@nalvietnam/avatar-cli 1.2.4 → 1.2.6

package/dist/index.js

@@ -546,19 +546,19 @@ function applyUseGlobal(existing, source) {
     ...sourceModel ? { model: sourceModel } : {}
   };
 }
-async function writeClaudeSettings(workspacePath, input3) {
+async function writeClaudeSettings(workspacePath, input4) {
   const path = getClaudeSettingsPath(workspacePath);
   const existing = await readExistingSettings(path);
   let merged;
-  switch (input3.provider) {
+  switch (input4.provider) {
     case "subscription":
-      merged = applySubscription(existing, input3.model);
+      merged = applySubscription(existing, input4.model);
       break;
     case "llmlite":
-      merged = applyLLMLite(existing, input3.apiKey, input3.baseUrl, input3.model);
+      merged = applyLLMLite(existing, input4.apiKey, input4.baseUrl, input4.model);
       break;
     case "use-global":
-      merged = applyUseGlobal(existing, input3.sourceSettings);
+      merged = applyUseGlobal(existing, input4.sourceSettings);
       break;
   }
   await writeJsonAtomic(path, merged, SECRET_FILE_MODE2);
@@ -1194,8 +1194,240 @@ async function applyFixes(checks) {
 
 // src/commands/init.ts
 import { basename, join as join16, relative as relative2, resolve } from "path";
-import { confirm as confirm3, input as input2, select as select6 } from "@inquirer/prompts";
-import boxen3 from "boxen";
+import { confirm as confirm3, input as input3, select as select7 } from "@inquirer/prompts";
+import boxen4 from "boxen";
+
+// src/lib/prompt-recovery-action-on-failure.ts
+import { input as input2, select as select3 } from "@inquirer/prompts";
+var UserAbortedRecoveryError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "UserAbortedRecoveryError";
+  }
+};
+async function promptRetryOrSkip(args) {
+  log.warn(`${args.taskName} th\u1EA5t b\u1EA1i: ${args.reason}`);
+  if (args.hint) log.info(args.hint);
+  const choices = [
+    { name: "Th\u1EED l\u1EA1i (Retry)", value: "retry" }
+  ];
+  if (args.allowSkip) {
+    choices.push({ name: "B\u1ECF qua b\u01B0\u1EDBc n\xE0y v\xE0 ti\u1EBFp t\u1EE5c (Skip)", value: "skip" });
+  }
+  choices.push({ name: "T\u1EA1m ng\u01B0ng init \u2014 ch\u1EA1y l\u1EA1i sau (Abort)", value: "abort" });
+  return await select3({
+    message: "C\xE1ch x\u1EED l\xFD?",
+    choices
+  });
+}
+
+// src/lib/team-pack-submodule-manager.ts
+import { join as join10 } from "path";
+
+// src/lib/check-team-pack-access-with-retry-loop.ts
+import { spawnSync as spawnSync6 } from "child_process";
+import { confirm as confirm2, select as select4 } from "@inquirer/prompts";
+import boxen2 from "boxen";
+function parseRepoSlugFromGitUrl(url) {
+  const httpsMatch = url.match(/github\.com[/:]([^/]+\/[^/]+?)(?:\.git)?$/);
+  if (httpsMatch) return httpsMatch[1];
+  return null;
+}
+function checkRepoAccess(repoSlug) {
+  const r = spawnSync6("gh", ["api", `repos/${repoSlug}`], { stdio: "ignore" });
+  return r.status === 0;
+}
+function getCurrentGhUser() {
+  const r = spawnSync6("gh", ["api", "user", "--jq", ".login"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (r.status !== 0) return null;
+  return r.stdout.trim() || null;
+}
+function triggerGhAuthLoginInteractive() {
+  log.info("M\u1EDF browser \u0111\u1EC3 switch GitHub account...");
+  const r = spawnSync6("gh", ["auth", "login", "--web"], { stdio: "inherit" });
+  if (r.status !== 0) {
+    log.warn(`gh auth login exit ${r.status}. C\xF3 th\u1EC3 ch\u1EA1y tay r\u1ED3i quay l\u1EA1i retry.`);
+  }
+}
+async function copyInfoToClipboardWithConsent(info) {
+  const ok = await confirm2({
+    message: "Copy th\xF4ng tin (GitHub username + email) v\xE0o clipboard \u0111\u1EC3 d\xE1n v\xE0o Slack/email?",
+    default: true
+  });
+  if (!ok) return;
+  try {
+    const { default: clipboardy } = await import("clipboardy");
+    await clipboardy.write(info);
+    log.success("\u0110\xE3 copy v\xE0o clipboard");
+  } catch (err) {
+    log.dim(`Copy clipboard fail: ${err.message}`);
+  }
+}
+function printAccessWarningBox(repoSlug, ghUser, ssoEmail) {
+  const lines = [
+    `${chalk.red("\u26D4 KH\xD4NG C\xD3 QUY\u1EC0N ACCESS")}`,
+    "",
+    `Repo: ${chalk.bold(repoSlug)}`,
+    "",
+    "B\u1EA1n c\u1EA7n \u0111\u01B0\u1EE3c admin add v\xE0o org \u0111\u1EC3 pull team-ai-pack.",
+    "",
+    `${chalk.dim("Th\xF4ng tin g\u1EEDi admin:")}`,
+    `  GitHub username: ${chalk.cyan(ghUser ?? "(ch\u01B0a gh auth \u2014 ch\u1EA1y: gh auth login)")}`,
+    `  NAL email:       ${chalk.cyan(ssoEmail ?? "(ch\u01B0a avatar login \u2014 ch\u1EA1y: avatar login)")}`,
+    `  Date:            ${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}`,
+    "",
+    `${chalk.dim("Li\xEAn h\u1EC7:")} luke@nal.vn (Slack #avatar-setup)`
+  ];
+  process.stdout.write(
+    `${boxen2(lines.join("\n"), { padding: 1, borderColor: "red", borderStyle: "round" })}
+`
+  );
+}
+function buildAccessRequestInfo(repoSlug, ghUser, ssoEmail) {
+  return [
+    `Request access ${repoSlug} (NAL)`,
+    "",
+    `GitHub username: ${ghUser ?? "(ch\u01B0a gh auth \u2014 ch\u1EA1y: gh auth login)"}`,
+    `NAL email:       ${ssoEmail ?? "(ch\u01B0a avatar login \u2014 ch\u1EA1y: avatar login)"}`,
+    `Date:            ${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}`
+  ].join("\n");
+}
+async function ensureTeamPackAccessWithRetry(args) {
+  if (checkRepoAccess(args.repoSlug)) return true;
+  const initialGhUser = getCurrentGhUser();
+  printAccessWarningBox(args.repoSlug, initialGhUser, args.ssoEmail ?? null);
+  await copyInfoToClipboardWithConsent(
+    buildAccessRequestInfo(args.repoSlug, initialGhUser, args.ssoEmail ?? null)
+  );
+  while (true) {
+    const ghUser = getCurrentGhUser();
+    const ghUserDisplay = ghUser ?? "(ch\u01B0a gh auth)";
+    const action = await select4({
+      message: "C\xE1ch x\u1EED l\xFD?",
+      choices: [
+        {
+          name: `\u0110\xE3 \u0111\u01B0\u1EE3c grant access v\u1EDBi GitHub username '${ghUserDisplay}' \u2014 ki\u1EC3m tra l\u1EA1i`,
+          value: "retry-same"
+        },
+        {
+          name: "\u0110\xE3 grant v\u1EDBi GitHub account kh\xE1c \u2014 switch gh (m\u1EDF browser)",
+          value: "switch-account"
+        },
+        {
+          name: "T\u1EA1m ng\u01B0ng \u2014 ch\u1EA1y l\u1EA1i 'avatar init' sau",
+          value: "abort"
+        }
+      ]
+    });
+    if (action === "abort") {
+      log.dim("T\u1EA1m ng\u01B0ng. Ch\u1EA1y l\u1EA1i 'avatar init' sau khi \u0111\xE3 accept invite t\u1EEB GitHub.");
+      return false;
+    }
+    if (action === "switch-account") {
+      triggerGhAuthLoginInteractive();
+    }
+    log.info("Ki\u1EC3m tra access...");
+    if (checkRepoAccess(args.repoSlug)) {
+      const finalUser = getCurrentGhUser();
+      log.success(`\u0110\xE3 c\xF3 access v\u1EDBi '${finalUser ?? "(unknown)"}' \u2014 ti\u1EBFp t\u1EE5c.`);
+      return true;
+    }
+    log.warn(
+      `V\u1EABn ch\u01B0a c\xF3 access v\u1EDBi account '${ghUser ?? "(unknown)"}'. \u0110\u1EA3m b\u1EA3o \u0111\xE3 accept email invite ho\u1EB7c switch \u0111\xFAng account.`
+    );
+  }
+}
+
+// src/lib/resolve-team-pack-repo-url.ts
+var ORG_DEFAULT = "https://github.com/nalvn/team-ai-pack.git";
+function resolveTeamPackRepoUrl() {
+  if (process.env.AVATAR_TEAM_PACK_REPO_URL) {
+    return process.env.AVATAR_TEAM_PACK_REPO_URL;
+  }
+  return ORG_DEFAULT;
+}
+
+// src/lib/team-pack-submodule-manager.ts
+var TEAM_PACK_REPO_URL = resolveTeamPackRepoUrl();
+var TEAM_PACK_RELATIVE_PATH = ".claude/pack";
+var TeamPackAccessAbortedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TeamPackAccessAbortedError";
+  }
+};
+async function addTeamPackSubmodule(projectRoot, tag, ssoEmail) {
+  const url = resolveTeamPackRepoUrl();
+  const repoSlug = parseRepoSlugFromGitUrl(url);
+  if (repoSlug) {
+    const hasAccess = await ensureTeamPackAccessWithRetry({ repoSlug, ssoEmail });
+    if (!hasAccess) {
+      throw new TeamPackAccessAbortedError(
+        "User ch\u1ECDn t\u1EA1m ng\u01B0ng. Ch\u1EA1y l\u1EA1i 'avatar init' sau khi \u0111\u01B0\u1EE3c add v\xE0o org."
+      );
+    }
+  }
+  try {
+    await addSubmodule(url, TEAM_PACK_RELATIVE_PATH, projectRoot);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("Repository not found") || msg.includes("not found")) {
+      log.error(
+        `Repo team-ai-pack kh\xF4ng t\u1ED3n t\u1EA1i: ${url}
+  C\xE1ch fix:
+    1. T\u1EA1o repo: gh repo create <owner>/team-ai-pack --private --add-readme
+    2. Ho\u1EB7c override URL: export AVATAR_TEAM_PACK_REPO_URL=<url-repo-c\u1EE7a-b\u1EA1n>
+    3. Ho\u1EB7c d\xF9ng flag --skip-team-pack`
+      );
+    }
+    throw err;
+  }
+  let target = tag ?? null;
+  if (!target) {
+    target = await latestTag(join10(projectRoot, TEAM_PACK_RELATIVE_PATH));
+  }
+  if (target) {
+    await checkoutTagInSubmodule(TEAM_PACK_RELATIVE_PATH, target, projectRoot);
+  }
+  return { pinnedTag: target };
+}
+async function readPinnedPackVersion(projectRoot) {
+  const submoduleRoot = join10(projectRoot, TEAM_PACK_RELATIVE_PATH);
+  const tag = await latestTag(submoduleRoot);
+  if (tag) return tag;
+  const sha = await currentCommitSha(submoduleRoot);
+  return sha.slice(0, 7);
+}
+
+// src/lib/add-team-pack-submodule-with-retry-on-network-fail.ts
+async function addTeamPackSubmoduleWithRetryOnNetworkFail(projectRoot, tag, ssoEmail) {
+  while (true) {
+    try {
+      const result = await addTeamPackSubmodule(projectRoot, tag, ssoEmail);
+      return { pinnedTag: result.pinnedTag, skipped: false };
+    } catch (err) {
+      if (err instanceof TeamPackAccessAbortedError) throw err;
+      const action = await promptRetryOrSkip({
+        taskName: "Pull team-ai-pack submodule",
+        reason: err instanceof Error ? err.message : String(err),
+        allowSkip: true,
+        hint: "Network glitch? Retry th\u01B0\u1EDDng work. N\u1EBFu skip, d\xF9ng `avatar sync` sau \u0111\u1EC3 pull pack."
+      });
+      if (action === "abort") {
+        throw new UserAbortedRecoveryError("User abort t\u1EA1i b\u01B0\u1EDBc pull team-ai-pack.");
+      }
+      if (action === "skip") {
+        log.warn(
+          "Skip team-ai-pack. Workspace d\xF9ng \u0111\u01B0\u1EE3c nh\u01B0ng kh\xF4ng c\xF3 shared knowledge. Pull sau qua `avatar sync`."
+        );
+        return { pinnedTag: null, skipped: true };
+      }
+    }
+  }
+}
 
 // src/lib/avatar-ascii-banner.ts
 import chalk2 from "chalk";
@@ -1259,27 +1491,27 @@ ${renderAvatarBanner(opts)}
 }
 
 // src/lib/execute-gh-repo-create.ts
-import { spawnSync as spawnSync6 } from "child_process";
+import { spawnSync as spawnSync7 } from "child_process";
 var RepoAlreadyExistsError = class extends Error {
   constructor(fullName) {
     super(`Repo "${fullName}" \u0111\xE3 t\u1ED3n t\u1EA1i tr\xEAn GitHub. \u0110\u1ED5i t\xEAn ho\u1EB7c x\xF3a repo c\u0169.`);
     this.name = "RepoAlreadyExistsError";
   }
 };
-function executeGhRepoCreate(input3) {
-  const fullName = `${input3.org}/${input3.name}`;
+function executeGhRepoCreate(input4) {
+  const fullName = `${input4.org}/${input4.name}`;
   const args = [
     "repo",
     "create",
     fullName,
-    `--${input3.visibility}`,
+    `--${input4.visibility}`,
     "--source",
-    input3.folder,
+    input4.folder,
     "--remote",
     "origin",
     "--push"
   ];
-  const r = spawnSync6("gh", args, { stdio: "inherit" });
+  const r = spawnSync7("gh", args, { stdio: "inherit" });
   if (r.status !== 0) {
     if (r.status === 1) {
       throw new RepoAlreadyExistsError(fullName);
@@ -1293,9 +1525,9 @@ function executeGhRepoCreate(input3) {
 }
 
 // src/lib/resolve-github-username-default.ts
-import { spawnSync as spawnSync7 } from "child_process";
+import { spawnSync as spawnSync8 } from "child_process";
 function resolveGithubUsernameDefault() {
-  const r = spawnSync7("gh", ["api", "user", "--jq", ".login"], {
+  const r = spawnSync8("gh", ["api", "user", "--jq", ".login"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -1327,28 +1559,28 @@ function validateRepoVisibility(v) {
 }
 
 // src/lib/create-github-remote-from-folder.ts
-function createGithubRemoteFromFolder(input3) {
-  validateRepoName(input3.name);
-  validateRepoVisibility(input3.visibility);
-  const org = input3.org ?? resolveGithubUsernameDefault();
-  log.info(`T\u1EA1o GitHub repo ${org}/${input3.name} (${input3.visibility})...`);
+function createGithubRemoteFromFolder(input4) {
+  validateRepoName(input4.name);
+  validateRepoVisibility(input4.visibility);
+  const org = input4.org ?? resolveGithubUsernameDefault();
+  log.info(`T\u1EA1o GitHub repo ${org}/${input4.name} (${input4.visibility})...`);
   const urls = executeGhRepoCreate({
-    folder: input3.folder,
+    folder: input4.folder,
     org,
-    name: input3.name,
-    visibility: input3.visibility
+    name: input4.name,
+    visibility: input4.visibility
   });
   log.success(`\u0110\xE3 t\u1EA1o: ${urls.sshUrl}`);
   return urls;
 }
 
 // src/lib/create-workspace-remote-via-gh.ts
-import { spawnSync as spawnSync15 } from "child_process";
+import { spawnSync as spawnSync16 } from "child_process";
 
 // src/lib/check-gh-cli-auth-status.ts
-import { spawnSync as spawnSync8 } from "child_process";
+import { spawnSync as spawnSync9 } from "child_process";
 function checkGhCliAuthStatus() {
-  const r = spawnSync8("gh", ["auth", "status"], { stdio: "ignore" });
+  const r = spawnSync9("gh", ["auth", "status"], { stdio: "ignore" });
   if (r.error && r.error.code === "ENOENT") {
     return "not-installed";
   }
@@ -1356,12 +1588,12 @@ function checkGhCliAuthStatus() {
 }
 
 // src/lib/detect-package-manager.ts
-import { spawnSync as spawnSync9 } from "child_process";
+import { spawnSync as spawnSync10 } from "child_process";
 function hasBinary(name) {
   const platform2 = detectHostPlatform();
   const probe = platform2 === "win32" ? "where" : "command";
   const args = platform2 === "win32" ? [name] : ["-v", name];
-  const r = spawnSync9(probe, args, {
+  const r = spawnSync10(probe, args, {
     shell: platform2 !== "win32",
     stdio: "ignore"
   });
@@ -1377,11 +1609,11 @@ function detectPackageManager() {
 }
 
 // src/lib/handle-remote-access-failure-with-account-switch.ts
-import { spawnSync as spawnSync11 } from "child_process";
-import { select as select3 } from "@inquirer/prompts";
+import { spawnSync as spawnSync12 } from "child_process";
+import { select as select5 } from "@inquirer/prompts";
 
 // src/lib/verify-git-remote-accessible.ts
-import { spawnSync as spawnSync10 } from "child_process";
+import { spawnSync as spawnSync11 } from "child_process";
 var TIMEOUT_MS = 5e3;
 function classifyRemoteError(stderr) {
   const text = stderr.toLowerCase();
@@ -1397,7 +1629,7 @@ function classifyRemoteError(stderr) {
   return "unknown";
 }
 function tryVerifyGitRemoteAccessible(url) {
-  const r = spawnSync10("git", ["ls-remote", "--exit-code", url, "HEAD"], {
+  const r = spawnSync11("git", ["ls-remote", "--exit-code", url, "HEAD"], {
     encoding: "utf8",
     timeout: TIMEOUT_MS,
     stdio: ["ignore", "pipe", "pipe"]
@@ -1418,17 +1650,17 @@ var RemoteAccessAbortedError = class extends Error {
     this.name = "RemoteAccessAbortedError";
   }
 };
-function getCurrentGhUser() {
-  const r = spawnSync11("gh", ["api", "user", "--jq", ".login"], {
+function getCurrentGhUser2() {
+  const r = spawnSync12("gh", ["api", "user", "--jq", ".login"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
   if (r.status !== 0) return null;
   return r.stdout.trim() || null;
 }
-function triggerGhAuthLoginInteractive() {
+function triggerGhAuthLoginInteractive2() {
   log.info("M\u1EDF browser \u0111\u1EC3 switch GitHub account...");
-  const r = spawnSync11("gh", ["auth", "login", "--web"], { stdio: "inherit" });
+  const r = spawnSync12("gh", ["auth", "login", "--web"], { stdio: "inherit" });
   if (r.status !== 0) {
     log.warn(`gh auth login exit ${r.status}. B\u1EA1n c\xF3 th\u1EC3 ch\u1EA1y tay r\u1ED3i quay l\u1EA1i retry.`);
   }
@@ -1451,12 +1683,12 @@ async function handleRemoteAccessFailureWithAccountSwitch(args) {
   let reason = args.initialReason;
   let detail = args.initialDetail;
   while (true) {
-    const ghUser = getCurrentGhUser();
+    const ghUser = getCurrentGhUser2();
     log.warn(`Kh\xF4ng truy c\u1EADp \u0111\u01B0\u1EE3c ${args.url}`);
     log.dim(`  L\xFD do: ${reason}${detail ? ` \u2014 ${detail.slice(0, 150)}` : ""}`);
     log.info(getReasonHint(reason, args.url, ghUser));
     if (ghUser) log.dim(`  gh CLI hi\u1EC7n \u0111ang login: ${ghUser}`);
-    const action = await select3({
+    const action = await select5({
       message: "C\xE1ch x\u1EED l\xFD?",
       choices: [
         {
@@ -1479,7 +1711,7 @@ async function handleRemoteAccessFailureWithAccountSwitch(args) {
       );
     }
     if (action === "switch") {
-      triggerGhAuthLoginInteractive();
+      triggerGhAuthLoginInteractive2();
     }
     log.info("Verify remote l\u1EA1i...");
     const result = tryVerifyGitRemoteAccessible(args.url);
@@ -1493,7 +1725,7 @@ async function handleRemoteAccessFailureWithAccountSwitch(args) {
 }
 
 // src/lib/install-gh-cli-via-package-manager.ts
-import { spawnSync as spawnSync12 } from "child_process";
+import { spawnSync as spawnSync13 } from "child_process";
 var INSTALL_COMMANDS = {
   brew: { cmd: "brew", args: ["install", "gh"] },
   apt: { cmd: "sudo", args: ["apt-get", "install", "-y", "gh"] },
@@ -1504,7 +1736,7 @@ var INSTALL_COMMANDS = {
 function installGhCliViaPackageManager(pm) {
   const spec = INSTALL_COMMANDS[pm];
   log.info(`\u0110ang c\xE0i gh CLI qua ${pm}...`);
-  const r = spawnSync12(spec.cmd, spec.args, { stdio: "inherit" });
+  const r = spawnSync13(spec.cmd, spec.args, { stdio: "inherit" });
   if (r.status !== 0) {
     throw new Error(`C\xE0i gh CLI th\u1EA5t b\u1EA1i qua ${pm} (exit ${r.status}). C\xE0i tay r\u1ED3i ch\u1EA1y l\u1EA1i.`);
   }
@@ -1512,9 +1744,9 @@ function installGhCliViaPackageManager(pm) {
 }
 
 // src/lib/setup-git-credential-via-gh.ts
-import { spawnSync as spawnSync13 } from "child_process";
+import { spawnSync as spawnSync14 } from "child_process";
 function setupGitCredentialViaGh() {
-  const r = spawnSync13("gh", ["auth", "setup-git"], { stdio: "ignore" });
+  const r = spawnSync14("gh", ["auth", "setup-git"], { stdio: "ignore" });
   if (r.status !== 0) {
     log.warn("gh auth setup-git fail (non-fatal). N\u1EBFu git clone l\u1ED7i 128 \u2192 ch\u1EA1y th\u1EE7 c\xF4ng.");
     return;
@@ -1523,10 +1755,10 @@ function setupGitCredentialViaGh() {
 }
 
 // src/lib/trigger-gh-cli-auth-login.ts
-import { spawnSync as spawnSync14 } from "child_process";
+import { spawnSync as spawnSync15 } from "child_process";
 function triggerGhCliAuthLogin() {
   log.info("Kh\u1EDFi \u0111\u1ED9ng \u0111\u0103ng nh\u1EADp GitHub qua gh CLI (browser s\u1EBD m\u1EDF)...");
-  const r = spawnSync14(
+  const r = spawnSync15(
     "gh",
     ["auth", "login", "--hostname", "github.com", "--web", "--git-protocol", "ssh"],
     { stdio: "inherit" }
@@ -1539,24 +1771,61 @@ function triggerGhCliAuthLogin() {
 
 // src/lib/git-auth-and-install-orchestrator.ts
 async function ensureGitHubReady(remoteUrl) {
-  let state = checkGhCliAuthStatus();
-  if (state === "not-installed") {
+  while (checkGhCliAuthStatus() === "not-installed") {
     log.warn("gh CLI ch\u01B0a c\xE0i. Avatar s\u1EBD t\u1EF1 c\xE0i.");
     const pm = detectPackageManager();
     if (!pm) {
-      throw new Error(
-        "Kh\xF4ng ph\xE1t hi\u1EC7n package manager (brew/apt/dnf/pacman/winget). C\xE0i gh CLI tay r\u1ED3i ch\u1EA1y l\u1EA1i: https://cli.github.com"
-      );
+      const action = await promptRetryOrSkip({
+        taskName: "Ph\xE1t hi\u1EC7n package manager",
+        reason: "Kh\xF4ng t\xECm th\u1EA5y brew/apt/dnf/pacman/winget tr\xEAn m\xE1y.",
+        allowSkip: false,
+        hint: "C\xE0i gh CLI tay (https://cli.github.com) r\u1ED3i ch\u1ECDn Retry."
+      });
+      if (action === "abort") {
+        throw new UserAbortedRecoveryError("User abort t\u1EA1i b\u01B0\u1EDBc c\xE0i gh CLI.");
+      }
+      continue;
+    }
+    try {
+      installGhCliViaPackageManager(pm);
+    } catch (err) {
+      const action = await promptRetryOrSkip({
+        taskName: `C\xE0i gh CLI qua ${pm}`,
+        reason: err.message,
+        allowSkip: false,
+        hint: "C\xE0i tay (https://cli.github.com) r\u1ED3i ch\u1ECDn Retry, ho\u1EB7c Abort."
+      });
+      if (action === "abort") {
+        throw new UserAbortedRecoveryError("User abort t\u1EA1i b\u01B0\u1EDBc c\xE0i gh CLI.");
+      }
     }
-    installGhCliViaPackageManager(pm);
-    state = checkGhCliAuthStatus();
   }
-  if (state === "not-authenticated") {
+  while (checkGhCliAuthStatus() === "not-authenticated") {
     log.warn("Ch\u01B0a \u0111\u0103ng nh\u1EADp GitHub.");
-    triggerGhCliAuthLogin();
-    state = checkGhCliAuthStatus();
-    if (state !== "authenticated") {
-      throw new Error("Sau gh auth login v\u1EABn ch\u01B0a authenticated. Th\u1EED l\u1EA1i.");
+    try {
+      triggerGhCliAuthLogin();
+    } catch (err) {
+      const action = await promptRetryOrSkip({
+        taskName: "\u0110\u0103ng nh\u1EADp GitHub qua gh",
+        reason: err.message,
+        allowSkip: false,
+        hint: "Th\u1EED l\u1EA1i \u2014 ch\u1ECDn c\xE1ch login kh\xE1c (browser vs token) khi gh prompt."
+      });
+      if (action === "abort") {
+        throw new UserAbortedRecoveryError("User abort t\u1EA1i b\u01B0\u1EDBc gh auth login.");
+      }
+      continue;
+    }
+    if (checkGhCliAuthStatus() !== "authenticated") {
+      const action = await promptRetryOrSkip({
+        taskName: "Verify gh auth",
+        reason: "Sau gh auth login v\u1EABn b\xE1o not-authenticated.",
+        allowSkip: false,
+        hint: "C\xF3 th\u1EC3 user cancel browser. Th\u1EED l\u1EA1i ho\u1EB7c abort."
+      });
+      if (action === "abort") {
+        throw new UserAbortedRecoveryError("User abort t\u1EA1i b\u01B0\u1EDBc verify gh auth.");
+      }
     }
   }
   log.success("gh CLI s\u1EB5n s\xE0ng");
@@ -1578,13 +1847,13 @@ async function ensureGitHubReady(remoteUrl) {
 // src/lib/create-workspace-remote-via-gh.ts
 function canCreateInNamespace(org, ghUser) {
   if (org.toLowerCase() === ghUser.toLowerCase()) return { ok: true };
-  const r = spawnSync15("gh", ["api", `orgs/${org}/members/${ghUser}`, "--silent"], {
+  const r = spawnSync16("gh", ["api", `orgs/${org}/members/${ghUser}`, "--silent"], {
     stdio: "ignore"
   });
   if (r.status === 0) return { ok: true };
-  const orgCheck = spawnSync15("gh", ["api", `orgs/${org}`, "--silent"], { stdio: "ignore" });
+  const orgCheck = spawnSync16("gh", ["api", `orgs/${org}`, "--silent"], { stdio: "ignore" });
   if (orgCheck.status !== 0) {
-    const userCheck = spawnSync15("gh", ["api", `users/${org}`, "--silent"], { stdio: "ignore" });
+    const userCheck = spawnSync16("gh", ["api", `users/${org}`, "--silent"], { stdio: "ignore" });
     if (userCheck.status === 0) {
       return {
         ok: false,
@@ -1601,27 +1870,27 @@ function canCreateInNamespace(org, ghUser) {
     reason: `'${ghUser}' kh\xF4ng ph\u1EA3i member c\u1EE7a org '${org}'. Li\xEAn h\u1EC7 admin org \u0111\u1EC3 \u0111\u01B0\u1EE3c invite, ho\u1EB7c pass --repo-org=${ghUser} t\u1EA1o d\u01B0\u1EDBi personal account.`
   };
 }
-async function createWorkspaceRemoteViaGh(input3) {
-  validateRepoName(input3.workspaceName);
-  validateRepoVisibility(input3.visibility);
+async function createWorkspaceRemoteViaGh(input4) {
+  validateRepoName(input4.workspaceName);
+  validateRepoVisibility(input4.visibility);
   await ensureGitHubReady();
   const ghUser = resolveGithubUsernameDefault();
-  const org = input3.org ?? ghUser;
+  const org = input4.org ?? ghUser;
   const namespaceCheck = canCreateInNamespace(org, ghUser);
   if (!namespaceCheck.ok) {
     throw new Error(`Kh\xF4ng th\u1EC3 t\u1EA1o repo d\u01B0\u1EDBi '${org}/': ${namespaceCheck.reason}`);
   }
-  const fullName = `${org}/${input3.workspaceName}`;
-  log.info(`T\u1EA1o GitHub repo cho workspace: ${fullName} (${input3.visibility})...`);
-  const r = spawnSync15(
+  const fullName = `${org}/${input4.workspaceName}`;
+  log.info(`T\u1EA1o GitHub repo cho workspace: ${fullName} (${input4.visibility})...`);
+  const r = spawnSync16(
     "gh",
     [
       "repo",
       "create",
       fullName,
-      `--${input3.visibility}`,
+      `--${input4.visibility}`,
       "--source",
-      input3.workspacePath,
+      input4.workspacePath,
       "--remote",
       "origin",
       "--push"
@@ -1633,7 +1902,7 @@ async function createWorkspaceRemoteViaGh(input3) {
     if (stderr) process.stderr.write(`${stderr}
 `);
     throw new Error(
-      `T\u1EA1o workspace remote th\u1EA5t b\u1EA1i (exit ${r.status}). Workspace v\u1EABn d\xF9ng \u0111\u01B0\u1EE3c local. Setup remote sau qua: gh repo create ${fullName} --${input3.visibility} --source=. --remote=origin --push`
+      `T\u1EA1o workspace remote th\u1EA5t b\u1EA1i (exit ${r.status}). Workspace v\u1EABn d\xF9ng \u0111\u01B0\u1EE3c local. Setup remote sau qua: gh repo create ${fullName} --${input4.visibility} --source=. --remote=origin --push`
     );
   }
   const sshUrl = `git@github.com:${fullName}.git`;
@@ -1644,14 +1913,14 @@ async function createWorkspaceRemoteViaGh(input3) {
 
 // src/lib/safe-bootstrap-for-dirty-folder.ts
 import { readdirSync } from "fs";
-import { select as select4 } from "@inquirer/prompts";
+import { select as select6 } from "@inquirer/prompts";
 import { simpleGit as simpleGit3 } from "simple-git";
 
 // src/lib/check-folder-has-git.ts
 import { existsSync as existsSync2, statSync } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 function checkFolderHasGit(folderPath) {
-  const gitPath = join10(folderPath, ".git");
+  const gitPath = join11(folderPath, ".git");
   if (!existsSync2(gitPath)) return false;
   const stat = statSync(gitPath);
   return stat.isDirectory() || stat.isFile();
@@ -1683,7 +1952,7 @@ async function createInitialGitCommit(folderPath) {
 
 // src/lib/detect-folder-tech-stack.ts
 import { existsSync as existsSync3 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 var SIGNATURES = {
   node: ["package.json"],
   python: ["pyproject.toml", "requirements.txt", "setup.py", "Pipfile"],
@@ -1695,7 +1964,7 @@ var SIGNATURES = {
 function detectFolderTechStack(folderPath) {
   const matched = [];
   for (const [stack, files] of Object.entries(SIGNATURES)) {
-    if (files.some((f) => existsSync3(join11(folderPath, f)))) {
+    if (files.some((f) => existsSync3(join12(folderPath, f)))) {
       matched.push(stack);
     }
   }
@@ -1704,19 +1973,19 @@ function detectFolderTechStack(folderPath) {
 
 // src/lib/gitignore-template-loader.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname3, join as join12 } from "path";
+import { dirname as dirname3, join as join13 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var __dirname = dirname3(fileURLToPath2(import.meta.url));
 var CANDIDATE_DIRS = [
-  join12(__dirname, "..", "templates", "gitignore"),
-  join12(__dirname, "..", "..", "src", "templates", "gitignore")
+  join13(__dirname, "..", "templates", "gitignore"),
+  join13(__dirname, "..", "..", "src", "templates", "gitignore")
 ];
 var AVATAR_MARKER_START = "# === avatar ===";
 var AVATAR_MARKER_END = "# === /avatar ===";
 function readTemplate(stack) {
   for (const dir of CANDIDATE_DIRS) {
     try {
-      return readFileSync2(join12(dir, `${stack}.txt`), "utf8");
+      return readFileSync2(join13(dir, `${stack}.txt`), "utf8");
     } catch {
     }
   }
@@ -1731,9 +2000,9 @@ ${readTemplate(s).trim()}`);
 
 // src/lib/write-or-merge-gitignore.ts
 import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 function writeOrMergeGitignore(folderPath, avatarBlock) {
-  const path = join13(folderPath, ".gitignore");
+  const path = join14(folderPath, ".gitignore");
   if (!existsSync4(path)) {
     writeFileSync(path, avatarBlock, "utf8");
     return;
@@ -1775,7 +2044,7 @@ async function promptBootstrapStrategy(state, opts) {
   if (opts.presetStrategy) return opts.presetStrategy;
   if (opts.autoYes) return "stash";
   if (state === "empty" || state === "clean") return "commit-all";
-  return await select4({
+  return await select6({
     message: state === "dirty" ? "Folder c\xF3 changes ch\u01B0a commit. C\xE1ch x\u1EED l\xFD:" : "Folder c\xF3 file ch\u01B0a version. C\xE1ch x\u1EED l\xFD:",
     choices: [
       {
@@ -1908,145 +2177,6 @@ async function safeBootstrapGitInFolder(folderPath, opts = {}) {
   await appendAuditEntry("bootstrap", `state=${state},strategy=${strategy}`);
 }
 
-// src/lib/team-pack-submodule-manager.ts
-import { join as join14 } from "path";
-
-// src/lib/check-team-pack-access-with-retry-loop.ts
-import { spawnSync as spawnSync16 } from "child_process";
-import { confirm as confirm2, select as select5 } from "@inquirer/prompts";
-function parseRepoSlugFromGitUrl(url) {
-  const httpsMatch = url.match(/github\.com[/:]([^/]+\/[^/]+?)(?:\.git)?$/);
-  if (httpsMatch) return httpsMatch[1];
-  return null;
-}
-function checkRepoAccess(repoSlug) {
-  const r = spawnSync16("gh", ["api", `repos/${repoSlug}`], { stdio: "ignore" });
-  return r.status === 0;
-}
-function getCurrentGhUser2() {
-  const r = spawnSync16("gh", ["api", "user", "--jq", ".login"], {
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  if (r.status !== 0) return null;
-  return r.stdout.trim() || null;
-}
-async function copyInfoToClipboardWithConsent(info) {
-  const ok = await confirm2({
-    message: "Copy th\xF4ng tin (GitHub username + email) v\xE0o clipboard \u0111\u1EC3 d\xE1n v\xE0o Slack/email?",
-    default: true
-  });
-  if (!ok) return;
-  try {
-    const { default: clipboardy } = await import("clipboardy");
-    await clipboardy.write(info);
-    log.success("\u0110\xE3 copy v\xE0o clipboard");
-  } catch (err) {
-    log.dim(`Copy clipboard fail: ${err.message}`);
-  }
-}
-function buildAccessRequestInfo(ghUser, ssoEmail) {
-  const lines = [
-    "Request access team-ai-pack (NAL)",
-    "",
-    `GitHub username: ${ghUser ?? "(ch\u01B0a gh auth \u2014 ch\u1EA1y: gh auth login)"}`,
-    `NAL email:       ${ssoEmail ?? "(ch\u01B0a avatar login \u2014 ch\u1EA1y: avatar login)"}`,
-    `Date:            ${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}`
-  ];
-  return lines.join("\n");
-}
-async function ensureTeamPackAccessWithRetry(args) {
-  if (checkRepoAccess(args.repoSlug)) return true;
-  const ghUser = getCurrentGhUser2();
-  const info = buildAccessRequestInfo(ghUser, args.ssoEmail ?? null);
-  log.warn(`B\u1EA1n ch\u01B0a c\xF3 quy\u1EC1n access v\xE0o b\u1ED9 package ${args.repoSlug}.`);
-  log.info("Li\xEAn h\u1EC7 admin (Luke @nal.vn) \u0111\u1EC3 \u0111\u01B0\u1EE3c add v\xE0o org nalvn.");
-  log.plain("");
-  log.plain(info);
-  log.plain("");
-  await copyInfoToClipboardWithConsent(info);
-  while (true) {
-    const action = await select5({
-      message: "Ti\u1EBFp t\u1EE5c?",
-      choices: [
-        { name: "\u0110\xE3 \u0111\u01B0\u1EE3c add \u2014 ki\u1EC3m tra l\u1EA1i v\xE0 ti\u1EBFp t\u1EE5c", value: "retry" },
-        { name: "T\u1EA1m ng\u01B0ng \u2014 ch\u1EA1y l\u1EA1i 'avatar init' sau", value: "abort" }
-      ]
-    });
-    if (action === "abort") {
-      log.dim("T\u1EA1m ng\u01B0ng. Ch\u1EA1y l\u1EA1i 'avatar init' sau khi \u0111\xE3 accept invite t\u1EEB GitHub.");
-      return false;
-    }
-    log.info("Ki\u1EC3m tra access...");
-    if (checkRepoAccess(args.repoSlug)) {
-      log.success("\u0110\xE3 c\xF3 access \u2014 ti\u1EBFp t\u1EE5c.");
-      return true;
-    }
-    log.warn("V\u1EABn ch\u01B0a c\xF3 access. \u0110\u1EA3m b\u1EA3o b\u1EA1n \u0111\xE3 accept email invite t\u1EEB GitHub (Inbox + Spam).");
-  }
-}
-
-// src/lib/resolve-team-pack-repo-url.ts
-var ORG_DEFAULT = "https://github.com/nalvn/team-ai-pack.git";
-function resolveTeamPackRepoUrl() {
-  if (process.env.AVATAR_TEAM_PACK_REPO_URL) {
-    return process.env.AVATAR_TEAM_PACK_REPO_URL;
-  }
-  return ORG_DEFAULT;
-}
-
-// src/lib/team-pack-submodule-manager.ts
-var TEAM_PACK_REPO_URL = resolveTeamPackRepoUrl();
-var TEAM_PACK_RELATIVE_PATH = ".claude/pack";
-var TeamPackAccessAbortedError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "TeamPackAccessAbortedError";
-  }
-};
-async function addTeamPackSubmodule(projectRoot, tag, ssoEmail) {
-  const url = resolveTeamPackRepoUrl();
-  const repoSlug = parseRepoSlugFromGitUrl(url);
-  if (repoSlug) {
-    const hasAccess = await ensureTeamPackAccessWithRetry({ repoSlug, ssoEmail });
-    if (!hasAccess) {
-      throw new TeamPackAccessAbortedError(
-        "User ch\u1ECDn t\u1EA1m ng\u01B0ng. Ch\u1EA1y l\u1EA1i 'avatar init' sau khi \u0111\u01B0\u1EE3c add v\xE0o org."
-      );
-    }
-  }
-  try {
-    await addSubmodule(url, TEAM_PACK_RELATIVE_PATH, projectRoot);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (msg.includes("Repository not found") || msg.includes("not found")) {
-      log.error(
-        `Repo team-ai-pack kh\xF4ng t\u1ED3n t\u1EA1i: ${url}
-  C\xE1ch fix:
-    1. T\u1EA1o repo: gh repo create <owner>/team-ai-pack --private --add-readme
-    2. Ho\u1EB7c override URL: export AVATAR_TEAM_PACK_REPO_URL=<url-repo-c\u1EE7a-b\u1EA1n>
-    3. Ho\u1EB7c d\xF9ng flag --skip-team-pack`
-      );
-    }
-    throw err;
-  }
-  let target = tag ?? null;
-  if (!target) {
-    target = await latestTag(join14(projectRoot, TEAM_PACK_RELATIVE_PATH));
-  }
-  if (target) {
-    await checkoutTagInSubmodule(TEAM_PACK_RELATIVE_PATH, target, projectRoot);
-  }
-  return { pinnedTag: target };
-}
-async function readPinnedPackVersion(projectRoot) {
-  const submoduleRoot = join14(projectRoot, TEAM_PACK_RELATIVE_PATH);
-  const tag = await latestTag(submoduleRoot);
-  if (tag) return tag;
-  const sha = await currentCommitSha(submoduleRoot);
-  return sha.slice(0, 7);
-}
-
 // src/commands/init-conflict-detection-helpers.ts
 import { readdir } from "fs/promises";
 import { join as join15 } from "path";
@@ -2088,7 +2218,7 @@ function buildScaffoldVariables(args) {
 }
 
 // src/commands/login.ts
-import boxen2 from "boxen";
+import boxen3 from "boxen";
 import open from "open";
 
 // src/lib/google-oauth-device-flow.ts
@@ -2235,7 +2365,7 @@ async function runLogin(opts) {
     "",
     `Ho\u1EB7c Avatar t\u1EF1 m\u1EDF browser, click ${chalk.green("Allow")}...`
   ].join("\n");
-  process.stdout.write(`${boxen2(instructions, { padding: 1, borderStyle: "round" })}
+  process.stdout.write(`${boxen3(instructions, { padding: 1, borderStyle: "round" })}
 `);
   void open(verificationUrl).catch(() => {
     log.dim("(Kh\xF4ng m\u1EDF \u0111\u01B0\u1EE3c browser t\u1EF1 \u0111\u1ED9ng \u2014 copy URL \u1EDF tr\xEAn)");
@@ -2309,6 +2439,10 @@ function registerInitCommand(program2) {
         log.dim(err.message);
         process.exit(0);
       }
+      if (err instanceof UserAbortedRecoveryError) {
+        log.dim(err.message);
+        process.exit(0);
+      }
       log.error(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
@@ -2320,13 +2454,26 @@ async function runInit(opts) {
     log.warn("Flag --mode \u0111\xE3 deprecated t\u1EEB v1.1. D\xF9ng --project-status thay th\u1EBF.");
   }
   let userConfig = await readUserConfig();
-  if (!userConfig || isTokenExpired(userConfig)) {
+  while (!userConfig || isTokenExpired(userConfig)) {
     log.info("Ch\u01B0a \u0111\u0103ng nh\u1EADp \u2014 ch\u1EA1y login flow tr\u01B0\u1EDBc khi init...");
-    await runLogin({});
+    try {
+      await runLogin({});
+    } catch (err) {
+      log.warn(`Login fail: ${err.message}`);
+    }
     userConfig = await readUserConfig();
-    if (!userConfig || isTokenExpired(userConfig)) {
-      log.error("Login kh\xF4ng ho\xE0n t\u1EA5t. Ch\u1EA1y 'avatar login' tay r\u1ED3i init l\u1EA1i.");
-      process.exit(1);
+    if (userConfig && !isTokenExpired(userConfig)) break;
+    const action = await promptRetryOrSkip({
+      taskName: "\u0110\u0103ng nh\u1EADp SSO Google",
+      reason: "Token ch\u01B0a \u0111\u01B0\u1EE3c t\u1EA1o ho\u1EB7c \u0111\xE3 h\u1EBFt h\u1EA1n.",
+      allowSkip: false,
+      // Login bắt buộc, không skip được.
+      hint: "\u0110\u1EA3m b\u1EA3o b\u1EA1n ch\u1ECDn 'Allow' tr\xEAn browser v\xE0 d\xF9ng email @nal.vn."
+    });
+    if (action === "abort") {
+      throw new UserAbortedRecoveryError(
+        "User abort t\u1EA1i b\u01B0\u1EDBc login. Ch\u1EA1y 'avatar login' tay r\u1ED3i 'avatar init' l\u1EA1i."
+      );
     }
   }
   const status = opts.projectStatus ?? await promptProjectStatus();
@@ -2343,7 +2490,7 @@ async function runInit(opts) {
   }
 }
 async function promptProjectStatus() {
-  return await select6({
+  return await select7({
     message: "T\xECnh tr\u1EA1ng d\u1EF1 \xE1n c\u1EE7a b\u1EA1n?",
     choices: [
       { name: "1. \u0110\xE3 c\xF3 repo git remote (URL c\xF3 s\u1EB5n)", value: "existing-remote" },
@@ -2353,14 +2500,14 @@ async function promptProjectStatus() {
   });
 }
 async function runInitFromExistingRemote(opts, ownerEmail) {
-  const remoteUrl = opts.clientRepo ?? await input2({
+  const remoteUrl = opts.clientRepo ?? await input3({
     message: "URL git c\u1EE7a repo:",
     validate: (v) => v.length > 0 ? true : "URL b\u1EAFt bu\u1ED9c"
   });
   await ensureGitHubReady(remoteUrl);
   const teamOwner = opts.teamOwner ?? await promptTeamOwner(ownerEmail);
   const inferredName = inferWorkspaceName(remoteUrl);
-  const workspaceName = opts.workspaceName ?? await input2({ message: "T\xEAn workspace:", default: inferredName });
+  const workspaceName = opts.workspaceName ?? await input3({ message: "T\xEAn workspace:", default: inferredName });
   const workspaceParent = resolve(opts.workspaceParent ?? ".");
   const workspacePath = await resolveWorkspacePath(workspaceParent, workspaceName, opts.force);
   await scaffoldWorkspaceWithSrcSubmodule({
@@ -2377,12 +2524,13 @@ async function runInitFromExistingRemote(opts, ownerEmail) {
     repoVisibility: opts.repoVisibility,
     repoOrg: opts.repoOrg,
     flow: "existing-remote",
-    aiSkip: opts.aiSkip
+    aiSkip: opts.aiSkip,
+    ssoEmail: ownerEmail
   });
 }
 async function runInitFromExistingFolder(opts, ownerEmail) {
   const folderPath = resolve(
-    opts.folderPath ?? await input2({
+    opts.folderPath ?? await input3({
       message: "\u0110\u01B0\u1EDDng d\u1EABn folder hi\u1EC7n c\xF3:",
       validate: (v) => v.length > 0 ? true : "Path b\u1EAFt bu\u1ED9c"
     })
@@ -2394,7 +2542,7 @@ async function runInitFromExistingFolder(opts, ownerEmail) {
   const remoteUrl = await getOrCreateOriginRemote(folderPath, opts);
   const teamOwner = opts.teamOwner ?? await promptTeamOwner(ownerEmail);
   const inferredName = opts.workspaceName ?? `${basename(folderPath)}-avatar-workspace`;
-  const workspaceName = opts.workspaceName ?? await input2({ message: "T\xEAn workspace:", default: inferredName });
+  const workspaceName = opts.workspaceName ?? await input3({ message: "T\xEAn workspace:", default: inferredName });
   const workspaceParent = resolve(opts.workspaceParent ?? ".");
   const workspacePath = await resolveWorkspacePath(workspaceParent, workspaceName, opts.force);
   await scaffoldWorkspaceWithSrcSubmodule({
@@ -2412,16 +2560,17 @@ async function runInitFromExistingFolder(opts, ownerEmail) {
     repoVisibility: opts.repoVisibility,
     repoOrg: opts.repoOrg,
     flow: "existing-folder",
-    aiSkip: opts.aiSkip
+    aiSkip: opts.aiSkip,
+    ssoEmail: ownerEmail
   });
 }
 async function runInitFromScratch(opts, ownerEmail) {
   await ensureGitHubReady();
-  const projectName = opts.workspaceName ?? await input2({
+  const projectName = opts.workspaceName ?? await input3({
     message: "T\xEAn d\u1EF1 \xE1n:",
     validate: (v) => v.length > 0 ? true : "T\xEAn b\u1EAFt bu\u1ED9c"
   });
-  const visibility = opts.repoVisibility ?? await select6({
+  const visibility = opts.repoVisibility ?? await select7({
     message: "Visibility?",
     choices: [
       { name: "private (m\u1EB7c \u0111\u1ECBnh)", value: "private" },
@@ -2449,7 +2598,12 @@ async function runInitFromScratch(opts, ownerEmail) {
     await git(workspacePath).subModule(["add", urls.sshUrl, "src"]);
     let pinnedTag = "HEAD";
     if (!opts.skipTeamPack) {
-      const result = await addTeamPackSubmodule(workspacePath, opts.packVersion);
+      sp.stop();
+      const result = await addTeamPackSubmoduleWithRetryOnNetworkFail(
+        workspacePath,
+        opts.packVersion,
+        ownerEmail
+      );
       pinnedTag = result.pinnedTag ?? "HEAD";
       sp.succeed(`Pin team-ai-pack v\xE0o ${pinnedTag}`);
     } else {
@@ -2490,14 +2644,14 @@ async function getOrCreateOriginRemote(folderPath, opts) {
     return void 0;
   }
   await ensureGitHubReady();
-  const visibility = opts.repoVisibility ?? await select6({
+  const visibility = opts.repoVisibility ?? await select7({
     message: "Visibility?",
     choices: [
       { name: "private (m\u1EB7c \u0111\u1ECBnh)", value: "private" },
       { name: "public", value: "public" }
     ]
   });
-  const repoName = await input2({
+  const repoName = await input3({
     message: "T\xEAn repo:",
     default: basename(folderPath)
   });
@@ -2519,7 +2673,12 @@ async function scaffoldWorkspaceWithSrcSubmodule(args) {
     await git(args.workspacePath).subModule(["add", args.srcRemoteUrl, "src"]);
     let pinnedTag = "HEAD";
     if (!args.skipTeamPack) {
-      const result = await addTeamPackSubmodule(args.workspacePath, args.packVersion);
+      sp.stop();
+      const result = await addTeamPackSubmoduleWithRetryOnNetworkFail(
+        args.workspacePath,
+        args.packVersion,
+        args.ssoEmail
+      );
       pinnedTag = result.pinnedTag ?? "HEAD";
       sp.succeed(`Pin team-ai-pack v\xE0o ${pinnedTag}`);
     } else {
@@ -2587,43 +2746,79 @@ async function maybeCreateWorkspaceRemote(args) {
     });
   }
   if (!shouldCreate) return;
-  const visibility = args.repoVisibility ?? (args.autoYes ? "private" : await select6({
+  const visibility = args.repoVisibility ?? (args.autoYes ? "private" : await select7({
     message: "Workspace visibility?",
     choices: [
       { name: "private (m\u1EB7c \u0111\u1ECBnh, an to\xE0n)", value: "private" },
       { name: "public", value: "public" }
     ]
   }));
-  try {
-    await createWorkspaceRemoteViaGh({
-      workspacePath: args.workspacePath,
-      workspaceName: args.workspaceName,
-      visibility,
-      org: args.repoOrg
-    });
-  } catch (err) {
-    log.warn(err instanceof Error ? err.message : String(err));
-    log.warn("Workspace v\u1EABn s\u1EB5n s\xE0ng local-only. Setup remote sau khi c\u1EA7n.");
+  while (true) {
+    try {
+      await createWorkspaceRemoteViaGh({
+        workspacePath: args.workspacePath,
+        workspaceName: args.workspaceName,
+        visibility,
+        org: args.repoOrg
+      });
+      return;
+    } catch (err) {
+      const action = await promptRetryOrSkip({
+        taskName: "T\u1EA1o workspace remote tr\xEAn GitHub",
+        reason: err instanceof Error ? err.message : String(err),
+        allowSkip: true,
+        // Workspace remote OPTIONAL — skip OK, workspace local vẫn dùng được.
+        hint: "Tip: sai org? Pass --repo-org=<your-gh-user>. Ho\u1EB7c switch gh: gh auth login."
+      });
+      if (action === "abort") {
+        throw new UserAbortedRecoveryError("User abort t\u1EA1i b\u01B0\u1EDBc t\u1EA1o workspace remote.");
+      }
+      if (action === "skip") {
+        log.warn("Workspace v\u1EABn s\u1EB5n s\xE0ng local-only. Setup remote sau khi c\u1EA7n.");
+        return;
+      }
+    }
   }
 }
 async function resolveWorkspacePath(parent, desiredName, force) {
   const desired = join16(parent, desiredName);
   if (await isEmptyOrMissing(desired)) return desired;
-  const alternative = await findAlternativeWorkspaceName(parent, desiredName);
-  if (!alternative) {
-    throw new Error(`Kh\xF4ng t\xECm \u0111\u01B0\u1EE3c workspace path kh\u1EA3 d\u1EE5ng trong ${parent}`);
-  }
   log.warn(`Workspace path "${desired}" \u0111\xE3 c\xF3 n\u1ED9i dung.`);
-  if (force) {
-    log.info(`--force: d\xF9ng ${alternative}`);
-    return alternative;
+  while (true) {
+    const alternative = await findAlternativeWorkspaceName(parent, desiredName);
+    if (force && alternative) {
+      log.info(`--force: d\xF9ng ${alternative}`);
+      return alternative;
+    }
+    const choices = [];
+    if (alternative) {
+      choices.push({ name: `D\xF9ng "${alternative}" (suggest)`, value: "use-alt" });
+    }
+    choices.push({ name: "Nh\u1EADp t\xEAn workspace kh\xE1c (manual)", value: "manual" });
+    choices.push({ name: "T\u1EA1m ng\u01B0ng init", value: "abort" });
+    const action = await select7({
+      message: "C\xE1ch x\u1EED l\xFD workspace path conflict?",
+      choices
+    });
+    if (action === "abort") {
+      throw new UserAbortedRecoveryError(
+        "User abort t\u1EA1i b\u01B0\u1EDBc resolve workspace path. Ch\u1EA1y l\u1EA1i v\u1EDBi --workspace-name kh\xE1c."
+      );
+    }
+    if (action === "use-alt" && alternative) {
+      return alternative;
+    }
+    const newName = await input3({
+      message: "T\xEAn workspace m\u1EDBi:",
+      validate: (v) => v.trim().length > 0 ? true : "T\xEAn kh\xF4ng \u0111\u01B0\u1EE3c r\u1ED7ng"
+    });
+    const newPath = join16(parent, newName.trim());
+    if (await isEmptyOrMissing(newPath)) return newPath;
+    log.warn(`"${newPath}" c\u0169ng \u0111\xE3 c\xF3 n\u1ED9i dung. Th\u1EED t\xEAn kh\xE1c.`);
   }
-  const useAlt = await confirm3({ message: `D\xF9ng "${alternative}" thay th\u1EBF?`, default: true });
-  if (!useAlt) throw new Error("H\u1EE7y init. Ch\u1EA1y l\u1EA1i v\u1EDBi --workspace-name kh\xE1c.");
-  return alternative;
 }
 async function promptTeamOwner(currentUserEmail) {
-  return await input2({ message: "Team owner email:", default: currentUserEmail });
+  return await input3({ message: "Team owner email:", default: currentUserEmail });
 }
 async function maybeCommitWorkspace(workspacePath, skipCommit) {
   if (skipCommit) {
@@ -2659,7 +2854,7 @@ function printInitSuccessBox(rootPath, flow, aiResult = null) {
     `  ${chalk.cyan("avatar sync")}               Pull team-ai-pack m\u1EDBi`,
     `  ${chalk.cyan("avatar uninstall")}          G\u1EE1 Avatar (gi\u1EEF code)`
   ];
-  process.stdout.write(`${boxen3(lines.join("\n"), { padding: 1, borderStyle: "round" })}
+  process.stdout.write(`${boxen4(lines.join("\n"), { padding: 1, borderStyle: "round" })}
 `);
 }
 
@@ -2696,7 +2891,7 @@ function registerSecretsCommand(program2) {
 // src/commands/status.ts
 import { promises as fs8 } from "fs";
 import { join as join18 } from "path";
-import boxen4 from "boxen";
+import boxen5 from "boxen";
 
 // src/lib/pack-backup-manager.ts
 import { promises as fs7 } from "fs";
@@ -2774,7 +2969,7 @@ function renderStatusBox(s) {
     `${chalk.dim("Backups:")}            ${s.backupCount}`,
     `${chalk.dim("Tech stack:")}         ${s.techStackSummary}`
   ];
-  process.stdout.write(`${boxen4(lines.join("\n"), { padding: 1, borderStyle: "round" })}
+  process.stdout.write(`${boxen5(lines.join("\n"), { padding: 1, borderStyle: "round" })}
 `);
 }
 
@@ -2794,7 +2989,7 @@ function registerToolsCommand(program2) {
 // src/commands/uninstall.ts
 import { relative as relative3 } from "path";
 import { confirm as confirm4 } from "@inquirer/prompts";
-import boxen5 from "boxen";
+import boxen6 from "boxen";
 
 // src/lib/create-uninstall-backup-snapshot.ts
 import { cp, mkdir, writeFile } from "fs/promises";
@@ -2948,7 +3143,7 @@ async function removeSubmoduleEntry(gitmodulesPath, submodulePath) {
 }
 
 // src/commands/uninstall.ts
-var CLI_VERSION = "1.2.4";
+var CLI_VERSION = "1.2.6";
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("G\u1EE1 Avatar kh\u1ECFi project \u2014 backup t\u1EF1 \u0111\u1ED9ng (M11)").option("--yes", "Skip confirm prompt").option("--no-backup", "Kh\xF4ng t\u1EA1o backup tr\u01B0\u1EDBc khi x\xF3a (nguy hi\u1EC3m)").option("--keep-submodule", "Gi\u1EEF submodule .claude/pack/").option("--keep-hooks", "Gi\u1EEF git hooks post-merge, pre-push").option("--dry-run", "Hi\u1EC3n th\u1ECB danh s\xE1ch s\u1EBD x\xF3a, kh\xF4ng th\u1EF1c thi").action(async (opts) => {
     try {
@@ -3025,12 +3220,12 @@ function printUninstallSuccessBox(backupPath) {
     lines.push(`  ${chalk.dim("Backup:")} ${backupPath}`);
     lines.push(`  ${chalk.dim("Restore:")} ${chalk.cyan(`cp -r "${backupPath}"/* .`)}`);
   }
-  process.stdout.write(`${boxen5(lines.join("\n"), { padding: 1, borderStyle: "round" })}
+  process.stdout.write(`${boxen6(lines.join("\n"), { padding: 1, borderStyle: "round" })}
 `);
 }
 
 // src/index.ts
-var CLI_VERSION2 = "1.2.4";
+var CLI_VERSION2 = "1.2.6";
 var program = new Command();
 program.name("avatar").description("AI harness CLI for NAL Vietnam engineering").version(CLI_VERSION2, "-v, --version", "Hi\u1EC3n th\u1ECB phi\xEAn b\u1EA3n Avatar CLI").addHelpText(
   "beforeAll",