@nalvietnam/avatar-cli 1.2.2 → 1.2.4

package/dist/index.js

@@ -4,7 +4,6 @@
 import { Command } from "commander";
 
 // src/commands/ai.ts
-import { spawnSync as spawnSync4 } from "child_process";
 import { promises as fs4 } from "fs";
 import { join as join5 } from "path";
 import { confirm } from "@inquirer/prompts";
@@ -654,6 +653,102 @@ async function runAiSetupPhase(args) {
   }
 }
 
+// src/lib/test-ai-provider-by-detected-mode.ts
+import { spawnSync as spawnSync4 } from "child_process";
+var FETCH_TIMEOUT_MS2 = 1e4;
+var CLAUDE_PRINT_TIMEOUT_MS = 3e4;
+var TEST_CHAT_MAX_TOKENS = 5;
+var TEST_CHAT_PROMPT = "say ok";
+async function testLLMLiteProvider(baseUrl, token, model) {
+  log.info(`Testing LLMLite provider: ${baseUrl} (key: ${maskApiKey(token)})`);
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS2);
+  try {
+    const modelsRes = await fetch(`${baseUrl}/v1/models`, {
+      headers: { Authorization: `Bearer ${token}` },
+      signal: controller.signal
+    });
+    if (modelsRes.status === 401 || modelsRes.status === 403) {
+      throw new Error(`API key invalid (HTTP ${modelsRes.status}). Re-run: avatar ai setup`);
+    }
+    if (!modelsRes.ok) {
+      throw new Error(`Endpoint /v1/models l\u1ED7i (HTTP ${modelsRes.status}).`);
+    }
+    const modelsJson = await modelsRes.json();
+    const models = (modelsJson.data || []).map((m) => typeof m.id === "string" ? m.id : null).filter((id) => id !== null);
+    log.success(`Connectivity OK \xB7 ${models.length} models available`);
+    if (models.length > 0) {
+      const preview = models.slice(0, 5).join(", ");
+      const more = models.length > 5 ? ` ...+${models.length - 5} more` : "";
+      log.dim(`  Models: ${preview}${more}`);
+    }
+    log.info(`Testing chat completion v\u1EDBi model "${model}"...`);
+    const chatRes = await fetch(`${baseUrl}/v1/chat/completions`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        model,
+        messages: [{ role: "user", content: TEST_CHAT_PROMPT }],
+        max_tokens: TEST_CHAT_MAX_TOKENS
+      }),
+      signal: controller.signal
+    });
+    if (!chatRes.ok) {
+      const errBody = (await chatRes.text()).slice(0, 200);
+      throw new Error(`Chat completion fail (HTTP ${chatRes.status}). ${errBody}`);
+    }
+    const chatJson = await chatRes.json();
+    const reply = typeof chatJson.choices?.[0]?.message?.content === "string" ? chatJson.choices[0].message.content : "(empty response)";
+    const tokens = chatJson.usage?.total_tokens ?? "?";
+    log.success(`Response: "${String(reply).trim().slice(0, 100)}"`);
+    log.dim(`  Tokens used: ${tokens}`);
+  } catch (err) {
+    if (err.name === "AbortError") {
+      throw new Error(`Timeout ${FETCH_TIMEOUT_MS2 / 1e3}s. Check m\u1EA1ng / endpoint ${baseUrl}.`);
+    }
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function testSubscriptionProvider() {
+  log.info("Testing Subscription provider qua `claude --print`...");
+  const result = spawnSync4("claude", ["--print", TEST_CHAT_PROMPT], {
+    encoding: "utf8",
+    timeout: CLAUDE_PRINT_TIMEOUT_MS
+  });
+  if (result.signal === "SIGTERM") {
+    throw new Error(`Timeout ${CLAUDE_PRINT_TIMEOUT_MS / 1e3}s. Check m\u1EA1ng / endpoint.`);
+  }
+  if (result.status !== 0) {
+    const stderr = (result.stderr || "").toLowerCase();
+    if (stderr.includes("401") || stderr.includes("invalid authentication") || stderr.includes("unauthorized")) {
+      throw new Error(
+        "Token Claude Code stale (401). Fix: `claude auth logout && claude auth login`."
+      );
+    }
+    throw new Error(
+      `Test fail (exit ${result.status}). Stderr: ${(result.stderr || "").slice(0, 200)}`
+    );
+  }
+  log.success(`Response: "${(result.stdout || "").trim().slice(0, 100)}"`);
+}
+async function testAiProviderByDetectedMode(settings) {
+  const env = settings.env || {};
+  const baseUrl = typeof env.ANTHROPIC_BASE_URL === "string" ? env.ANTHROPIC_BASE_URL : void 0;
+  const token = typeof env.ANTHROPIC_AUTH_TOKEN === "string" ? env.ANTHROPIC_AUTH_TOKEN : void 0;
+  const model = typeof settings.model === "string" ? settings.model : "default";
+  if (baseUrl && token) {
+    await testLLMLiteProvider(baseUrl, token, model);
+    return { ok: true, provider: "llmlite", message: "LLMLite provider working" };
+  }
+  testSubscriptionProvider();
+  return { ok: true, provider: "subscription", message: "Subscription provider working" };
+}
+
 // src/commands/ai.ts
 async function ensureWorkspaceCwd() {
   const cwd = process.cwd();
@@ -691,24 +786,15 @@ async function runAiStatus() {
   log.info(`Token:    ${token ? maskApiKey(token) : "(kh\xF4ng set \u2014 d\xF9ng subscription auth)"}`);
 }
 async function runAiTest() {
-  await ensureWorkspaceCwd();
-  log.info("Calling provider v\u1EDBi prompt 'say ok'...");
-  const result = spawnSync4("claude", ["--print", "say ok"], {
-    encoding: "utf8",
-    timeout: 3e4
-  });
-  if (result.signal === "SIGTERM") {
-    log.error("Timeout sau 30s. Check m\u1EA1ng / endpoint.");
-    process.exit(1);
-  }
-  if (result.status !== 0) {
-    log.error(`Test th\u1EA5t b\u1EA1i (exit ${result.status}).`);
-    if (result.stderr) process.stderr.write(`${result.stderr}
-`);
+  const workspacePath = await ensureWorkspaceCwd();
+  const settings = await readWorkspaceSettings(workspacePath);
+  try {
+    const result = await testAiProviderByDetectedMode(settings);
+    log.success(`\u2713 ${result.message}`);
+  } catch (err) {
+    log.error(`Test fail: ${err.message}`);
     process.exit(1);
   }
-  log.success(`Response: ${(result.stdout || "").trim().slice(0, 200)}`);
-  log.success("AI provider working");
 }
 async function runAiReset(opts) {
   const workspacePath = await ensureWorkspaceCwd();
@@ -1108,7 +1194,7 @@ async function applyFixes(checks) {
 
 // src/commands/init.ts
 import { basename, join as join16, relative as relative2, resolve } from "path";
-import { confirm as confirm2, input as input2, select as select4 } from "@inquirer/prompts";
+import { confirm as confirm3, input as input2, select as select6 } from "@inquirer/prompts";
 import boxen3 from "boxen";
 
 // src/lib/avatar-ascii-banner.ts
@@ -1257,7 +1343,7 @@ function createGithubRemoteFromFolder(input3) {
 }
 
 // src/lib/create-workspace-remote-via-gh.ts
-import { spawnSync as spawnSync14 } from "child_process";
+import { spawnSync as spawnSync15 } from "child_process";
 
 // src/lib/check-gh-cli-auth-status.ts
 import { spawnSync as spawnSync8 } from "child_process";
@@ -1290,8 +1376,124 @@ function detectPackageManager() {
   return null;
 }
 
-// src/lib/install-gh-cli-via-package-manager.ts
+// src/lib/handle-remote-access-failure-with-account-switch.ts
+import { spawnSync as spawnSync11 } from "child_process";
+import { select as select3 } from "@inquirer/prompts";
+
+// src/lib/verify-git-remote-accessible.ts
 import { spawnSync as spawnSync10 } from "child_process";
+var TIMEOUT_MS = 5e3;
+function classifyRemoteError(stderr) {
+  const text = stderr.toLowerCase();
+  if (text.includes("authentication") || text.includes("could not read username") || text.includes("permission denied") || text.includes("403") || text.includes("access denied") || text.includes("repository not found")) {
+    return "no-access";
+  }
+  if (text.includes("404") || text.includes("does not exist")) {
+    return "not-found";
+  }
+  if (text.includes("could not resolve host") || text.includes("network") || text.includes("connection refused") || text.includes("connection timed out")) {
+    return "network";
+  }
+  return "unknown";
+}
+function tryVerifyGitRemoteAccessible(url) {
+  const r = spawnSync10("git", ["ls-remote", "--exit-code", url, "HEAD"], {
+    encoding: "utf8",
+    timeout: TIMEOUT_MS,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (r.status === 0) return { ok: true };
+  if (r.signal === "SIGTERM") {
+    return { ok: false, reason: "timeout", detail: "git ls-remote > 5s" };
+  }
+  const stderr = (r.stderr || "").trim();
+  const reason = classifyRemoteError(stderr);
+  return { ok: false, reason, detail: stderr.slice(0, 300) };
+}
+
+// src/lib/handle-remote-access-failure-with-account-switch.ts
+var RemoteAccessAbortedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "RemoteAccessAbortedError";
+  }
+};
+function getCurrentGhUser() {
+  const r = spawnSync11("gh", ["api", "user", "--jq", ".login"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (r.status !== 0) return null;
+  return r.stdout.trim() || null;
+}
+function triggerGhAuthLoginInteractive() {
+  log.info("M\u1EDF browser \u0111\u1EC3 switch GitHub account...");
+  const r = spawnSync11("gh", ["auth", "login", "--web"], { stdio: "inherit" });
+  if (r.status !== 0) {
+    log.warn(`gh auth login exit ${r.status}. B\u1EA1n c\xF3 th\u1EC3 ch\u1EA1y tay r\u1ED3i quay l\u1EA1i retry.`);
+  }
+}
+function getReasonHint(reason, url, ghUser) {
+  switch (reason) {
+    case "no-access":
+      return ghUser ? `Repo c\xF3 th\u1EC3 private v\xE0 account '${ghUser}' kh\xF4ng c\xF3 quy\u1EC1n access. Switch sang account c\xF3 quy\u1EC1n, ho\u1EB7c xin invite t\u1EEB owner repo.` : "Repo c\xF3 th\u1EC3 private v\xE0 gh CLI ch\u01B0a login. Login tr\u01B0\u1EDBc r\u1ED3i retry.";
+    case "not-found":
+      return `URL c\xF3 th\u1EC3 sai ch\xEDnh t\u1EA3, ho\u1EB7c repo \u0111\xE3 b\u1ECB x\xF3a/rename. Check: ${url}`;
+    case "network":
+      return "Kh\xF4ng k\u1EBFt n\u1ED1i \u0111\u01B0\u1EE3c GitHub. Check m\u1EA1ng / VPN / firewall.";
+    case "timeout":
+      return "Network ch\u1EADm > 5s. Check m\u1EA1ng r\u1ED3i retry.";
+    default:
+      return "L\u1ED7i kh\xF4ng x\xE1c \u0111\u1ECBnh. Check URL + gh auth status.";
+  }
+}
+async function handleRemoteAccessFailureWithAccountSwitch(args) {
+  let reason = args.initialReason;
+  let detail = args.initialDetail;
+  while (true) {
+    const ghUser = getCurrentGhUser();
+    log.warn(`Kh\xF4ng truy c\u1EADp \u0111\u01B0\u1EE3c ${args.url}`);
+    log.dim(`  L\xFD do: ${reason}${detail ? ` \u2014 ${detail.slice(0, 150)}` : ""}`);
+    log.info(getReasonHint(reason, args.url, ghUser));
+    if (ghUser) log.dim(`  gh CLI hi\u1EC7n \u0111ang login: ${ghUser}`);
+    const action = await select3({
+      message: "C\xE1ch x\u1EED l\xFD?",
+      choices: [
+        {
+          name: "Switch GitHub account (gh auth login \u2014 m\u1EDF browser)",
+          value: "switch"
+        },
+        {
+          name: "T\xF4i v\u1EEBa fix (accept invite / s\u1EEDa URL) \u2014 retry verify",
+          value: "retry"
+        },
+        {
+          name: "T\u1EA1m ng\u01B0ng init \u2014 ch\u1EA1y l\u1EA1i 'avatar init' sau",
+          value: "abort"
+        }
+      ]
+    });
+    if (action === "abort") {
+      throw new RemoteAccessAbortedError(
+        `User ch\u1ECDn t\u1EA1m ng\u01B0ng. Fix access ${args.url} r\u1ED3i ch\u1EA1y l\u1EA1i 'avatar init'.`
+      );
+    }
+    if (action === "switch") {
+      triggerGhAuthLoginInteractive();
+    }
+    log.info("Verify remote l\u1EA1i...");
+    const result = tryVerifyGitRemoteAccessible(args.url);
+    if (result.ok) {
+      log.success(`Remote accessible: ${args.url}`);
+      return;
+    }
+    reason = result.reason ?? "unknown";
+    detail = result.detail;
+  }
+}
+
+// src/lib/install-gh-cli-via-package-manager.ts
+import { spawnSync as spawnSync12 } from "child_process";
 var INSTALL_COMMANDS = {
   brew: { cmd: "brew", args: ["install", "gh"] },
   apt: { cmd: "sudo", args: ["apt-get", "install", "-y", "gh"] },
@@ -1302,7 +1504,7 @@ var INSTALL_COMMANDS = {
 function installGhCliViaPackageManager(pm) {
   const spec = INSTALL_COMMANDS[pm];
   log.info(`\u0110ang c\xE0i gh CLI qua ${pm}...`);
-  const r = spawnSync10(spec.cmd, spec.args, { stdio: "inherit" });
+  const r = spawnSync12(spec.cmd, spec.args, { stdio: "inherit" });
   if (r.status !== 0) {
     throw new Error(`C\xE0i gh CLI th\u1EA5t b\u1EA1i qua ${pm} (exit ${r.status}). C\xE0i tay r\u1ED3i ch\u1EA1y l\u1EA1i.`);
   }
@@ -1310,9 +1512,9 @@ function installGhCliViaPackageManager(pm) {
 }
 
 // src/lib/setup-git-credential-via-gh.ts
-import { spawnSync as spawnSync11 } from "child_process";
+import { spawnSync as spawnSync13 } from "child_process";
 function setupGitCredentialViaGh() {
-  const r = spawnSync11("gh", ["auth", "setup-git"], { stdio: "ignore" });
+  const r = spawnSync13("gh", ["auth", "setup-git"], { stdio: "ignore" });
   if (r.status !== 0) {
     log.warn("gh auth setup-git fail (non-fatal). N\u1EBFu git clone l\u1ED7i 128 \u2192 ch\u1EA1y th\u1EE7 c\xF4ng.");
     return;
@@ -1321,10 +1523,10 @@ function setupGitCredentialViaGh() {
 }
 
 // src/lib/trigger-gh-cli-auth-login.ts
-import { spawnSync as spawnSync12 } from "child_process";
+import { spawnSync as spawnSync14 } from "child_process";
 function triggerGhCliAuthLogin() {
   log.info("Kh\u1EDFi \u0111\u1ED9ng \u0111\u0103ng nh\u1EADp GitHub qua gh CLI (browser s\u1EBD m\u1EDF)...");
-  const r = spawnSync12(
+  const r = spawnSync14(
     "gh",
     ["auth", "login", "--hostname", "github.com", "--web", "--git-protocol", "ssh"],
     { stdio: "inherit" }
@@ -1335,25 +1537,6 @@ function triggerGhCliAuthLogin() {
   log.success("\u0110\xE3 \u0111\u0103ng nh\u1EADp GitHub");
 }
 
-// src/lib/verify-git-remote-accessible.ts
-import { spawnSync as spawnSync13 } from "child_process";
-var TIMEOUT_MS = 5e3;
-var RemoteNotAccessibleError = class extends Error {
-  constructor(url, reason) {
-    super(`Kh\xF4ng truy c\u1EADp \u0111\u01B0\u1EE3c remote ${url}: ${reason}`);
-    this.name = "RemoteNotAccessibleError";
-  }
-};
-function verifyGitRemoteAccessible(url) {
-  const r = spawnSync13("git", ["ls-remote", "--exit-code", url, "HEAD"], {
-    stdio: "ignore",
-    timeout: TIMEOUT_MS
-  });
-  if (r.status === 0) return;
-  if (r.signal === "SIGTERM") throw new RemoteNotAccessibleError(url, "timeout 5s");
-  throw new RemoteNotAccessibleError(url, `git ls-remote exit ${r.status}`);
-}
-
 // src/lib/git-auth-and-install-orchestrator.ts
 async function ensureGitHubReady(remoteUrl) {
   let state = checkGhCliAuthStatus();
@@ -1379,20 +1562,58 @@ async function ensureGitHubReady(remoteUrl) {
   log.success("gh CLI s\u1EB5n s\xE0ng");
   setupGitCredentialViaGh();
   if (remoteUrl) {
-    verifyGitRemoteAccessible(remoteUrl);
-    log.success(`Remote accessible: ${remoteUrl}`);
+    const result = tryVerifyGitRemoteAccessible(remoteUrl);
+    if (result.ok) {
+      log.success(`Remote accessible: ${remoteUrl}`);
+    } else {
+      await handleRemoteAccessFailureWithAccountSwitch({
+        url: remoteUrl,
+        initialReason: result.reason ?? "unknown",
+        initialDetail: result.detail
+      });
+    }
   }
 }
 
 // src/lib/create-workspace-remote-via-gh.ts
+function canCreateInNamespace(org, ghUser) {
+  if (org.toLowerCase() === ghUser.toLowerCase()) return { ok: true };
+  const r = spawnSync15("gh", ["api", `orgs/${org}/members/${ghUser}`, "--silent"], {
+    stdio: "ignore"
+  });
+  if (r.status === 0) return { ok: true };
+  const orgCheck = spawnSync15("gh", ["api", `orgs/${org}`, "--silent"], { stdio: "ignore" });
+  if (orgCheck.status !== 0) {
+    const userCheck = spawnSync15("gh", ["api", `users/${org}`, "--silent"], { stdio: "ignore" });
+    if (userCheck.status === 0) {
+      return {
+        ok: false,
+        reason: `'${org}' l\xE0 personal account kh\xE1c (kh\xF4ng ph\u1EA3i org). B\u1EA1n (${ghUser}) kh\xF4ng th\u1EC3 t\u1EA1o repo d\u01B0\u1EDBi account c\u1EE7a user kh\xE1c. Pass --repo-org=${ghUser} ho\u1EB7c switch gh: gh auth login`
+      };
+    }
+    return {
+      ok: false,
+      reason: `'${org}' kh\xF4ng t\u1ED3n t\u1EA1i tr\xEAn GitHub. Check ch\xEDnh t\u1EA3 ho\u1EB7c t\u1EA1o org tr\u01B0\u1EDBc.`
+    };
+  }
+  return {
+    ok: false,
+    reason: `'${ghUser}' kh\xF4ng ph\u1EA3i member c\u1EE7a org '${org}'. Li\xEAn h\u1EC7 admin org \u0111\u1EC3 \u0111\u01B0\u1EE3c invite, ho\u1EB7c pass --repo-org=${ghUser} t\u1EA1o d\u01B0\u1EDBi personal account.`
+  };
+}
 async function createWorkspaceRemoteViaGh(input3) {
   validateRepoName(input3.workspaceName);
   validateRepoVisibility(input3.visibility);
   await ensureGitHubReady();
-  const org = input3.org ?? resolveGithubUsernameDefault();
+  const ghUser = resolveGithubUsernameDefault();
+  const org = input3.org ?? ghUser;
+  const namespaceCheck = canCreateInNamespace(org, ghUser);
+  if (!namespaceCheck.ok) {
+    throw new Error(`Kh\xF4ng th\u1EC3 t\u1EA1o repo d\u01B0\u1EDBi '${org}/': ${namespaceCheck.reason}`);
+  }
   const fullName = `${org}/${input3.workspaceName}`;
   log.info(`T\u1EA1o GitHub repo cho workspace: ${fullName} (${input3.visibility})...`);
-  const r = spawnSync14(
+  const r = spawnSync15(
     "gh",
     [
       "repo",
@@ -1405,9 +1626,12 @@ async function createWorkspaceRemoteViaGh(input3) {
       "origin",
       "--push"
     ],
-    { stdio: "inherit" }
+    { stdio: ["inherit", "inherit", "pipe"], encoding: "utf8" }
   );
   if (r.status !== 0) {
+    const stderr = (r.stderr || "").trim();
+    if (stderr) process.stderr.write(`${stderr}
+`);
     throw new Error(
       `T\u1EA1o workspace remote th\u1EA5t b\u1EA1i (exit ${r.status}). Workspace v\u1EABn d\xF9ng \u0111\u01B0\u1EE3c local. Setup remote sau qua: gh repo create ${fullName} --${input3.visibility} --source=. --remote=origin --push`
     );
@@ -1420,7 +1644,7 @@ async function createWorkspaceRemoteViaGh(input3) {
 
 // src/lib/safe-bootstrap-for-dirty-folder.ts
 import { readdirSync } from "fs";
-import { select as select3 } from "@inquirer/prompts";
+import { select as select4 } from "@inquirer/prompts";
 import { simpleGit as simpleGit3 } from "simple-git";
 
 // src/lib/check-folder-has-git.ts
@@ -1551,7 +1775,7 @@ async function promptBootstrapStrategy(state, opts) {
   if (opts.presetStrategy) return opts.presetStrategy;
   if (opts.autoYes) return "stash";
   if (state === "empty" || state === "clean") return "commit-all";
-  return await select3({
+  return await select4({
     message: state === "dirty" ? "Folder c\xF3 changes ch\u01B0a commit. C\xE1ch x\u1EED l\xFD:" : "Folder c\xF3 file ch\u01B0a version. C\xE1ch x\u1EED l\xFD:",
     choices: [
       {
@@ -1687,25 +1911,110 @@ async function safeBootstrapGitInFolder(folderPath, opts = {}) {
 // src/lib/team-pack-submodule-manager.ts
 import { join as join14 } from "path";
 
+// src/lib/check-team-pack-access-with-retry-loop.ts
+import { spawnSync as spawnSync16 } from "child_process";
+import { confirm as confirm2, select as select5 } from "@inquirer/prompts";
+function parseRepoSlugFromGitUrl(url) {
+  const httpsMatch = url.match(/github\.com[/:]([^/]+\/[^/]+?)(?:\.git)?$/);
+  if (httpsMatch) return httpsMatch[1];
+  return null;
+}
+function checkRepoAccess(repoSlug) {
+  const r = spawnSync16("gh", ["api", `repos/${repoSlug}`], { stdio: "ignore" });
+  return r.status === 0;
+}
+function getCurrentGhUser2() {
+  const r = spawnSync16("gh", ["api", "user", "--jq", ".login"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (r.status !== 0) return null;
+  return r.stdout.trim() || null;
+}
+async function copyInfoToClipboardWithConsent(info) {
+  const ok = await confirm2({
+    message: "Copy th\xF4ng tin (GitHub username + email) v\xE0o clipboard \u0111\u1EC3 d\xE1n v\xE0o Slack/email?",
+    default: true
+  });
+  if (!ok) return;
+  try {
+    const { default: clipboardy } = await import("clipboardy");
+    await clipboardy.write(info);
+    log.success("\u0110\xE3 copy v\xE0o clipboard");
+  } catch (err) {
+    log.dim(`Copy clipboard fail: ${err.message}`);
+  }
+}
+function buildAccessRequestInfo(ghUser, ssoEmail) {
+  const lines = [
+    "Request access team-ai-pack (NAL)",
+    "",
+    `GitHub username: ${ghUser ?? "(ch\u01B0a gh auth \u2014 ch\u1EA1y: gh auth login)"}`,
+    `NAL email:       ${ssoEmail ?? "(ch\u01B0a avatar login \u2014 ch\u1EA1y: avatar login)"}`,
+    `Date:            ${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}`
+  ];
+  return lines.join("\n");
+}
+async function ensureTeamPackAccessWithRetry(args) {
+  if (checkRepoAccess(args.repoSlug)) return true;
+  const ghUser = getCurrentGhUser2();
+  const info = buildAccessRequestInfo(ghUser, args.ssoEmail ?? null);
+  log.warn(`B\u1EA1n ch\u01B0a c\xF3 quy\u1EC1n access v\xE0o b\u1ED9 package ${args.repoSlug}.`);
+  log.info("Li\xEAn h\u1EC7 admin (Luke @nal.vn) \u0111\u1EC3 \u0111\u01B0\u1EE3c add v\xE0o org nalvn.");
+  log.plain("");
+  log.plain(info);
+  log.plain("");
+  await copyInfoToClipboardWithConsent(info);
+  while (true) {
+    const action = await select5({
+      message: "Ti\u1EBFp t\u1EE5c?",
+      choices: [
+        { name: "\u0110\xE3 \u0111\u01B0\u1EE3c add \u2014 ki\u1EC3m tra l\u1EA1i v\xE0 ti\u1EBFp t\u1EE5c", value: "retry" },
+        { name: "T\u1EA1m ng\u01B0ng \u2014 ch\u1EA1y l\u1EA1i 'avatar init' sau", value: "abort" }
+      ]
+    });
+    if (action === "abort") {
+      log.dim("T\u1EA1m ng\u01B0ng. Ch\u1EA1y l\u1EA1i 'avatar init' sau khi \u0111\xE3 accept invite t\u1EEB GitHub.");
+      return false;
+    }
+    log.info("Ki\u1EC3m tra access...");
+    if (checkRepoAccess(args.repoSlug)) {
+      log.success("\u0110\xE3 c\xF3 access \u2014 ti\u1EBFp t\u1EE5c.");
+      return true;
+    }
+    log.warn("V\u1EABn ch\u01B0a c\xF3 access. \u0110\u1EA3m b\u1EA3o b\u1EA1n \u0111\xE3 accept email invite t\u1EEB GitHub (Inbox + Spam).");
+  }
+}
+
 // src/lib/resolve-team-pack-repo-url.ts
-var LEGACY_FALLBACK = "https://github.com/LukeNALS/team-ai-pack.git";
+var ORG_DEFAULT = "https://github.com/nalvn/team-ai-pack.git";
 function resolveTeamPackRepoUrl() {
   if (process.env.AVATAR_TEAM_PACK_REPO_URL) {
     return process.env.AVATAR_TEAM_PACK_REPO_URL;
   }
-  try {
-    const ghUser = resolveGithubUsernameDefault();
-    if (ghUser) return `https://github.com/${ghUser}/team-ai-pack.git`;
-  } catch {
-  }
-  return LEGACY_FALLBACK;
+  return ORG_DEFAULT;
 }
 
 // src/lib/team-pack-submodule-manager.ts
 var TEAM_PACK_REPO_URL = resolveTeamPackRepoUrl();
 var TEAM_PACK_RELATIVE_PATH = ".claude/pack";
-async function addTeamPackSubmodule(projectRoot, tag) {
+var TeamPackAccessAbortedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TeamPackAccessAbortedError";
+  }
+};
+async function addTeamPackSubmodule(projectRoot, tag, ssoEmail) {
   const url = resolveTeamPackRepoUrl();
+  const repoSlug = parseRepoSlugFromGitUrl(url);
+  if (repoSlug) {
+    const hasAccess = await ensureTeamPackAccessWithRetry({ repoSlug, ssoEmail });
+    if (!hasAccess) {
+      throw new TeamPackAccessAbortedError(
+        "User ch\u1ECDn t\u1EA1m ng\u01B0ng. Ch\u1EA1y l\u1EA1i 'avatar init' sau khi \u0111\u01B0\u1EE3c add v\xE0o org."
+      );
+    }
+  }
   try {
     await addSubmodule(url, TEAM_PACK_RELATIVE_PATH, projectRoot);
   } catch (err) {
@@ -1992,6 +2301,14 @@ function registerInitCommand(program2) {
         log.dim(err.message);
         process.exit(0);
       }
+      if (err instanceof TeamPackAccessAbortedError) {
+        log.dim(err.message);
+        process.exit(0);
+      }
+      if (err instanceof RemoteAccessAbortedError) {
+        log.dim(err.message);
+        process.exit(0);
+      }
       log.error(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
@@ -2026,7 +2343,7 @@ async function runInit(opts) {
   }
 }
 async function promptProjectStatus() {
-  return await select4({
+  return await select6({
     message: "T\xECnh tr\u1EA1ng d\u1EF1 \xE1n c\u1EE7a b\u1EA1n?",
     choices: [
       { name: "1. \u0110\xE3 c\xF3 repo git remote (URL c\xF3 s\u1EB5n)", value: "existing-remote" },
@@ -2104,7 +2421,7 @@ async function runInitFromScratch(opts, ownerEmail) {
     message: "T\xEAn d\u1EF1 \xE1n:",
     validate: (v) => v.length > 0 ? true : "T\xEAn b\u1EAFt bu\u1ED9c"
   });
-  const visibility = opts.repoVisibility ?? await select4({
+  const visibility = opts.repoVisibility ?? await select6({
     message: "Visibility?",
     choices: [
       { name: "private (m\u1EB7c \u0111\u1ECBnh)", value: "private" },
@@ -2164,7 +2481,7 @@ async function getOrCreateOriginRemote(folderPath, opts) {
     log.success(`Folder \u0111\xE3 c\xF3 remote origin: ${origin.refs.push}`);
     return origin.refs.push;
   }
-  const shouldCreate = opts.createRemote ?? await confirm2({
+  const shouldCreate = opts.createRemote ?? await confirm3({
     message: "Folder ch\u01B0a c\xF3 remote. T\u1EA1o GitHub repo ngay \u0111\u1EC3 share team?",
     default: true
   });
@@ -2173,7 +2490,7 @@ async function getOrCreateOriginRemote(folderPath, opts) {
     return void 0;
   }
   await ensureGitHubReady();
-  const visibility = opts.repoVisibility ?? await select4({
+  const visibility = opts.repoVisibility ?? await select6({
     message: "Visibility?",
     choices: [
       { name: "private (m\u1EB7c \u0111\u1ECBnh)", value: "private" },
@@ -2264,13 +2581,13 @@ async function maybeCreateWorkspaceRemote(args) {
   let shouldCreate = args.createWorkspaceRemote;
   if (shouldCreate === void 0) {
     if (args.autoYes) return;
-    shouldCreate = await confirm2({
+    shouldCreate = await confirm3({
       message: "T\u1EA1o remote GitHub cho workspace \u0111\u1EC3 share team? (Avatar state)",
       default: false
     });
   }
   if (!shouldCreate) return;
-  const visibility = args.repoVisibility ?? (args.autoYes ? "private" : await select4({
+  const visibility = args.repoVisibility ?? (args.autoYes ? "private" : await select6({
     message: "Workspace visibility?",
     choices: [
       { name: "private (m\u1EB7c \u0111\u1ECBnh, an to\xE0n)", value: "private" },
@@ -2301,7 +2618,7 @@ async function resolveWorkspacePath(parent, desiredName, force) {
     log.info(`--force: d\xF9ng ${alternative}`);
     return alternative;
   }
-  const useAlt = await confirm2({ message: `D\xF9ng "${alternative}" thay th\u1EBF?`, default: true });
+  const useAlt = await confirm3({ message: `D\xF9ng "${alternative}" thay th\u1EBF?`, default: true });
   if (!useAlt) throw new Error("H\u1EE7y init. Ch\u1EA1y l\u1EA1i v\u1EDBi --workspace-name kh\xE1c.");
   return alternative;
 }
@@ -2476,7 +2793,7 @@ function registerToolsCommand(program2) {
 
 // src/commands/uninstall.ts
 import { relative as relative3 } from "path";
-import { confirm as confirm3 } from "@inquirer/prompts";
+import { confirm as confirm4 } from "@inquirer/prompts";
 import boxen5 from "boxen";
 
 // src/lib/create-uninstall-backup-snapshot.ts
@@ -2631,7 +2948,7 @@ async function removeSubmoduleEntry(gitmodulesPath, submodulePath) {
 }
 
 // src/commands/uninstall.ts
-var CLI_VERSION = "1.2.2";
+var CLI_VERSION = "1.2.4";
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("G\u1EE1 Avatar kh\u1ECFi project \u2014 backup t\u1EF1 \u0111\u1ED9ng (M11)").option("--yes", "Skip confirm prompt").option("--no-backup", "Kh\xF4ng t\u1EA1o backup tr\u01B0\u1EDBc khi x\xF3a (nguy hi\u1EC3m)").option("--keep-submodule", "Gi\u1EEF submodule .claude/pack/").option("--keep-hooks", "Gi\u1EEF git hooks post-merge, pre-push").option("--dry-run", "Hi\u1EC3n th\u1ECB danh s\xE1ch s\u1EBD x\xF3a, kh\xF4ng th\u1EF1c thi").action(async (opts) => {
     try {
@@ -2655,7 +2972,7 @@ async function runUninstall(opts) {
     return;
   }
   if (!opts.yes) {
-    const ok = await confirm3({
+    const ok = await confirm4({
       message: "Ti\u1EBFp t\u1EE5c g\u1EE1 Avatar?",
       default: false
     });
@@ -2713,7 +3030,7 @@ function printUninstallSuccessBox(backupPath) {
 }
 
 // src/index.ts
-var CLI_VERSION2 = "1.2.2";
+var CLI_VERSION2 = "1.2.4";
 var program = new Command();
 program.name("avatar").description("AI harness CLI for NAL Vietnam engineering").version(CLI_VERSION2, "-v, --version", "Hi\u1EC3n th\u1ECB phi\xEAn b\u1EA3n Avatar CLI").addHelpText(
   "beforeAll",