectRoot, ".claude", "settings.json"), content);
 }
 async function appendGitignoreEntries(projectRoot) {
-  const path = join8(projectRoot, ".gitignore");
+  const path = join9(projectRoot, ".gitignore");
   const tpl = await renderTemplateByName("gitignore", {});
   const marker = "# Avatar \u2014 git-ignored entries injected on `avatar init`";
   let existing = "";
@@ -1042,9 +1181,9 @@ ${tpl}`);
 }
 async function installGitHook(gitDir, hookName) {
   const content = await loadHook(hookName);
-  const hooksDir = join8(gitDir, "hooks");
+  const hooksDir = join9(gitDir, "hooks");
   await ensureDir(hooksDir);
-  const dest = join8(hooksDir, hookName);
+  const dest = join9(hooksDir, hookName);
   await writeTextAtomic(dest, content, 493);
 }
 
@@ -1102,7 +1241,7 @@ async function runChecks(cwd) {
     detail: gitRepo ? cwd : "Kh\xF4ng ph\u1EA3i git repo (c\u1EA7n cho 'avatar init')",
     fixable: false
   });
-  const packPath = join9(cwd, ".claude", "pack");
+  const packPath = join10(cwd, ".claude", "pack");
   const hasPack = await pathExists(packPath);
   checks.push({
     name: "team-ai-pack submodule",
@@ -1110,7 +1249,7 @@ async function runChecks(cwd) {
     detail: hasPack ? packPath : "Avatar ch\u01B0a init \u2014 ch\u1EA1y 'avatar init'",
     fixable: false
   });
-  const claudeMdPath = join9(cwd, "CLAUDE.md");
+  const claudeMdPath = join10(cwd, "CLAUDE.md");
   const hasClaudeMd = await pathExists(claudeMdPath);
   checks.push({
     name: "CLAUDE.md",
@@ -1118,7 +1257,7 @@ async function runChecks(cwd) {
     detail: hasClaudeMd ? "t\u1ED3n t\u1EA1i \u1EDF project root" : "thi\u1EBFu \u2014 ch\u1EA1y 'avatar init'",
     fixable: false
   });
-  const hookPath = join9(cwd, ".git", "hooks", "post-merge");
+  const hookPath = join10(cwd, ".git", "hooks", "post-merge");
   const hasHook = await pathExists(hookPath);
   if (gitRepo && hasPack) {
     checks.push({
@@ -1127,11 +1266,11 @@ async function runChecks(cwd) {
       detail: hasHook ? "installed" : "missing \u2014 fixable",
       fixable: !hasHook,
       fix: hasHook ? void 0 : async () => {
-        await installGitHook(join9(cwd, ".git"), "post-merge");
+        await installGitHook(join10(cwd, ".git"), "post-merge");
       }
     });
   }
-  const gitignorePath = join9(cwd, ".gitignore");
+  const gitignorePath = join10(cwd, ".gitignore");
   if (gitRepo) {
     let gitignoreOk = false;
     if (await pathExists(gitignorePath)) {
@@ -1145,7 +1284,7 @@ async function runChecks(cwd) {
       fixable: false
     });
   }
-  const which = spawnSync5("which", ["claude"]);
+  const which = spawnSync6("which", ["claude"]);
   const hasClaudeCli = which.status === 0;
   checks.push({
     name: "Claude Code CLI",
@@ -1193,12 +1332,16 @@ async function applyFixes(checks) {
 }
 
 // src/commands/init.ts
-import { basename, join as join16, relative as relative2, resolve } from "path";
-import { confirm as confirm3, input as input4, select as select7 } from "@inquirer/prompts";
+import { basename, join as join17, relative as relative2, resolve } from "path";
+import { confirm as confirm3, input as input5, select as select8 } from "@inquirer/prompts";
 import boxen4 from "boxen";
 
+// src/lib/add-team-pack-submodule-with-retry-on-network-fail.ts
+import { spawnSync as spawnSync8 } from "child_process";
+import { select as select5 } from "@inquirer/prompts";
+
 // src/lib/prompt-recovery-action-on-failure.ts
-import { input as input2, select as select3 } from "@inquirer/prompts";
+import { input as input3, select as select3 } from "@inquirer/prompts";
 var UserAbortedRecoveryError = class extends Error {
   constructor(message) {
     super(message);
@@ -1222,10 +1365,10 @@ async function promptRetryOrSkip(args) {
 }
 
 // src/lib/team-pack-submodule-manager.ts
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 
 // src/lib/check-team-pack-access-with-retry-loop.ts
-import { spawnSync as spawnSync6 } from "child_process";
+import { spawnSync as spawnSync7 } from "child_process";
 import { confirm as confirm2, select as select4 } from "@inquirer/prompts";
 import boxen2 from "boxen";
 function parseRepoSlugFromGitUrl(url) {
@@ -1234,11 +1377,11 @@ function parseRepoSlugFromGitUrl(url) {
   return null;
 }
 function checkRepoAccess(repoSlug) {
-  const r = spawnSync6("gh", ["api", `repos/${repoSlug}`], { stdio: "ignore" });
+  const r = spawnSync7("gh", ["api", `repos/${repoSlug}`], { stdio: "ignore" });
   return r.status === 0;
 }
 function getCurrentGhUser() {
-  const r = spawnSync6("gh", ["api", "user", "--jq", ".login"], {
+  const r = spawnSync7("gh", ["api", "user", "--jq", ".login"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -1247,7 +1390,7 @@ function getCurrentGhUser() {
 }
 function triggerGhAuthLoginInteractive() {
   log.info("M\u1EDF browser \u0111\u1EC3 switch GitHub account...");
-  const r = spawnSync6("gh", ["auth", "login", "--web"], { stdio: "inherit" });
+  const r = spawnSync7("gh", ["auth", "login", "--web"], { stdio: "inherit" });
   if (r.status !== 0) {
     log.warn(`gh auth login exit ${r.status}. C\xF3 th\u1EC3 ch\u1EA1y tay r\u1ED3i quay l\u1EA1i retry.`);
   }
@@ -1387,7 +1530,7 @@ async function addTeamPackSubmodule(projectRoot, tag, ssoEmail) {
   }
   let target = tag ?? null;
   if (!target) {
-    target = await latestTag(join10(projectRoot, TEAM_PACK_RELATIVE_PATH));
+    target = await latestTag(join11(projectRoot, TEAM_PACK_RELATIVE_PATH));
   }
   if (target) {
     await checkoutTagInSubmodule(TEAM_PACK_RELATIVE_PATH, target, projectRoot);
@@ -1395,7 +1538,7 @@ async function addTeamPackSubmodule(projectRoot, tag, ssoEmail) {
   return { pinnedTag: target };
 }
 async function readPinnedPackVersion(projectRoot) {
-  const submoduleRoot = join10(projectRoot, TEAM_PACK_RELATIVE_PATH);
+  const submoduleRoot = join11(projectRoot, TEAM_PACK_RELATIVE_PATH);
   const tag = await latestTag(submoduleRoot);
   if (tag) return tag;
   const sha = await currentCommitSha(submoduleRoot);
@@ -1403,6 +1546,51 @@ async function readPinnedPackVersion(projectRoot) {
 }
 
 // src/lib/add-team-pack-submodule-with-retry-on-network-fail.ts
+function isSshPermissionError(message) {
+  const text = message.toLowerCase();
+  return text.includes("permission denied (publickey)") || text.includes("publickey)") || text.includes("ssh: could not resolve") || text.includes("host key verification failed");
+}
+function triggerGhAuthLoginInteractive2() {
+  log.info("M\u1EDF browser \u0111\u1EC3 switch GitHub account...");
+  const r = spawnSync8("gh", ["auth", "login", "--web"], { stdio: "inherit" });
+  if (r.status !== 0) {
+    log.warn(`gh auth login exit ${r.status}. C\xF3 th\u1EC3 ch\u1EA1y tay r\u1ED3i quay l\u1EA1i retry.`);
+  }
+}
+function openGithubSshKeysPage() {
+  log.info("M\u1EDF trang GitHub Settings \u2192 SSH Keys...");
+  const r = spawnSync8("open", ["https://github.com/settings/keys"], { stdio: "ignore" });
+  if (r.status !== 0) {
+    log.info("URL: https://github.com/settings/keys");
+  }
+}
+async function handleSshPermissionError() {
+  return await select5({
+    message: "SSH permission denied. C\xE1ch x\u1EED l\xFD?",
+    choices: [
+      {
+        name: "Switch GitHub account (gh auth login \u2014 m\u1EDF browser)",
+        value: "switch"
+      },
+      {
+        name: "D\xF9ng HTTPS thay SSH (override URL b\u1EB1ng env AVATAR_TEAM_PACK_REPO_URL)",
+        value: "https"
+      },
+      {
+        name: "T\xF4i v\u1EEBa add SSH key l\xEAn GitHub \u2014 retry",
+        value: "retry"
+      },
+      {
+        name: "B\u1ECF qua team-ai-pack (d\xF9ng avatar sync sau)",
+        value: "skip"
+      },
+      {
+        name: "T\u1EA1m ng\u01B0ng init \u2014 fix SSH key tay r\u1ED3i ch\u1EA1y l\u1EA1i",
+        value: "abort"
+      }
+    ]
+  });
+}
 async function addTeamPackSubmoduleWithRetryOnNetworkFail(projectRoot, tag, ssoEmail) {
   while (true) {
     try {
@@ -1410,9 +1598,39 @@ async function addTeamPackSubmoduleWithRetryOnNetworkFail(projectRoot, tag, ssoE
       return { pinnedTag: result.pinnedTag, skipped: false };
     } catch (err) {
       if (err instanceof TeamPackAccessAbortedError) throw err;
+      const message = err instanceof Error ? err.message : String(err);
+      if (isSshPermissionError(message)) {
+        log.warn("Pull team-ai-pack th\u1EA5t b\u1EA1i: SSH permission denied (publickey).");
+        log.dim(
+          "  \u2192 M\xE1y n\xE0y ch\u01B0a c\xF3 SSH key \u0111\u01B0\u1EE3c register tr\xEAn GitHub, ho\u1EB7c key thu\u1ED9c account kh\xE1c."
+        );
+        const action2 = await handleSshPermissionError();
+        if (action2 === "abort") {
+          throw new UserAbortedRecoveryError(
+            "User abort t\u1EA1i b\u01B0\u1EDBc pull team-ai-pack. Fix SSH key (https://github.com/settings/keys) r\u1ED3i ch\u1EA1y l\u1EA1i 'avatar init'."
+          );
+        }
+        if (action2 === "skip") {
+          log.warn(
+            "Skip team-ai-pack. Workspace d\xF9ng \u0111\u01B0\u1EE3c nh\u01B0ng kh\xF4ng c\xF3 shared knowledge. Pull sau qua `avatar sync`."
+          );
+          return { pinnedTag: null, skipped: true };
+        }
+        if (action2 === "switch") {
+          triggerGhAuthLoginInteractive2();
+          continue;
+        }
+        if (action2 === "https") {
+          process.env.AVATAR_TEAM_PACK_REPO_URL = "https://github.com/nalvn/team-ai-pack.git";
+          log.info("Override URL sang HTTPS. L\u01B0u \xFD: HTTPS c\xF3 th\u1EC3 fail 403 n\u1EBFu read-only role.");
+          openGithubSshKeysPage();
+          continue;
+        }
+        continue;
+      }
       const action = await promptRetryOrSkip({
         taskName: "Pull team-ai-pack submodule",
-        reason: err instanceof Error ? err.message : String(err),
+        reason: message,
         allowSkip: true,
         hint: "Network glitch? Retry th\u01B0\u1EDDng work. N\u1EBFu skip, d\xF9ng `avatar sync` sau \u0111\u1EC3 pull pack."
       });
@@ -1491,27 +1709,27 @@ ${renderAvatarBanner(opts)}
 }
 
 // src/lib/execute-gh-repo-create.ts
-import { spawnSync as spawnSync7 } from "child_process";
+import { spawnSync as spawnSync9 } from "child_process";
 var RepoAlreadyExistsError = class extends Error {
   constructor(fullName) {
     super(`Repo "${fullName}" \u0111\xE3 t\u1ED3n t\u1EA1i tr\xEAn GitHub. \u0110\u1ED5i t\xEAn ho\u1EB7c x\xF3a repo c\u0169.`);
     this.name = "RepoAlreadyExistsError";
   }
 };
-function executeGhRepoCreate(input5) {
-  const fullName = `${input5.org}/${input5.name}`;
+function executeGhRepoCreate(input6) {
+  const fullName = `${input6.org}/${input6.name}`;
   const args = [
     "repo",
     "create",
     fullName,
-    `--${input5.visibility}`,
+    `--${input6.visibility}`,
     "--source",
-    input5.folder,
+    input6.folder,
     "--remote",
     "origin",
     "--push"
   ];
-  const r = spawnSync7("gh", args, { stdio: "inherit" });
+  const r = spawnSync9("gh", args, { stdio: "inherit" });
   if (r.status !== 0) {
     if (r.status === 1) {
       throw new RepoAlreadyExistsError(fullName);
@@ -1525,9 +1743,9 @@ function executeGhRepoCreate(input5) {
 }
 
 // src/lib/resolve-github-username-default.ts
-import { spawnSync as spawnSync8 } from "child_process";
+import { spawnSync as spawnSync10 } from "child_process";
 function resolveGithubUsernameDefault() {
-  const r = spawnSync8("gh", ["api", "user", "--jq", ".login"], {
+  const r = spawnSync10("gh", ["api", "user", "--jq", ".login"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -1559,28 +1777,28 @@ function validateRepoVisibility(v) {
 }
 
 // src/lib/create-github-remote-from-folder.ts
-function createGithubRemoteFromFolder(input5) {
-  validateRepoName(input5.name);
-  validateRepoVisibility(input5.visibility);
-  const org = input5.org ?? resolveGithubUsernameDefault();
-  log.info(`T\u1EA1o GitHub repo ${org}/${input5.name} (${input5.visibility})...`);
+function createGithubRemoteFromFolder(input6) {
+  validateRepoName(input6.name);
+  validateRepoVisibility(input6.visibility);
+  const org = input6.org ?? resolveGithubUsernameDefault();
+  log.info(`T\u1EA1o GitHub repo ${org}/${input6.name} (${input6.visibility})...`);
   const urls = executeGhRepoCreate({
-    folder: input5.folder,
+    folder: input6.folder,
     org,
-    name: input5.name,
-    visibility: input5.visibility
+    name: input6.name,
+    visibility: input6.visibility
   });
   log.success(`\u0110\xE3 t\u1EA1o: ${urls.sshUrl}`);
   return urls;
 }
 
 // src/lib/create-workspace-remote-via-gh.ts
-import { spawnSync as spawnSync16 } from "child_process";
+import { spawnSync as spawnSync18 } from "child_process";
 
 // src/lib/check-gh-cli-auth-status.ts
-import { spawnSync as spawnSync9 } from "child_process";
+import { spawnSync as spawnSync11 } from "child_process";
 function checkGhCliAuthStatus() {
-  const r = spawnSync9("gh", ["auth", "status"], { stdio: "ignore" });
+  const r = spawnSync11("gh", ["auth", "status"], { stdio: "ignore" });
   if (r.error && r.error.code === "ENOENT") {
     return "not-installed";
   }
@@ -1588,12 +1806,12 @@ function checkGhCliAuthStatus() {
 }
 
 // src/lib/detect-package-manager.ts
-import { spawnSync as spawnSync10 } from "child_process";
+import { spawnSync as spawnSync12 } from "child_process";
 function hasBinary(name) {
   const platform2 = detectHostPlatform();
   const probe = platform2 === "win32" ? "where" : "command";
   const args = platform2 === "win32" ? [name] : ["-v", name];
-  const r = spawnSync10(probe, args, {
+  const r = spawnSync12(probe, args, {
     shell: platform2 !== "win32",
     stdio: "ignore"
   });
@@ -1609,11 +1827,11 @@ function detectPackageManager() {
 }
 
 // src/lib/handle-remote-access-failure-with-account-switch.ts
-import { spawnSync as spawnSync12 } from "child_process";
-import { input as input3, select as select5 } from "@inquirer/prompts";
+import { spawnSync as spawnSync14 } from "child_process";
+import { input as input4, select as select6 } from "@inquirer/prompts";
 
 // src/lib/verify-git-remote-accessible.ts
-import { spawnSync as spawnSync11 } from "child_process";
+import { spawnSync as spawnSync13 } from "child_process";
 var TIMEOUT_MS = 5e3;
 function classifyRemoteError(stderr) {
   const text = stderr.toLowerCase();
@@ -1629,7 +1847,7 @@ function classifyRemoteError(stderr) {
   return "unknown";
 }
 function tryVerifyGitRemoteAccessible(url) {
-  const r = spawnSync11("git", ["ls-remote", "--exit-code", url, "HEAD"], {
+  const r = spawnSync13("git", ["ls-remote", "--exit-code", url, "HEAD"], {
     encoding: "utf8",
     timeout: TIMEOUT_MS,
     stdio: ["ignore", "pipe", "pipe"]
@@ -1651,16 +1869,16 @@ var RemoteAccessAbortedError = class extends Error {
   }
 };
 function getCurrentGhUser2() {
-  const r = spawnSync12("gh", ["api", "user", "--jq", ".login"], {
+  const r = spawnSync14("gh", ["api", "user", "--jq", ".login"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
   if (r.status !== 0) return null;
   return r.stdout.trim() || null;
 }
-function triggerGhAuthLoginInteractive2() {
+function triggerGhAuthLoginInteractive3() {
   log.info("M\u1EDF browser \u0111\u1EC3 switch GitHub account...");
-  const r = spawnSync12("gh", ["auth", "login", "--web"], { stdio: "inherit" });
+  const r = spawnSync14("gh", ["auth", "login", "--web"], { stdio: "inherit" });
   if (r.status !== 0) {
     log.warn(`gh auth login exit ${r.status}. B\u1EA1n c\xF3 th\u1EC3 ch\u1EA1y tay r\u1ED3i quay l\u1EA1i retry.`);
   }
@@ -1694,7 +1912,7 @@ async function handleRemoteAccessFailureWithAccountSwitch(args) {
     log.dim(`  L\xFD do: ${reason}${detail ? ` \u2014 ${detail.slice(0, 150)}` : ""}`);
     log.info(getReasonHint(reason, currentUrl, ghUser));
     if (ghUser) log.dim(`  gh CLI hi\u1EC7n \u0111ang login: ${ghUser}`);
-    const action = await select5({
+    const action = await select6({
       message: "C\xE1ch x\u1EED l\xFD?",
       choices: [
         {
@@ -1721,7 +1939,7 @@ async function handleRemoteAccessFailureWithAccountSwitch(args) {
       );
     }
     if (action === "re-input-url") {
-      const newUrl = await input3({
+      const newUrl = await input4({
         message: "URL git remote (https://github.com/owner/repo.git ho\u1EB7c git@github.com:owner/repo.git):",
         default: currentUrl,
         validate: (v) => isValidGitUrl(v) || "URL kh\xF4ng \u0111\xFAng format git remote"
@@ -1729,7 +1947,7 @@ async function handleRemoteAccessFailureWithAccountSwitch(args) {
       currentUrl = newUrl.trim();
     }
     if (action === "switch") {
-      triggerGhAuthLoginInteractive2();
+      triggerGhAuthLoginInteractive3();
     }
     log.info(`Verify remote l\u1EA1i: ${currentUrl}...`);
     const result = tryVerifyGitRemoteAccessible(currentUrl);
@@ -1743,7 +1961,7 @@ async function handleRemoteAccessFailureWithAccountSwitch(args) {
 }
 
 // src/lib/install-gh-cli-via-package-manager.ts
-import { spawnSync as spawnSync13 } from "child_process";
+import { spawnSync as spawnSync15 } from "child_process";
 var INSTALL_COMMANDS = {
   brew: { cmd: "brew", args: ["install", "gh"] },
   apt: { cmd: "sudo", args: ["apt-get", "install", "-y", "gh"] },
@@ -1754,7 +1972,7 @@ var INSTALL_COMMANDS = {
 function installGhCliViaPackageManager(pm) {
   const spec = INSTALL_COMMANDS[pm];
   log.info(`\u0110ang c\xE0i gh CLI qua ${pm}...`);
-  const r = spawnSync13(spec.cmd, spec.args, { stdio: "inherit" });
+  const r = spawnSync15(spec.cmd, spec.args, { stdio: "inherit" });
   if (r.status !== 0) {
     throw new Error(`C\xE0i gh CLI th\u1EA5t b\u1EA1i qua ${pm} (exit ${r.status}). C\xE0i tay r\u1ED3i ch\u1EA1y l\u1EA1i.`);
   }
@@ -1762,9 +1980,9 @@ function installGhCliViaPackageManager(pm) {
 }
 
 // src/lib/setup-git-credential-via-gh.ts
-import { spawnSync as spawnSync14 } from "child_process";
+import { spawnSync as spawnSync16 } from "child_process";
 function setupGitCredentialViaGh() {
-  const r = spawnSync14("gh", ["auth", "setup-git"], { stdio: "ignore" });
+  const r = spawnSync16("gh", ["auth", "setup-git"], { stdio: "ignore" });
   if (r.status !== 0) {
     log.warn("gh auth setup-git fail (non-fatal). N\u1EBFu git clone l\u1ED7i 128 \u2192 ch\u1EA1y th\u1EE7 c\xF4ng.");
     return;
@@ -1773,10 +1991,10 @@ function setupGitCredentialViaGh() {
 }
 
 // src/lib/trigger-gh-cli-auth-login.ts
-import { spawnSync as spawnSync15 } from "child_process";
+import { spawnSync as spawnSync17 } from "child_process";
 function triggerGhCliAuthLogin() {
   log.info("Kh\u1EDFi \u0111\u1ED9ng \u0111\u0103ng nh\u1EADp GitHub qua gh CLI (browser s\u1EBD m\u1EDF)...");
-  const r = spawnSync15(
+  const r = spawnSync17(
     "gh",
     ["auth", "login", "--hostname", "github.com", "--web", "--git-protocol", "ssh"],
     { stdio: "inherit" }
@@ -1894,20 +2112,20 @@ function classifyGhCreateError(stderr) {
   return "unknown";
 }
 function repoExistsOnGitHub(fullName) {
-  const r = spawnSync16("gh", ["repo", "view", fullName, "--json", "name"], {
+  const r = spawnSync18("gh", ["repo", "view", fullName, "--json", "name"], {
     stdio: "ignore"
   });
   return r.status === 0;
 }
 function canCreateInNamespace(org, ghUser) {
   if (org.toLowerCase() === ghUser.toLowerCase()) return { ok: true };
-  const r = spawnSync16("gh", ["api", `orgs/${org}/members/${ghUser}`, "--silent"], {
+  const r = spawnSync18("gh", ["api", `orgs/${org}/members/${ghUser}`, "--silent"], {
     stdio: "ignore"
   });
   if (r.status === 0) return { ok: true };
-  const orgCheck = spawnSync16("gh", ["api", `orgs/${org}`, "--silent"], { stdio: "ignore" });
+  const orgCheck = spawnSync18("gh", ["api", `orgs/${org}`, "--silent"], { stdio: "ignore" });
   if (orgCheck.status !== 0) {
-    const userCheck = spawnSync16("gh", ["api", `users/${org}`, "--silent"], { stdio: "ignore" });
+    const userCheck = spawnSync18("gh", ["api", `users/${org}`, "--silent"], { stdio: "ignore" });
     if (userCheck.status === 0) {
       return {
         ok: false,
@@ -1924,17 +2142,17 @@ function canCreateInNamespace(org, ghUser) {
     reason: `'${ghUser}' kh\xF4ng ph\u1EA3i member c\u1EE7a org '${org}'. Li\xEAn h\u1EC7 admin org \u0111\u1EC3 \u0111\u01B0\u1EE3c invite, ho\u1EB7c pass --repo-org=${ghUser} t\u1EA1o d\u01B0\u1EDBi personal account.`
   };
 }
-async function createWorkspaceRemoteViaGh(input5) {
-  validateRepoName(input5.workspaceName);
-  validateRepoVisibility(input5.visibility);
+async function createWorkspaceRemoteViaGh(input6) {
+  validateRepoName(input6.workspaceName);
+  validateRepoVisibility(input6.visibility);
   await ensureGitHubReady();
   const ghUser = resolveGithubUsernameDefault();
-  const org = input5.org ?? ghUser;
+  const org = input6.org ?? ghUser;
   const namespaceCheck = canCreateInNamespace(org, ghUser);
   if (!namespaceCheck.ok) {
     throw new Error(`Kh\xF4ng th\u1EC3 t\u1EA1o repo d\u01B0\u1EDBi '${org}/': ${namespaceCheck.reason}`);
   }
-  const fullName = `${org}/${input5.workspaceName}`;
+  const fullName = `${org}/${input6.workspaceName}`;
   if (repoExistsOnGitHub(fullName)) {
     throw new CreateWorkspaceRemoteError(
       "repo-exists",
@@ -1942,16 +2160,16 @@ async function createWorkspaceRemoteViaGh(input5) {
       `Repo '${fullName}' \u0111\xE3 t\u1ED3n t\u1EA1i tr\xEAn GitHub. C\xF3 th\u1EC3 b\u1EA1n \u0111\xE3 init workspace n\xE0y tr\u01B0\u1EDBc \u0111\xF3.`
     );
   }
-  log.info(`T\u1EA1o GitHub repo cho workspace: ${fullName} (${input5.visibility})...`);
-  const r = spawnSync16(
+  log.info(`T\u1EA1o GitHub repo cho workspace: ${fullName} (${input6.visibility})...`);
+  const r = spawnSync18(
     "gh",
     [
       "repo",
       "create",
       fullName,
-      `--${input5.visibility}`,
+      `--${input6.visibility}`,
       "--source",
-      input5.workspacePath,
+      input6.workspacePath,
       "--remote",
       "origin",
       "--push"
@@ -1984,7 +2202,7 @@ ${combined}
 function linkExistingRemoteToWorkspace(args) {
   const sshUrl = `git@github.com:${args.fullName}.git`;
   const httpsUrl = `https://github.com/${args.fullName}.git`;
-  const addResult = spawnSync16(
+  const addResult = spawnSync18(
     "git",
     ["-C", args.workspacePath, "remote", "add", "origin", sshUrl],
     {
@@ -1993,7 +2211,7 @@ function linkExistingRemoteToWorkspace(args) {
     }
   );
   if (addResult.status !== 0) {
-    spawnSync16("git", ["-C", args.workspacePath, "remote", "set-url", "origin", sshUrl], {
+    spawnSync18("git", ["-C", args.workspacePath, "remote", "set-url", "origin", sshUrl], {
       stdio: "ignore"
     });
   }
@@ -2003,15 +2221,15 @@ function linkExistingRemoteToWorkspace(args) {
 
 // src/lib/safe-bootstrap-for-dirty-folder.ts
 import { readdirSync } from "fs";
-import { select as select6 } from "@inquirer/prompts";
+import { select as select7 } from "@inquirer/prompts";
 import { simpleGit as simpleGit3 } from "simple-git";
 
 // src/lib/check-folder-has-git.ts
-import { existsSync as existsSync2, statSync } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync3, statSync } from "fs";
+import { join as join12 } from "path";
 function checkFolderHasGit(folderPath) {
-  const gitPath = join11(folderPath, ".git");
-  if (!existsSync2(gitPath)) return false;
+  const gitPath = join12(folderPath, ".git");
+  if (!existsSync3(gitPath)) return false;
   const stat = statSync(gitPath);
   return stat.isDirectory() || stat.isFile();
 }
@@ -2041,8 +2259,8 @@ async function createInitialGitCommit(folderPath) {
 }
 
 // src/lib/detect-folder-tech-stack.ts
-import { existsSync as existsSync3 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { join as join13 } from "path";
 var SIGNATURES = {
   node: ["package.json"],
   python: ["pyproject.toml", "requirements.txt", "setup.py", "Pipfile"],
@@ -2054,7 +2272,7 @@ var SIGNATURES = {
 function detectFolderTechStack(folderPath) {
   const matched = [];
   for (const [stack, files] of Object.entries(SIGNATURES)) {
-    if (files.some((f) => existsSync3(join12(folderPath, f)))) {
+    if (files.some((f) => existsSync4(join13(folderPath, f)))) {
       matched.push(stack);
     }
   }
@@ -2063,25 +2281,25 @@ function detectFolderTechStack(folderPath) {
 
 // src/lib/gitignore-template-loader.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname3, join as join13 } from "path";
+import { dirname as dirname3, join as join14 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var __dirname = dirname3(fileURLToPath2(import.meta.url));
 var CANDIDATE_DIRS = [
   // Bundled production: dist/index.js → __dirname = .../dist/, sibling dist/templates
-  join13(__dirname, "templates", "gitignore"),
+  join14(__dirname, "templates", "gitignore"),
   // Legacy bundled: nếu file là dist/lib/*.js (sub-bundle), templates ở dist/templates
-  join13(__dirname, "..", "templates", "gitignore"),
+  join14(__dirname, "..", "templates", "gitignore"),
   // Dev mode (vitest/tsx run src/ trực tiếp): __dirname = src/lib/
-  join13(__dirname, "..", "..", "src", "templates", "gitignore"),
+  join14(__dirname, "..", "..", "src", "templates", "gitignore"),
   // npm-installed alt: __dirname = .../dist/ → package_root/src/templates
-  join13(__dirname, "..", "src", "templates", "gitignore")
+  join14(__dirname, "..", "src", "templates", "gitignore")
 ];
 var AVATAR_MARKER_START = "# === avatar ===";
 var AVATAR_MARKER_END = "# === /avatar ===";
 function readTemplate(stack) {
   for (const dir of CANDIDATE_DIRS) {
     try {
-      return readFileSync2(join13(dir, `${stack}.txt`), "utf8");
+      return readFileSync2(join14(dir, `${stack}.txt`), "utf8");
     } catch {
     }
   }
@@ -2095,11 +2313,11 @@ ${readTemplate(s).trim()}`);
 }
 
 // src/lib/write-or-merge-gitignore.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync } from "fs";
+import { join as join15 } from "path";
 function writeOrMergeGitignore(folderPath, avatarBlock) {
-  const path = join14(folderPath, ".gitignore");
-  if (!existsSync4(path)) {
+  const path = join15(folderPath, ".gitignore");
+  if (!existsSync5(path)) {
     writeFileSync(path, avatarBlock, "utf8");
     return;
   }
@@ -2140,7 +2358,7 @@ async function promptBootstrapStrategy(state, opts) {
   if (opts.presetStrategy) return opts.presetStrategy;
   if (opts.autoYes) return "stash";
   if (state === "empty" || state === "clean") return "commit-all";
-  return await select6({
+  return await select7({
     message: state === "dirty" ? "Folder c\xF3 changes ch\u01B0a commit. C\xE1ch x\u1EED l\xFD:" : "Folder c\xF3 file ch\u01B0a version. C\xE1ch x\u1EED l\xFD:",
     choices: [
       {
@@ -2275,7 +2493,7 @@ async function safeBootstrapGitInFolder(folderPath, opts = {}) {
 
 // src/commands/init-conflict-detection-helpers.ts
 import { readdir } from "fs/promises";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 async function isEmptyOrMissing(path) {
   if (!await pathExists(path)) return true;
   try {
@@ -2288,7 +2506,7 @@ async function isEmptyOrMissing(path) {
 }
 async function findAlternativeWorkspaceName(parent, desiredName, maxAttempts = 10) {
   for (let i = 2; i < maxAttempts; i++) {
-    const candidate = join15(parent, `${desiredName}-${i}`);
+    const candidate = join16(parent, `${desiredName}-${i}`);
     if (await isEmptyOrMissing(candidate)) return candidate;
   }
   return null;
@@ -2589,7 +2807,7 @@ async function runInit(opts) {
   }
 }
 async function promptProjectStatus() {
-  return await select7({
+  return await select8({
     message: "T\xECnh tr\u1EA1ng d\u1EF1 \xE1n c\u1EE7a b\u1EA1n?",
     choices: [
       { name: "1. \u0110\xE3 c\xF3 repo git remote (URL c\xF3 s\u1EB5n)", value: "existing-remote" },
@@ -2599,7 +2817,7 @@ async function promptProjectStatus() {
   });
 }
 async function runInitFromExistingRemote(opts, ownerEmail) {
-  const initialRemoteUrl = opts.clientRepo ?? await input4({
+  const initialRemoteUrl = opts.clientRepo ?? await input5({
     message: "URL git c\u1EE7a repo:",
     validate: (v) => v.length > 0 ? true : "URL b\u1EAFt bu\u1ED9c"
   });
@@ -2607,7 +2825,7 @@ async function runInitFromExistingRemote(opts, ownerEmail) {
   const remoteUrl = resolvedRemoteUrl ?? initialRemoteUrl;
   const teamOwner = opts.teamOwner ?? await promptTeamOwner(ownerEmail);
   const inferredName = inferWorkspaceName(remoteUrl);
-  const workspaceName = opts.workspaceName ?? await input4({ message: "T\xEAn workspace:", default: inferredName });
+  const workspaceName = opts.workspaceName ?? await input5({ message: "T\xEAn workspace:", default: inferredName });
   const workspaceParent = resolve(opts.workspaceParent ?? ".");
   const workspacePath = await resolveWorkspacePath(workspaceParent, workspaceName, opts.force);
   await scaffoldWorkspaceWithSrcSubmodule({
@@ -2630,7 +2848,7 @@ async function runInitFromExistingRemote(opts, ownerEmail) {
 }
 async function runInitFromExistingFolder(opts, ownerEmail) {
   const folderPath = resolve(
-    opts.folderPath ?? await input4({
+    opts.folderPath ?? await input5({
       message: "\u0110\u01B0\u1EDDng d\u1EABn folder hi\u1EC7n c\xF3:",
       validate: (v) => v.length > 0 ? true : "Path b\u1EAFt bu\u1ED9c"
     })
@@ -2642,7 +2860,7 @@ async function runInitFromExistingFolder(opts, ownerEmail) {
   const remoteUrl = await getOrCreateOriginRemote(folderPath, opts);
   const teamOwner = opts.teamOwner ?? await promptTeamOwner(ownerEmail);
   const inferredName = opts.workspaceName ?? `${basename(folderPath)}-avatar-workspace`;
-  const workspaceName = opts.workspaceName ?? await input4({ message: "T\xEAn workspace:", default: inferredName });
+  const workspaceName = opts.workspaceName ?? await input5({ message: "T\xEAn workspace:", default: inferredName });
   const workspaceParent = resolve(opts.workspaceParent ?? ".");
   const workspacePath = await resolveWorkspacePath(workspaceParent, workspaceName, opts.force);
   await scaffoldWorkspaceWithSrcSubmodule({
@@ -2666,11 +2884,11 @@ async function runInitFromExistingFolder(opts, ownerEmail) {
 }
 async function runInitFromScratch(opts, ownerEmail) {
   await ensureGitHubReady();
-  const projectName = opts.workspaceName ?? await input4({
+  const projectName = opts.workspaceName ?? await input5({
     message: "T\xEAn d\u1EF1 \xE1n:",
     validate: (v) => v.length > 0 ? true : "T\xEAn b\u1EAFt bu\u1ED9c"
   });
-  const visibility = opts.repoVisibility ?? await select7({
+  const visibility = opts.repoVisibility ?? await select8({
     message: "Visibility?",
     choices: [
       { name: "private (m\u1EB7c \u0111\u1ECBnh)", value: "private" },
@@ -2680,7 +2898,7 @@ async function runInitFromScratch(opts, ownerEmail) {
   const teamOwner = opts.teamOwner ?? await promptTeamOwner(ownerEmail);
   const workspaceParent = resolve(opts.workspaceParent ?? ".");
   const workspacePath = await resolveWorkspacePath(workspaceParent, projectName, opts.force);
-  const srcPath = join16(workspacePath, "src");
+  const srcPath = join17(workspacePath, "src");
   await ensureDir(workspacePath);
   await ensureDir(srcPath);
   await safeBootstrapGitInFolder(srcPath, { autoYes: true });
@@ -2744,14 +2962,14 @@ async function getOrCreateOriginRemote(folderPath, opts) {
     return void 0;
   }
   await ensureGitHubReady();
-  const visibility = opts.repoVisibility ?? await select7({
+  const visibility = opts.repoVisibility ?? await select8({
     message: "Visibility?",
     choices: [
       { name: "private (m\u1EB7c \u0111\u1ECBnh)", value: "private" },
       { name: "public", value: "public" }
     ]
   });
-  const repoName = await input4({
+  const repoName = await input5({
     message: "T\xEAn repo:",
     default: basename(folderPath)
   });
@@ -2816,10 +3034,10 @@ async function finalizeWorkspaceScaffold(args) {
   await writeRootClaudeMd(args.workspacePath, vars);
   await writeProjectSettings(args.workspacePath, vars);
   await appendGitignoreEntries(args.workspacePath);
-  await ensureDir(join16(args.workspacePath, "notes"));
-  await ensureDir(join16(args.workspacePath, "scripts"));
-  await installGitHook(join16(args.workspacePath, ".git"), "post-merge");
-  await installGitHook(join16(args.workspacePath, ".git", "modules", "src"), "pre-push");
+  await ensureDir(join17(args.workspacePath, "notes"));
+  await ensureDir(join17(args.workspacePath, "scripts"));
+  await installGitHook(join17(args.workspacePath, ".git"), "post-merge");
+  await installGitHook(join17(args.workspacePath, ".git", "modules", "src"), "pre-push");
   log.success("C\xE0i post-merge (workspace) + pre-push (src/)");
   await appendAuditEntry("init", `flow=${args.flow},workspace=${args.workspaceName}`);
   await maybeCommitWorkspace(args.workspacePath, args.skipCommit);
@@ -2846,7 +3064,7 @@ async function maybeCreateWorkspaceRemote(args) {
     });
   }
   if (!shouldCreate) return;
-  const visibility = args.repoVisibility ?? (args.autoYes ? "private" : await select7({
+  const visibility = args.repoVisibility ?? (args.autoYes ? "private" : await select8({
     message: "Workspace visibility?",
     choices: [
       { name: "private (m\u1EB7c \u0111\u1ECBnh, an to\xE0n)", value: "private" },
@@ -2865,7 +3083,7 @@ async function maybeCreateWorkspaceRemote(args) {
     } catch (err) {
       if (err instanceof CreateWorkspaceRemoteError && err.reason === "repo-exists") {
         const fullName = err.fullName;
-        const reuseAction = await select7({
+        const reuseAction = await select8({
           message: `Repo '${fullName}' \u0111\xE3 t\u1ED3n t\u1EA1i tr\xEAn GitHub. C\xE1ch x\u1EED l\xFD?`,
           choices: [
             {
@@ -2894,7 +3112,7 @@ async function maybeCreateWorkspaceRemote(args) {
           });
           return;
         }
-        const newName = await input4({
+        const newName = await input5({
           message: "T\xEAn workspace m\u1EDBi (s\u1EBD t\u1EA1o repo new):",
           validate: (v) => v.trim().length > 0 ? true : "T\xEAn kh\xF4ng \u0111\u01B0\u1EE3c r\u1ED7ng"
         });
@@ -2919,7 +3137,7 @@ async function maybeCreateWorkspaceRemote(args) {
   }
 }
 async function resolveWorkspacePath(parent, desiredName, force) {
-  const desired = join16(parent, desiredName);
+  const desired = join17(parent, desiredName);
   if (await isEmptyOrMissing(desired)) return desired;
   log.warn(`Workspace path "${desired}" \u0111\xE3 c\xF3 n\u1ED9i dung.`);
   while (true) {
@@ -2934,7 +3152,7 @@ async function resolveWorkspacePath(parent, desiredName, force) {
     }
     choices.push({ name: "Nh\u1EADp t\xEAn workspace kh\xE1c (manual)", value: "manual" });
     choices.push({ name: "T\u1EA1m ng\u01B0ng init", value: "abort" });
-    const action = await select7({
+    const action = await select8({
       message: "C\xE1ch x\u1EED l\xFD workspace path conflict?",
       choices
     });
@@ -2946,17 +3164,17 @@ async function resolveWorkspacePath(parent, desiredName, force) {
     if (action === "use-alt" && alternative) {
       return alternative;
     }
-    const newName = await input4({
+    const newName = await input5({
       message: "T\xEAn workspace m\u1EDBi:",
       validate: (v) => v.trim().length > 0 ? true : "T\xEAn kh\xF4ng \u0111\u01B0\u1EE3c r\u1ED7ng"
     });
-    const newPath = join16(parent, newName.trim());
+    const newPath = join17(parent, newName.trim());
     if (await isEmptyOrMissing(newPath)) return newPath;
     log.warn(`"${newPath}" c\u0169ng \u0111\xE3 c\xF3 n\u1ED9i dung. Th\u1EED t\xEAn kh\xE1c.`);
   }
 }
 async function promptTeamOwner(currentUserEmail) {
-  return await input4({ message: "Team owner email:", default: currentUserEmail });
+  return await input5({ message: "Team owner email:", default: currentUserEmail });
 }
 async function maybeCommitWorkspace(workspacePath, skipCommit) {
   if (skipCommit) {
@@ -2996,6 +3214,22 @@ function printInitSuccessBox(rootPath, flow, aiResult = null) {
 `);
 }
 
+// src/lib/not-implemented-stub.ts
+function notImplementedYet(commandName, milestone) {
+  return () => {
+    process.stdout.write(
+      `${chalk.yellow("\u23F3")} ${chalk.bold(`avatar ${commandName}`)} \u2014 ch\u01B0a implement \u1EDF milestone hi\u1EC7n t\u1EA1i.
+`
+    );
+    if (milestone) {
+      process.stdout.write(`   D\u1EF1 ki\u1EBFn: ${chalk.cyan(milestone)}
+`);
+    }
+    process.stdout.write("   Spec \u0111\xE3 c\xF3 trong avatar-cli-implementation_4.html.\n");
+    process.exit(0);
+  };
+}
+
 // src/commands/mcp-run.ts
 function registerMcpRunCommand(program2) {
   program2.command("mcp-run <tool-id>", { hidden: true }).description("[internal] Spawn MCP v\u1EDBi secrets injected (M09)").action(notImplementedYet("mcp-run", "Milestone 09"));
@@ -3028,15 +3262,15 @@ function registerSecretsCommand(program2) {
 
 // src/commands/status.ts
 import { promises as fs8 } from "fs";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 import boxen5 from "boxen";
 
 // src/lib/pack-backup-manager.ts
 import { promises as fs7 } from "fs";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 var BACKUP_DIR_NAME = "_backup";
 async function listBackups(projectRoot) {
-  const dir = join17(projectRoot, ".claude", BACKUP_DIR_NAME);
+  const dir = join18(projectRoot, ".claude", BACKUP_DIR_NAME);
   if (!await pathExists(dir)) return [];
   const entries = await fs7.readdir(dir, { withFileTypes: true });
   return entries.filter((e) => e.isDirectory()).map((e) => e.name).sort().reverse();
@@ -3062,7 +3296,7 @@ function registerStatusCommand(program2) {
 }
 async function gatherStatus(cwd) {
   const projectName = cwd.split("/").filter(Boolean).pop() ?? "unknown";
-  const claudeRoot = join18(cwd, ".claude");
+  const claudeRoot = join19(cwd, ".claude");
   const hasAvatar = await pathExists(claudeRoot);
   if (!hasAvatar) {
     return {
@@ -3075,8 +3309,8 @@ async function gatherStatus(cwd) {
       hasAvatar: false
     };
   }
-  const packVersion = await isGitRepo(join18(claudeRoot, "pack")) ? await readPinnedPackVersion(cwd).catch(() => null) : null;
-  const pendingDir = join18(claudeRoot, "_pending");
+  const packVersion = await isGitRepo(join19(claudeRoot, "pack")) ? await readPinnedPackVersion(cwd).catch(() => null) : null;
+  const pendingDir = join19(claudeRoot, "_pending");
   const pendingCount = await pathExists(pendingDir) ? (await fs8.readdir(pendingDir)).filter((n) => n.endsWith(".diff.md")).length : 0;
   const backupCount = (await listBackups(cwd)).length;
   const techStackSummary = await readTechStackFirstLine(claudeRoot);
@@ -3091,7 +3325,7 @@ async function gatherStatus(cwd) {
   };
 }
 async function readTechStackFirstLine(claudeRoot) {
-  const techStackPath = join18(claudeRoot, "project", "tech-stack.md");
+  const techStackPath = join19(claudeRoot, "project", "tech-stack.md");
   if (!await pathExists(techStackPath)) return "(no tech-stack.md)";
   const content = await readText(techStackPath);
   const firstNonHeaderLine = content.split("\n").find((l) => l.trim() && !l.startsWith("#") && !l.startsWith(">"));
@@ -3132,27 +3366,27 @@ import boxen6 from "boxen";
 // src/lib/create-uninstall-backup-snapshot.ts
 import { cp, mkdir, writeFile } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { basename as basename2, join as join19 } from "path";
-var UNINSTALL_BACKUPS_DIR = join19(homedir3(), ".avatar", "uninstall-backups");
+import { basename as basename2, join as join20 } from "path";
+var UNINSTALL_BACKUPS_DIR = join20(homedir3(), ".avatar", "uninstall-backups");
 async function createUninstallBackupSnapshot(projectRoot, artifacts, avatarVersion) {
   const projectName = basename2(projectRoot);
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const backupDir = join19(UNINSTALL_BACKUPS_DIR, `${projectName}-${timestamp}`);
+  const backupDir = join20(UNINSTALL_BACKUPS_DIR, `${projectName}-${timestamp}`);
   await mkdir(backupDir, { recursive: true, mode: 448 });
   if (artifacts.claudeDir) {
-    await cp(artifacts.claudeDir, join19(backupDir, ".claude"), { recursive: true });
+    await cp(artifacts.claudeDir, join20(backupDir, ".claude"), { recursive: true });
   }
   if (artifacts.claudeMd) {
-    await cp(artifacts.claudeMd, join19(backupDir, "CLAUDE.md"));
+    await cp(artifacts.claudeMd, join20(backupDir, "CLAUDE.md"));
   }
   if (artifacts.postMergeHook || artifacts.prePushHook) {
-    const hooksBackupDir = join19(backupDir, "hooks");
+    const hooksBackupDir = join20(backupDir, "hooks");
     await mkdir(hooksBackupDir, { recursive: true });
     if (artifacts.postMergeHook) {
-      await cp(artifacts.postMergeHook, join19(hooksBackupDir, "post-merge"));
+      await cp(artifacts.postMergeHook, join20(hooksBackupDir, "post-merge"));
     }
     if (artifacts.prePushHook) {
-      await cp(artifacts.prePushHook, join19(hooksBackupDir, "pre-push"));
+      await cp(artifacts.prePushHook, join20(hooksBackupDir, "pre-push"));
     }
   }
   const manifest = {
@@ -3167,27 +3401,27 @@ async function createUninstallBackupSnapshot(projectRoot, artifacts, avatarVersi
       prePushHook: !!artifacts.prePushHook
     }
   };
-  await writeFile(join19(backupDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf8");
+  await writeFile(join20(backupDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf8");
   return backupDir;
 }
 
 // src/lib/detect-avatar-project-artifacts.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { join as join21 } from "path";
 function existsOrNull(path) {
-  return existsSync5(path) ? path : null;
+  return existsSync6(path) ? path : null;
 }
 function detectAvatarProjectArtifacts(projectRoot) {
-  const claudeDir = existsOrNull(join20(projectRoot, ".claude"));
-  const claudeMd = existsOrNull(join20(projectRoot, "CLAUDE.md"));
-  const postMergeHook = existsOrNull(join20(projectRoot, ".git", "hooks", "post-merge"));
+  const claudeDir = existsOrNull(join21(projectRoot, ".claude"));
+  const claudeMd = existsOrNull(join21(projectRoot, "CLAUDE.md"));
+  const postMergeHook = existsOrNull(join21(projectRoot, ".git", "hooks", "post-merge"));
   const prePushHook = existsOrNull(
-    join20(projectRoot, ".git", "modules", "src", "hooks", "pre-push")
+    join21(projectRoot, ".git", "modules", "src", "hooks", "pre-push")
   );
-  const gitignorePath = existsOrNull(join20(projectRoot, ".gitignore"));
-  const gitmodulesPath = existsOrNull(join20(projectRoot, ".gitmodules"));
-  const notesDir = existsOrNull(join20(projectRoot, "notes"));
-  const scriptsDir = existsOrNull(join20(projectRoot, "scripts"));
+  const gitignorePath = existsOrNull(join21(projectRoot, ".gitignore"));
+  const gitmodulesPath = existsOrNull(join21(projectRoot, ".gitmodules"));
+  const notesDir = existsOrNull(join21(projectRoot, "notes"));
+  const scriptsDir = existsOrNull(join21(projectRoot, "scripts"));
   const hasAnyArtifact = !!(claudeDir || claudeMd || postMergeHook || prePushHook);
   return {
     hasAnyArtifact,
@@ -3208,11 +3442,11 @@ async function executeUninstallDeletion(artifacts, flags) {
   if (artifacts.claudeDir) {
     if (flags.keepSubmodule) {
       const { readdir: readdir2 } = await import("fs/promises");
-      const { join: join21 } = await import("path");
+      const { join: join22 } = await import("path");
       const entries = await readdir2(artifacts.claudeDir);
       for (const entry of entries) {
         if (entry === "pack") continue;
-        await rm(join21(artifacts.claudeDir, entry), { recursive: true, force: true });
+        await rm(join22(artifacts.claudeDir, entry), { recursive: true, force: true });
       }
     } else {
       await rm(artifacts.claudeDir, { recursive: true, force: true });
@@ -3281,7 +3515,7 @@ async function removeSubmoduleEntry(gitmodulesPath, submodulePath) {
 }
 
 // src/commands/uninstall.ts
-var CLI_VERSION = "1.2.10";
+var CLI_VERSION = "1.3.0";
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("G\u1EE1 Avatar kh\u1ECFi project \u2014 backup t\u1EF1 \u0111\u1ED9ng (M11)").option("--yes", "Skip confirm prompt").option("--no-backup", "Kh\xF4ng t\u1EA1o backup tr\u01B0\u1EDBc khi x\xF3a (nguy hi\u1EC3m)").option("--keep-submodule", "Gi\u1EEF submodule .claude/pack/").option("--keep-hooks", "Gi\u1EEF git hooks post-merge, pre-push").option("--dry-run", "Hi\u1EC3n th\u1ECB danh s\xE1ch s\u1EBD x\xF3a, kh\xF4ng th\u1EF1c thi").action(async (opts) => {
     try {
@@ -3363,7 +3597,7 @@ function printUninstallSuccessBox(backupPath) {
 }
 
 // src/index.ts
-var CLI_VERSION2 = "1.2.10";
+var CLI_VERSION2 = "1.3.0";
 var program = new Command();
 program.name("avatar").description("AI harness CLI for NAL Vietnam engineering").version(CLI_VERSION2, "-v, --version", "Hi\u1EC3n th\u1ECB phi\xEAn b\u1EA3n Avatar CLI").addHelpText(
   "beforeAll",