@nalvietnam/avatar-cli 1.2.5 → 1.2.7

package/dist/index.js

@@ -546,19 +546,19 @@ function applyUseGlobal(existing, source) {
     ...sourceModel ? { model: sourceModel } : {}
   };
 }
-async function writeClaudeSettings(workspacePath, input4) {
+async function writeClaudeSettings(workspacePath, input5) {
   const path = getClaudeSettingsPath(workspacePath);
   const existing = await readExistingSettings(path);
   let merged;
-  switch (input4.provider) {
+  switch (input5.provider) {
     case "subscription":
-      merged = applySubscription(existing, input4.model);
+      merged = applySubscription(existing, input5.model);
       break;
     case "llmlite":
-      merged = applyLLMLite(existing, input4.apiKey, input4.baseUrl, input4.model);
+      merged = applyLLMLite(existing, input5.apiKey, input5.baseUrl, input5.model);
       break;
     case "use-global":
-      merged = applyUseGlobal(existing, input4.sourceSettings);
+      merged = applyUseGlobal(existing, input5.sourceSettings);
       break;
   }
   await writeJsonAtomic(path, merged, SECRET_FILE_MODE2);
@@ -1194,8 +1194,8 @@ async function applyFixes(checks) {
 
 // src/commands/init.ts
 import { basename, join as join16, relative as relative2, resolve } from "path";
-import { confirm as confirm3, input as input3, select as select7 } from "@inquirer/prompts";
-import boxen3 from "boxen";
+import { confirm as confirm3, input as input4, select as select7 } from "@inquirer/prompts";
+import boxen4 from "boxen";
 
 // src/lib/prompt-recovery-action-on-failure.ts
 import { input as input2, select as select3 } from "@inquirer/prompts";
@@ -1227,6 +1227,7 @@ import { join as join10 } from "path";
 // src/lib/check-team-pack-access-with-retry-loop.ts
 import { spawnSync as spawnSync6 } from "child_process";
 import { confirm as confirm2, select as select4 } from "@inquirer/prompts";
+import boxen2 from "boxen";
 function parseRepoSlugFromGitUrl(url) {
   const httpsMatch = url.match(/github\.com[/:]([^/]+\/[^/]+?)(?:\.git)?$/);
   if (httpsMatch) return httpsMatch[1];
@@ -1244,6 +1245,13 @@ function getCurrentGhUser() {
   if (r.status !== 0) return null;
   return r.stdout.trim() || null;
 }
+function triggerGhAuthLoginInteractive() {
+  log.info("M\u1EDF browser \u0111\u1EC3 switch GitHub account...");
+  const r = spawnSync6("gh", ["auth", "login", "--web"], { stdio: "inherit" });
+  if (r.status !== 0) {
+    log.warn(`gh auth login exit ${r.status}. C\xF3 th\u1EC3 ch\u1EA1y tay r\u1ED3i quay l\u1EA1i retry.`);
+  }
+}
 async function copyInfoToClipboardWithConsent(info) {
   const ok = await confirm2({
     message: "Copy th\xF4ng tin (GitHub username + email) v\xE0o clipboard \u0111\u1EC3 d\xE1n v\xE0o Slack/email?",
@@ -1258,44 +1266,78 @@ async function copyInfoToClipboardWithConsent(info) {
     log.dim(`Copy clipboard fail: ${err.message}`);
   }
 }
-function buildAccessRequestInfo(ghUser, ssoEmail) {
+function printAccessWarningBox(repoSlug, ghUser, ssoEmail) {
   const lines = [
-    "Request access team-ai-pack (NAL)",
+    `${chalk.red("\u26D4 KH\xD4NG C\xD3 QUY\u1EC0N ACCESS")}`,
+    "",
+    `Repo: ${chalk.bold(repoSlug)}`,
+    "",
+    "B\u1EA1n c\u1EA7n \u0111\u01B0\u1EE3c admin add v\xE0o org \u0111\u1EC3 pull team-ai-pack.",
+    "",
+    `${chalk.dim("Th\xF4ng tin g\u1EEDi admin:")}`,
+    `  GitHub username: ${chalk.cyan(ghUser ?? "(ch\u01B0a gh auth \u2014 ch\u1EA1y: gh auth login)")}`,
+    `  NAL email:       ${chalk.cyan(ssoEmail ?? "(ch\u01B0a avatar login \u2014 ch\u1EA1y: avatar login)")}`,
+    `  Date:            ${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}`,
+    "",
+    `${chalk.dim("Li\xEAn h\u1EC7:")} luke@nal.vn (Slack #avatar-setup)`
+  ];
+  process.stdout.write(
+    `${boxen2(lines.join("\n"), { padding: 1, borderColor: "red", borderStyle: "round" })}
+`
+  );
+}
+function buildAccessRequestInfo(repoSlug, ghUser, ssoEmail) {
+  return [
+    `Request access ${repoSlug} (NAL)`,
     "",
     `GitHub username: ${ghUser ?? "(ch\u01B0a gh auth \u2014 ch\u1EA1y: gh auth login)"}`,
     `NAL email:       ${ssoEmail ?? "(ch\u01B0a avatar login \u2014 ch\u1EA1y: avatar login)"}`,
     `Date:            ${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}`
-  ];
-  return lines.join("\n");
+  ].join("\n");
 }
 async function ensureTeamPackAccessWithRetry(args) {
   if (checkRepoAccess(args.repoSlug)) return true;
-  const ghUser = getCurrentGhUser();
-  const info = buildAccessRequestInfo(ghUser, args.ssoEmail ?? null);
-  log.warn(`B\u1EA1n ch\u01B0a c\xF3 quy\u1EC1n access v\xE0o b\u1ED9 package ${args.repoSlug}.`);
-  log.info("Li\xEAn h\u1EC7 admin (Luke @nal.vn) \u0111\u1EC3 \u0111\u01B0\u1EE3c add v\xE0o org nalvn.");
-  log.plain("");
-  log.plain(info);
-  log.plain("");
-  await copyInfoToClipboardWithConsent(info);
+  const initialGhUser = getCurrentGhUser();
+  printAccessWarningBox(args.repoSlug, initialGhUser, args.ssoEmail ?? null);
+  await copyInfoToClipboardWithConsent(
+    buildAccessRequestInfo(args.repoSlug, initialGhUser, args.ssoEmail ?? null)
+  );
   while (true) {
+    const ghUser = getCurrentGhUser();
+    const ghUserDisplay = ghUser ?? "(ch\u01B0a gh auth)";
     const action = await select4({
-      message: "Ti\u1EBFp t\u1EE5c?",
+      message: "C\xE1ch x\u1EED l\xFD?",
       choices: [
-        { name: "\u0110\xE3 \u0111\u01B0\u1EE3c add \u2014 ki\u1EC3m tra l\u1EA1i v\xE0 ti\u1EBFp t\u1EE5c", value: "retry" },
-        { name: "T\u1EA1m ng\u01B0ng \u2014 ch\u1EA1y l\u1EA1i 'avatar init' sau", value: "abort" }
+        {
+          name: `\u0110\xE3 \u0111\u01B0\u1EE3c grant access v\u1EDBi GitHub username '${ghUserDisplay}' \u2014 ki\u1EC3m tra l\u1EA1i`,
+          value: "retry-same"
+        },
+        {
+          name: "\u0110\xE3 grant v\u1EDBi GitHub account kh\xE1c \u2014 switch gh (m\u1EDF browser)",
+          value: "switch-account"
+        },
+        {
+          name: "T\u1EA1m ng\u01B0ng \u2014 ch\u1EA1y l\u1EA1i 'avatar init' sau",
+          value: "abort"
+        }
       ]
     });
     if (action === "abort") {
       log.dim("T\u1EA1m ng\u01B0ng. Ch\u1EA1y l\u1EA1i 'avatar init' sau khi \u0111\xE3 accept invite t\u1EEB GitHub.");
       return false;
     }
+    if (action === "switch-account") {
+      triggerGhAuthLoginInteractive();
+    }
     log.info("Ki\u1EC3m tra access...");
     if (checkRepoAccess(args.repoSlug)) {
-      log.success("\u0110\xE3 c\xF3 access \u2014 ti\u1EBFp t\u1EE5c.");
+      const finalUser = getCurrentGhUser();
+      log.success(`\u0110\xE3 c\xF3 access v\u1EDBi '${finalUser ?? "(unknown)"}' \u2014 ti\u1EBFp t\u1EE5c.`);
       return true;
     }
-    log.warn("V\u1EABn ch\u01B0a c\xF3 access. \u0110\u1EA3m b\u1EA3o b\u1EA1n \u0111\xE3 accept email invite t\u1EEB GitHub (Inbox + Spam).");
+    log.warn(
+      `V\u1EABn ch\u01B0a c\xF3 access v\u1EDBi account '${ghUser ?? "(unknown)"}'. \u0110\u1EA3m b\u1EA3o \u0111\xE3 accept email invite ho\u1EB7c switch \u0111\xFAng account.`
+    );
   }
 }
 
@@ -1361,10 +1403,10 @@ async function readPinnedPackVersion(projectRoot) {
 }
 
 // src/lib/add-team-pack-submodule-with-retry-on-network-fail.ts
-async function addTeamPackSubmoduleWithRetryOnNetworkFail(projectRoot, tag) {
+async function addTeamPackSubmoduleWithRetryOnNetworkFail(projectRoot, tag, ssoEmail) {
   while (true) {
     try {
-      const result = await addTeamPackSubmodule(projectRoot, tag);
+      const result = await addTeamPackSubmodule(projectRoot, tag, ssoEmail);
       return { pinnedTag: result.pinnedTag, skipped: false };
     } catch (err) {
       if (err instanceof TeamPackAccessAbortedError) throw err;
@@ -1456,15 +1498,15 @@ var RepoAlreadyExistsError = class extends Error {
     this.name = "RepoAlreadyExistsError";
   }
 };
-function executeGhRepoCreate(input4) {
-  const fullName = `${input4.org}/${input4.name}`;
+function executeGhRepoCreate(input5) {
+  const fullName = `${input5.org}/${input5.name}`;
   const args = [
     "repo",
     "create",
     fullName,
-    `--${input4.visibility}`,
+    `--${input5.visibility}`,
     "--source",
-    input4.folder,
+    input5.folder,
     "--remote",
     "origin",
     "--push"
@@ -1517,16 +1559,16 @@ function validateRepoVisibility(v) {
 }
 
 // src/lib/create-github-remote-from-folder.ts
-function createGithubRemoteFromFolder(input4) {
-  validateRepoName(input4.name);
-  validateRepoVisibility(input4.visibility);
-  const org = input4.org ?? resolveGithubUsernameDefault();
-  log.info(`T\u1EA1o GitHub repo ${org}/${input4.name} (${input4.visibility})...`);
+function createGithubRemoteFromFolder(input5) {
+  validateRepoName(input5.name);
+  validateRepoVisibility(input5.visibility);
+  const org = input5.org ?? resolveGithubUsernameDefault();
+  log.info(`T\u1EA1o GitHub repo ${org}/${input5.name} (${input5.visibility})...`);
   const urls = executeGhRepoCreate({
-    folder: input4.folder,
+    folder: input5.folder,
     org,
-    name: input4.name,
-    visibility: input4.visibility
+    name: input5.name,
+    visibility: input5.visibility
   });
   log.success(`\u0110\xE3 t\u1EA1o: ${urls.sshUrl}`);
   return urls;
@@ -1568,7 +1610,7 @@ function detectPackageManager() {
 
 // src/lib/handle-remote-access-failure-with-account-switch.ts
 import { spawnSync as spawnSync12 } from "child_process";
-import { select as select5 } from "@inquirer/prompts";
+import { input as input3, select as select5 } from "@inquirer/prompts";
 
 // src/lib/verify-git-remote-accessible.ts
 import { spawnSync as spawnSync11 } from "child_process";
@@ -1616,7 +1658,7 @@ function getCurrentGhUser2() {
   if (r.status !== 0) return null;
   return r.stdout.trim() || null;
 }
-function triggerGhAuthLoginInteractive() {
+function triggerGhAuthLoginInteractive2() {
   log.info("M\u1EDF browser \u0111\u1EC3 switch GitHub account...");
   const r = spawnSync12("gh", ["auth", "login", "--web"], { stdio: "inherit" });
   if (r.status !== 0) {
@@ -1628,33 +1670,43 @@ function getReasonHint(reason, url, ghUser) {
     case "no-access":
       return ghUser ? `Repo c\xF3 th\u1EC3 private v\xE0 account '${ghUser}' kh\xF4ng c\xF3 quy\u1EC1n access. Switch sang account c\xF3 quy\u1EC1n, ho\u1EB7c xin invite t\u1EEB owner repo.` : "Repo c\xF3 th\u1EC3 private v\xE0 gh CLI ch\u01B0a login. Login tr\u01B0\u1EDBc r\u1ED3i retry.";
     case "not-found":
-      return `URL c\xF3 th\u1EC3 sai ch\xEDnh t\u1EA3, ho\u1EB7c repo \u0111\xE3 b\u1ECB x\xF3a/rename. Check: ${url}`;
+      return `URL c\xF3 th\u1EC3 sai ch\xEDnh t\u1EA3, ho\u1EB7c repo \u0111\xE3 b\u1ECB x\xF3a/rename. Nh\u1EADp l\u1EA1i URL \u0111\xFAng. Check: ${url}`;
     case "network":
       return "Kh\xF4ng k\u1EBFt n\u1ED1i \u0111\u01B0\u1EE3c GitHub. Check m\u1EA1ng / VPN / firewall.";
     case "timeout":
       return "Network ch\u1EADm > 5s. Check m\u1EA1ng r\u1ED3i retry.";
     default:
-      return "L\u1ED7i kh\xF4ng x\xE1c \u0111\u1ECBnh. Check URL + gh auth status.";
+      return "L\u1ED7i kh\xF4ng x\xE1c \u0111\u1ECBnh. URL c\xF3 th\u1EC3 sai \u2014 nh\u1EADp l\u1EA1i, ho\u1EB7c check gh auth status.";
   }
 }
+function isValidGitUrl(url) {
+  const trimmed = url.trim();
+  if (!trimmed) return false;
+  return /^https?:\/\/[\w.@/-]+$/.test(trimmed) || /^git@[\w.-]+:[\w./-]+\.git$/.test(trimmed) || /^[\w.-]+\/[\w.-]+$/.test(trimmed);
+}
 async function handleRemoteAccessFailureWithAccountSwitch(args) {
+  let currentUrl = args.url;
   let reason = args.initialReason;
   let detail = args.initialDetail;
   while (true) {
     const ghUser = getCurrentGhUser2();
-    log.warn(`Kh\xF4ng truy c\u1EADp \u0111\u01B0\u1EE3c ${args.url}`);
+    log.warn(`Kh\xF4ng truy c\u1EADp \u0111\u01B0\u1EE3c ${currentUrl}`);
     log.dim(`  L\xFD do: ${reason}${detail ? ` \u2014 ${detail.slice(0, 150)}` : ""}`);
-    log.info(getReasonHint(reason, args.url, ghUser));
+    log.info(getReasonHint(reason, currentUrl, ghUser));
     if (ghUser) log.dim(`  gh CLI hi\u1EC7n \u0111ang login: ${ghUser}`);
     const action = await select5({
       message: "C\xE1ch x\u1EED l\xFD?",
       choices: [
+        {
+          name: "Nh\u1EADp l\u1EA1i URL \u0111\xFAng (recommended khi URL sai ch\xEDnh t\u1EA3)",
+          value: "re-input-url"
+        },
         {
           name: "Switch GitHub account (gh auth login \u2014 m\u1EDF browser)",
           value: "switch"
         },
         {
-          name: "T\xF4i v\u1EEBa fix (accept invite / s\u1EEDa URL) \u2014 retry verify",
+          name: "T\xF4i v\u1EEBa fix (accept invite / s\u1EEDa permission) \u2014 retry verify",
           value: "retry"
         },
         {
@@ -1665,17 +1717,25 @@ async function handleRemoteAccessFailureWithAccountSwitch(args) {
     });
     if (action === "abort") {
       throw new RemoteAccessAbortedError(
-        `User ch\u1ECDn t\u1EA1m ng\u01B0ng. Fix access ${args.url} r\u1ED3i ch\u1EA1y l\u1EA1i 'avatar init'.`
+        `User ch\u1ECDn t\u1EA1m ng\u01B0ng. Fix access ${currentUrl} r\u1ED3i ch\u1EA1y l\u1EA1i 'avatar init'.`
       );
     }
+    if (action === "re-input-url") {
+      const newUrl = await input3({
+        message: "URL git remote (https://github.com/owner/repo.git ho\u1EB7c git@github.com:owner/repo.git):",
+        default: currentUrl,
+        validate: (v) => isValidGitUrl(v) || "URL kh\xF4ng \u0111\xFAng format git remote"
+      });
+      currentUrl = newUrl.trim();
+    }
     if (action === "switch") {
-      triggerGhAuthLoginInteractive();
+      triggerGhAuthLoginInteractive2();
     }
-    log.info("Verify remote l\u1EA1i...");
-    const result = tryVerifyGitRemoteAccessible(args.url);
+    log.info(`Verify remote l\u1EA1i: ${currentUrl}...`);
+    const result = tryVerifyGitRemoteAccessible(currentUrl);
     if (result.ok) {
-      log.success(`Remote accessible: ${args.url}`);
-      return;
+      log.success(`Remote accessible: ${currentUrl}`);
+      return { resolvedUrl: currentUrl };
     }
     reason = result.reason ?? "unknown";
     detail = result.detail;
@@ -1792,14 +1852,16 @@ async function ensureGitHubReady(remoteUrl) {
     const result = tryVerifyGitRemoteAccessible(remoteUrl);
     if (result.ok) {
       log.success(`Remote accessible: ${remoteUrl}`);
-    } else {
-      await handleRemoteAccessFailureWithAccountSwitch({
-        url: remoteUrl,
-        initialReason: result.reason ?? "unknown",
-        initialDetail: result.detail
-      });
+      return { resolvedRemoteUrl: remoteUrl };
     }
+    const recovered = await handleRemoteAccessFailureWithAccountSwitch({
+      url: remoteUrl,
+      initialReason: result.reason ?? "unknown",
+      initialDetail: result.detail
+    });
+    return { resolvedRemoteUrl: recovered.resolvedUrl };
   }
+  return {};
 }
 
 // src/lib/create-workspace-remote-via-gh.ts
@@ -1828,27 +1890,27 @@ function canCreateInNamespace(org, ghUser) {
     reason: `'${ghUser}' kh\xF4ng ph\u1EA3i member c\u1EE7a org '${org}'. Li\xEAn h\u1EC7 admin org \u0111\u1EC3 \u0111\u01B0\u1EE3c invite, ho\u1EB7c pass --repo-org=${ghUser} t\u1EA1o d\u01B0\u1EDBi personal account.`
   };
 }
-async function createWorkspaceRemoteViaGh(input4) {
-  validateRepoName(input4.workspaceName);
-  validateRepoVisibility(input4.visibility);
+async function createWorkspaceRemoteViaGh(input5) {
+  validateRepoName(input5.workspaceName);
+  validateRepoVisibility(input5.visibility);
   await ensureGitHubReady();
   const ghUser = resolveGithubUsernameDefault();
-  const org = input4.org ?? ghUser;
+  const org = input5.org ?? ghUser;
   const namespaceCheck = canCreateInNamespace(org, ghUser);
   if (!namespaceCheck.ok) {
     throw new Error(`Kh\xF4ng th\u1EC3 t\u1EA1o repo d\u01B0\u1EDBi '${org}/': ${namespaceCheck.reason}`);
   }
-  const fullName = `${org}/${input4.workspaceName}`;
-  log.info(`T\u1EA1o GitHub repo cho workspace: ${fullName} (${input4.visibility})...`);
+  const fullName = `${org}/${input5.workspaceName}`;
+  log.info(`T\u1EA1o GitHub repo cho workspace: ${fullName} (${input5.visibility})...`);
   const r = spawnSync16(
     "gh",
     [
       "repo",
       "create",
       fullName,
-      `--${input4.visibility}`,
+      `--${input5.visibility}`,
       "--source",
-      input4.workspacePath,
+      input5.workspacePath,
       "--remote",
       "origin",
       "--push"
@@ -1860,7 +1922,7 @@ async function createWorkspaceRemoteViaGh(input4) {
     if (stderr) process.stderr.write(`${stderr}
 `);
     throw new Error(
-      `T\u1EA1o workspace remote th\u1EA5t b\u1EA1i (exit ${r.status}). Workspace v\u1EABn d\xF9ng \u0111\u01B0\u1EE3c local. Setup remote sau qua: gh repo create ${fullName} --${input4.visibility} --source=. --remote=origin --push`
+      `T\u1EA1o workspace remote th\u1EA5t b\u1EA1i (exit ${r.status}). Workspace v\u1EABn d\xF9ng \u0111\u01B0\u1EE3c local. Setup remote sau qua: gh repo create ${fullName} --${input5.visibility} --source=. --remote=origin --push`
     );
   }
   const sshUrl = `git@github.com:${fullName}.git`;
@@ -2176,7 +2238,7 @@ function buildScaffoldVariables(args) {
 }
 
 // src/commands/login.ts
-import boxen2 from "boxen";
+import boxen3 from "boxen";
 import open from "open";
 
 // src/lib/google-oauth-device-flow.ts
@@ -2323,7 +2385,7 @@ async function runLogin(opts) {
     "",
     `Ho\u1EB7c Avatar t\u1EF1 m\u1EDF browser, click ${chalk.green("Allow")}...`
   ].join("\n");
-  process.stdout.write(`${boxen2(instructions, { padding: 1, borderStyle: "round" })}
+  process.stdout.write(`${boxen3(instructions, { padding: 1, borderStyle: "round" })}
 `);
   void open(verificationUrl).catch(() => {
     log.dim("(Kh\xF4ng m\u1EDF \u0111\u01B0\u1EE3c browser t\u1EF1 \u0111\u1ED9ng \u2014 copy URL \u1EDF tr\xEAn)");
@@ -2458,14 +2520,15 @@ async function promptProjectStatus() {
   });
 }
 async function runInitFromExistingRemote(opts, ownerEmail) {
-  const remoteUrl = opts.clientRepo ?? await input3({
+  const initialRemoteUrl = opts.clientRepo ?? await input4({
     message: "URL git c\u1EE7a repo:",
     validate: (v) => v.length > 0 ? true : "URL b\u1EAFt bu\u1ED9c"
   });
-  await ensureGitHubReady(remoteUrl);
+  const { resolvedRemoteUrl } = await ensureGitHubReady(initialRemoteUrl);
+  const remoteUrl = resolvedRemoteUrl ?? initialRemoteUrl;
   const teamOwner = opts.teamOwner ?? await promptTeamOwner(ownerEmail);
   const inferredName = inferWorkspaceName(remoteUrl);
-  const workspaceName = opts.workspaceName ?? await input3({ message: "T\xEAn workspace:", default: inferredName });
+  const workspaceName = opts.workspaceName ?? await input4({ message: "T\xEAn workspace:", default: inferredName });
   const workspaceParent = resolve(opts.workspaceParent ?? ".");
   const workspacePath = await resolveWorkspacePath(workspaceParent, workspaceName, opts.force);
   await scaffoldWorkspaceWithSrcSubmodule({
@@ -2482,12 +2545,13 @@ async function runInitFromExistingRemote(opts, ownerEmail) {
     repoVisibility: opts.repoVisibility,
     repoOrg: opts.repoOrg,
     flow: "existing-remote",
-    aiSkip: opts.aiSkip
+    aiSkip: opts.aiSkip,
+    ssoEmail: ownerEmail
   });
 }
 async function runInitFromExistingFolder(opts, ownerEmail) {
   const folderPath = resolve(
-    opts.folderPath ?? await input3({
+    opts.folderPath ?? await input4({
       message: "\u0110\u01B0\u1EDDng d\u1EABn folder hi\u1EC7n c\xF3:",
       validate: (v) => v.length > 0 ? true : "Path b\u1EAFt bu\u1ED9c"
     })
@@ -2499,7 +2563,7 @@ async function runInitFromExistingFolder(opts, ownerEmail) {
   const remoteUrl = await getOrCreateOriginRemote(folderPath, opts);
   const teamOwner = opts.teamOwner ?? await promptTeamOwner(ownerEmail);
   const inferredName = opts.workspaceName ?? `${basename(folderPath)}-avatar-workspace`;
-  const workspaceName = opts.workspaceName ?? await input3({ message: "T\xEAn workspace:", default: inferredName });
+  const workspaceName = opts.workspaceName ?? await input4({ message: "T\xEAn workspace:", default: inferredName });
   const workspaceParent = resolve(opts.workspaceParent ?? ".");
   const workspacePath = await resolveWorkspacePath(workspaceParent, workspaceName, opts.force);
   await scaffoldWorkspaceWithSrcSubmodule({
@@ -2517,12 +2581,13 @@ async function runInitFromExistingFolder(opts, ownerEmail) {
     repoVisibility: opts.repoVisibility,
     repoOrg: opts.repoOrg,
     flow: "existing-folder",
-    aiSkip: opts.aiSkip
+    aiSkip: opts.aiSkip,
+    ssoEmail: ownerEmail
   });
 }
 async function runInitFromScratch(opts, ownerEmail) {
   await ensureGitHubReady();
-  const projectName = opts.workspaceName ?? await input3({
+  const projectName = opts.workspaceName ?? await input4({
     message: "T\xEAn d\u1EF1 \xE1n:",
     validate: (v) => v.length > 0 ? true : "T\xEAn b\u1EAFt bu\u1ED9c"
   });
@@ -2554,9 +2619,11 @@ async function runInitFromScratch(opts, ownerEmail) {
     await git(workspacePath).subModule(["add", urls.sshUrl, "src"]);
     let pinnedTag = "HEAD";
     if (!opts.skipTeamPack) {
+      sp.stop();
       const result = await addTeamPackSubmoduleWithRetryOnNetworkFail(
         workspacePath,
-        opts.packVersion
+        opts.packVersion,
+        ownerEmail
       );
       pinnedTag = result.pinnedTag ?? "HEAD";
       sp.succeed(`Pin team-ai-pack v\xE0o ${pinnedTag}`);
@@ -2605,7 +2672,7 @@ async function getOrCreateOriginRemote(folderPath, opts) {
       { name: "public", value: "public" }
     ]
   });
-  const repoName = await input3({
+  const repoName = await input4({
     message: "T\xEAn repo:",
     default: basename(folderPath)
   });
@@ -2627,9 +2694,11 @@ async function scaffoldWorkspaceWithSrcSubmodule(args) {
     await git(args.workspacePath).subModule(["add", args.srcRemoteUrl, "src"]);
     let pinnedTag = "HEAD";
     if (!args.skipTeamPack) {
+      sp.stop();
       const result = await addTeamPackSubmoduleWithRetryOnNetworkFail(
         args.workspacePath,
-        args.packVersion
+        args.packVersion,
+        args.ssoEmail
       );
       pinnedTag = result.pinnedTag ?? "HEAD";
       sp.succeed(`Pin team-ai-pack v\xE0o ${pinnedTag}`);
@@ -2760,7 +2829,7 @@ async function resolveWorkspacePath(parent, desiredName, force) {
     if (action === "use-alt" && alternative) {
       return alternative;
     }
-    const newName = await input3({
+    const newName = await input4({
       message: "T\xEAn workspace m\u1EDBi:",
       validate: (v) => v.trim().length > 0 ? true : "T\xEAn kh\xF4ng \u0111\u01B0\u1EE3c r\u1ED7ng"
     });
@@ -2770,7 +2839,7 @@ async function resolveWorkspacePath(parent, desiredName, force) {
   }
 }
 async function promptTeamOwner(currentUserEmail) {
-  return await input3({ message: "Team owner email:", default: currentUserEmail });
+  return await input4({ message: "Team owner email:", default: currentUserEmail });
 }
 async function maybeCommitWorkspace(workspacePath, skipCommit) {
   if (skipCommit) {
@@ -2806,7 +2875,7 @@ function printInitSuccessBox(rootPath, flow, aiResult = null) {
     `  ${chalk.cyan("avatar sync")}               Pull team-ai-pack m\u1EDBi`,
     `  ${chalk.cyan("avatar uninstall")}          G\u1EE1 Avatar (gi\u1EEF code)`
   ];
-  process.stdout.write(`${boxen3(lines.join("\n"), { padding: 1, borderStyle: "round" })}
+  process.stdout.write(`${boxen4(lines.join("\n"), { padding: 1, borderStyle: "round" })}
 `);
 }
 
@@ -2843,7 +2912,7 @@ function registerSecretsCommand(program2) {
 // src/commands/status.ts
 import { promises as fs8 } from "fs";
 import { join as join18 } from "path";
-import boxen4 from "boxen";
+import boxen5 from "boxen";
 
 // src/lib/pack-backup-manager.ts
 import { promises as fs7 } from "fs";
@@ -2921,7 +2990,7 @@ function renderStatusBox(s) {
     `${chalk.dim("Backups:")}            ${s.backupCount}`,
     `${chalk.dim("Tech stack:")}         ${s.techStackSummary}`
   ];
-  process.stdout.write(`${boxen4(lines.join("\n"), { padding: 1, borderStyle: "round" })}
+  process.stdout.write(`${boxen5(lines.join("\n"), { padding: 1, borderStyle: "round" })}
 `);
 }
 
@@ -2941,7 +3010,7 @@ function registerToolsCommand(program2) {
 // src/commands/uninstall.ts
 import { relative as relative3 } from "path";
 import { confirm as confirm4 } from "@inquirer/prompts";
-import boxen5 from "boxen";
+import boxen6 from "boxen";
 
 // src/lib/create-uninstall-backup-snapshot.ts
 import { cp, mkdir, writeFile } from "fs/promises";
@@ -3095,7 +3164,7 @@ async function removeSubmoduleEntry(gitmodulesPath, submodulePath) {
 }
 
 // src/commands/uninstall.ts
-var CLI_VERSION = "1.2.5";
+var CLI_VERSION = "1.2.7";
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("G\u1EE1 Avatar kh\u1ECFi project \u2014 backup t\u1EF1 \u0111\u1ED9ng (M11)").option("--yes", "Skip confirm prompt").option("--no-backup", "Kh\xF4ng t\u1EA1o backup tr\u01B0\u1EDBc khi x\xF3a (nguy hi\u1EC3m)").option("--keep-submodule", "Gi\u1EEF submodule .claude/pack/").option("--keep-hooks", "Gi\u1EEF git hooks post-merge, pre-push").option("--dry-run", "Hi\u1EC3n th\u1ECB danh s\xE1ch s\u1EBD x\xF3a, kh\xF4ng th\u1EF1c thi").action(async (opts) => {
     try {
@@ -3172,12 +3241,12 @@ function printUninstallSuccessBox(backupPath) {
     lines.push(`  ${chalk.dim("Backup:")} ${backupPath}`);
     lines.push(`  ${chalk.dim("Restore:")} ${chalk.cyan(`cp -r "${backupPath}"/* .`)}`);
   }
-  process.stdout.write(`${boxen5(lines.join("\n"), { padding: 1, borderStyle: "round" })}
+  process.stdout.write(`${boxen6(lines.join("\n"), { padding: 1, borderStyle: "round" })}
 `);
 }
 
 // src/index.ts
-var CLI_VERSION2 = "1.2.5";
+var CLI_VERSION2 = "1.2.7";
 var program = new Command();
 program.name("avatar").description("AI harness CLI for NAL Vietnam engineering").version(CLI_VERSION2, "-v, --version", "Hi\u1EC3n th\u1ECB phi\xEAn b\u1EA3n Avatar CLI").addHelpText(
   "beforeAll",