teamai-cli 0.17.2 → 0.17.3

package/README.md

@@ -77,7 +77,7 @@ teamai init --http https://your-team-host/api --token <api-key>
 
 - **Read-only:** `push` / `contribute` / `remove` are disabled for HTTP repos.
 - The API key is stored `0600` (never written to config, never committed); `TEAMAI_API_TOKEN` is also honored.
-- If the team-repo endpoint (`/repo`) is not live yet, init falls back to **reporting-only mode** — hooks and status reporting are wired immediately, and skills/rules begin syncing automatically once the endpoint is available.
+- No git clone: skills/rules/CLAUDE.md are delivered per-session over the report/sync/ack lifecycle. Hooks and status reporting are wired at init time.
 
 #### Agent status reporting
 
@@ -92,25 +92,22 @@ The value you pass to `--http <baseUrl>` is the base; every endpoint is relative
 
 | Endpoint | Method | Purpose | Path |
 |----------|--------|---------|------|
-| `{baseUrl}/repo` | GET | Team-repo snapshot (skills + rules/docs) | **fixed** |
 | `{baseUrl}/api/local-agent/report` | POST | Session start: upsert agent + installed skills | default, configurable |
 | `{baseUrl}/api/local-agent/sync` | POST | Report status + return pending skill commands | default, configurable |
 | `{baseUrl}/api/local-agent/commands/ack` | POST | Ack one command (`{ id, status, error }`) | default, configurable |
 
-`GET /repo` returns JSON (a 404 or non-JSON 200 ⇒ the client enters reporting-only mode):
+`POST /api/local-agent/sync` returns pending commands that install/update/uninstall skills:
 
 ```json
 {
-  "version": "<opaque cache key, e.g. a commit hash>",
-  "files":   [{ "path": "rules/foo.md", "content": "..." }],
-  "commands":[{ "type": "install_skill", "skill_slug": "x", "skill_version": "1.0.0", "download_url": "https://signed-url/..." }]
+  "ok": true,
+  "commands": [{ "id": 1, "type": "install_skill", "skill_slug": "x", "skill_version": "1.0.0", "download_url": "https://signed-url/..." }]
 }
 ```
 
-- `files[]` are written verbatim into the local repo tree (path-traversal guarded); `commands[]` install/update/uninstall skills.
 - A skill `download_url` is fetched **directly** — it carries its own signed auth in the query string, so no `Bearer` header is sent. It must resolve to a `.zip` whose root is either `<slug>/SKILL.md …` or a flat `SKILL.md …`.
 
-**Fixed vs configurable.** The `/repo` path is fixed; the three reporter paths are defaults you can override. The JSON shapes above are the contract. Knobs (env vars):
+**Configurable paths.** The three reporter paths are defaults you can override. The JSON shapes above are the contract. Knobs (env vars):
 
 | Variable | Effect |
 |----------|--------|
@@ -119,6 +116,7 @@ The value you pass to `--http <baseUrl>` is the base; every endpoint is relative
 | `TEAMAI_REPORT_PATHS` | JSON `{ "report", "sync", "ack" }` to override the three reporter paths |
 | `TEAMAI_REPORT_AGENTS` | Comma-separated agents that report (default `workbuddy,codebuddy`) |
 | `TEAMAI_SKILL_DOWNLOAD_HOSTS` | Comma-separated host allowlist for skill `download_url` (empty = allow all) |
+| `TEAMAI_BIND_PROMPT_ENABLED` | Set to `1` to enable the org-binding prompt (TTY prompt + injected hook hint). Off by default; `teamai bind-project` works regardless |
 
 </details>
 
@@ -300,6 +298,25 @@ teamai source remove other-team
 
 Subscribed skills sync to your local machine on `teamai pull` and coexist with your own team's skills.
 
+### HTTP source (report/sync/ack)
+
+The subscriptions above are **git** sources. You can additionally attach a single **HTTP** source that uses the report/sync/ack lifecycle — the same one an `init --http` consumer gets — **alongside your existing git main repo**, without changing it:
+
+```bash
+# Attach an HTTP source (git main repo stays untouched)
+teamai source add-http https://your-team-host/api --token <api-key>
+
+# See it listed under "HTTP source"
+teamai source list
+
+# Detach it (uninstalls its resources, clears its config)
+teamai source remove-http
+```
+
+The HTTP source reports status and pulls down skills/rules/CLAUDE.md commands on each AI session, driven by the `hook-dispatch` hook that `teamai init` already installs. Users who never run `add-http` are unaffected.
+
+Only one HTTP source is supported, and it is meant for **git-based** main repos: if your main repo is itself an HTTP backend (`init --http`), it already owns the HTTP config, so `add-http` is rejected.
+
 ## Scope
 
 TeamAI supports two scopes that can coexist:

package/README.zh-CN.md

@@ -77,7 +77,7 @@ teamai init --http https://your-team-host/api --token <api-key>
 
 - **只读**：HTTP 仓库下 `push` / `contribute` / `remove` 均被禁用。
 - API key 以 `0600` 权限保存（不写入 config，也不会被提交）；同时支持 `TEAMAI_API_TOKEN` 环境变量。
-- 如果团队仓库端点（`/repo`）尚未上线，init 会回落到 **reporting-only 模式**——hooks 和状态上报立即生效，待端点可用后 skills/rules 会自动开始同步。
+- 无需 git clone：skills/rules/CLAUDE.md 在每次会话时通过 report/sync/ack 生命周期交付。hooks 与状态上报在 init 时即接线完成。
 
 #### Agent 状态上报
 
@@ -92,25 +92,22 @@ teamai init --http https://your-team-host/api --token <api-key>
 
 | 端点 | 方法 | 用途 | 路径 |
 |------|------|------|------|
-| `{baseUrl}/repo` | GET | 团队仓库快照（skills + rules/docs） | **固定** |
 | `{baseUrl}/api/local-agent/report` | POST | session 启动：upsert agent + 已装 skill | 默认，可配置 |
 | `{baseUrl}/api/local-agent/sync` | POST | 上报状态 + 返回待执行的 skill 命令 | 默认，可配置 |
 | `{baseUrl}/api/local-agent/commands/ack` | POST | 回执单条命令（`{ id, status, error }`） | 默认，可配置 |
 
-`GET /repo` 返回 JSON（返回 404 或非 JSON 的 200 ⇒ 客户端进入 reporting-only 模式）：
+`POST /api/local-agent/sync` 返回负责 skill 安装/更新/卸载的待执行命令：
 
 ```json
 {
-  "version": "<不透明的缓存 key，例如 commit hash>",
-  "files":   [{ "path": "rules/foo.md", "content": "..." }],
-  "commands":[{ "type": "install_skill", "skill_slug": "x", "skill_version": "1.0.0", "download_url": "https://signed-url/..." }]
+  "ok": true,
+  "commands": [{ "id": 1, "type": "install_skill", "skill_slug": "x", "skill_version": "1.0.0", "download_url": "https://signed-url/..." }]
 }
 ```
 
-- `files[]` 原样写入本地仓库树（带路径穿越防护）；`commands[]` 负责 skill 的安装/更新/卸载。
 - skill 的 `download_url` 是**直连**拉取——它在 query string 里自带签名鉴权，因此不附带 `Bearer` 头。它必须指向一个 `.zip`，其根目录为 `<slug>/SKILL.md …` 或扁平的 `SKILL.md …`。
 
-**固定 vs 可配置**：`/repo` 路径固定；reporter 三个路径是可覆盖的默认值；上面的 JSON 结构是契约。可调项（环境变量）：
+**可配置路径**：reporter 三个路径是可覆盖的默认值;上面的 JSON 结构是契约。可调项（环境变量）：
 
 | 变量 | 作用 |
 |------|------|
@@ -119,6 +116,7 @@ teamai init --http https://your-team-host/api --token <api-key>
 | `TEAMAI_REPORT_PATHS` | JSON `{ "report", "sync", "ack" }`，覆盖 reporter 三个路径 |
 | `TEAMAI_REPORT_AGENTS` | 参与上报的 agent，逗号分隔（默认 `workbuddy,codebuddy`） |
 | `TEAMAI_SKILL_DOWNLOAD_HOSTS` | skill `download_url` 的 host 白名单，逗号分隔（空 = 全部放行） |
+| `TEAMAI_BIND_PROMPT_ENABLED` | 设为 `1` 开启组织绑定提示（TTY 交互提示 + 注入的 hook 提示）。默认关闭；`teamai bind-project` 手动命令不受影响 |
 
 </details>
 
@@ -300,6 +298,25 @@ teamai source remove other-team
 
 订阅源的 skills 在 `teamai pull` 时自动同步到本地，与团队自有 skills 共存。
 
+### HTTP source（report/sync/ack）
+
+上面的订阅源是 **git** 源。你还可以在**不改动现有 git 主仓**的前提下，额外挂一个 **HTTP** 源，它走 report/sync/ack 生命周期——与 `init --http` 消费者所用的完全相同：
+
+```bash
+# 挂一个 HTTP 源（git 主仓保持不变）
+teamai source add-http https://your-team-host/api --token <api-key>
+
+# 在 "HTTP source" 分区查看
+teamai source list
+
+# 移除（卸载其资源并清空配置）
+teamai source remove-http
+```
+
+HTTP 源在每次 AI 会话时上报状态并拉取 skills/rules/CLAUDE.md 指令命令，由 `teamai init` 已安装的 `hook-dispatch` hook 驱动。从不执行 `add-http` 的用户不受任何影响。
+
+仅支持一个 HTTP 源，且面向 **git 主仓**用户：若你的主仓本身就是 HTTP 后端（`init --http`），它已占用 HTTP 配置，此时 `add-http` 会被拒绝。
+
 ## Scope（作用域）
 
 TeamAI 支持两种 scope，可以共存：