teamai-cli 0.21.0-beta.3 → 0.21.0-beta.8

package/CHANGELOG.md

@@ -22,6 +22,10 @@ All notable changes to this project will be documented in this file. See [standa
   - `teamai skill` 或 `teamai skill list`：等价 `teamai list skills --source all`
   - `teamai skill show <name>`：查看单个 skill 的来源标签、命名空间、贡献者、`tags.yaml` 中的 tags、已安装的 agent 列表，以及 frontmatter 中的描述（最多 160 字符）。不渲染完整 SKILL.md 正文
 
+### 🐛 修复
+
+- **项目级 source 配置持久化**（#335）：`teamai pull` 自动上报 usage 时不再丢弃 `source add`/`remove` 尚未提交的 `teamai.yaml` 改动，后续 pull 可正常部署订阅 skills 并写入安装清单
+
 ## [0.14.2] (2026-04-16)
 
 ### 🐛 修复

package/README.md

@@ -159,7 +159,8 @@ teamai source browse other-team    # browse available skills
 teamai source remove other-team
 ```
 
-Subscribed skills sync automatically on `teamai pull`.
+The add/remove change takes effect locally right away, and subscribed skills sync on the next
+`teamai pull`. Run `teamai push` when you want to share the `teamai.yaml` change with teammates.
 
 ## Knowledge Base
 

package/README.zh-CN.md

@@ -159,7 +159,8 @@ teamai source browse other-team    # 浏览可用 skills
 teamai source remove other-team
 ```
 
-订阅的 skills 在 `teamai pull` 时自动同步。
+添加/移除会立即在本机生效，订阅的 skills 会在下一次 `teamai pull` 时同步。需要将
+`teamai.yaml` 的改动分享给团队成员时，再运行 `teamai push`。
 
 ## 知识库
 

package/dist/index.js

@@ -3918,6 +3918,13 @@ function assertSafePath(target, allowedRoots) {
     `Path traversal detected: "${target}" is outside allowed directories: ${allowedRoots.join(", ")}`
   );
 }
+function assertWithinRoot(root, candidate, message) {
+  const resolvedRoot = path11.resolve(root);
+  const resolvedCandidate = path11.resolve(candidate);
+  if (resolvedCandidate !== resolvedRoot && !resolvedCandidate.startsWith(resolvedRoot + path11.sep)) {
+    throw new Error(message ?? `path traversal detected: "${candidate}" is outside "${root}"`);
+  }
+}
 function resolveReal(p) {
   const expanded = p.startsWith("~") ? path11.join(os4.homedir(), p.slice(1)) : p;
   const abs = path11.resolve(expanded);
@@ -8712,12 +8719,6 @@ async function resolveSkillNamespaces(localConfig) {
     return [localConfig.primaryRole, ...localConfig.additionalRoles ?? []];
   }
 }
-function getSkillDestination(localConfig, skillName, namespace) {
-  if (namespace) {
-    return path24.join(localConfig.repo.localPath, "skills", namespace, skillName);
-  }
-  return path24.join(localConfig.repo.localPath, "skills", skillName);
-}
 async function scanSkillsRecursively(dirPath) {
   const results = /* @__PURE__ */ new Map();
   async function walk2(currentPath) {
@@ -8754,6 +8755,7 @@ var init_skills = __esm({
     init_builtin_skills();
     init_openclaw_hooks();
     init_roles();
+    init_path_safety();
     CONTRIBUTORS_FILE = "CONTRIBUTORS";
     SKILL_MD = "SKILL.md";
     FRONTMATTER_REGEX = /^---\n[\s\S]*?\n---/;
@@ -8917,7 +8919,13 @@ var init_skills = __esm({
        * Copy a local skill to the team repo.
        */
       async pushItem(item, _teamConfig, localConfig) {
-        const dest = getSkillDestination(localConfig, item.name, item.namespace ?? localConfig.primaryRole);
+        const skillsRoot = path24.join(localConfig.repo.localPath, "skills");
+        const dest = path24.resolve(localConfig.repo.localPath, item.relativePath);
+        assertWithinRoot(
+          skillsRoot,
+          dest,
+          `Invalid skill destination outside team repo skills directory: ${item.relativePath}`
+        );
         await copyDir(item.sourcePath, dest);
         log.debug(`Copied skill ${item.name} \u2192 team repo`);
         await ensureSkillFrontmatter(dest, item.name);
@@ -11159,6 +11167,7 @@ async function push(options) {
       } else {
         log.error(`Push failed: ${e.message}`);
       }
+      process.exitCode = 1;
     }
     return;
   }
@@ -11175,6 +11184,7 @@ async function pushCore(localConfig, teamConfig, options) {
       const git = createGit2(repoPath);
       if (!await isDedicatedRepoRoot(repoPath)) {
         pullSpin.fail("Cannot push: team repo path is not a dedicated git root. Run `teamai init` to re-clone the team repo before pushing.");
+        process.exitCode = 1;
         return;
       }
       const yamlPath = path35.join(repoPath, "teamai.yaml");
@@ -11295,6 +11305,25 @@ async function pushCore(localConfig, teamConfig, options) {
     allItems.length = 0;
     allItems.push(matchedItem);
   }
+  if (options.role) {
+    try {
+      assertSafeResourceName(options.role);
+      for (const item of allItems) {
+        if (item.type === "skills") {
+          assertSafeResourceName(item.name);
+        }
+      }
+    } catch (e) {
+      log.error(`Invalid skill role or name: ${e.message}`);
+      process.exitCode = 2;
+      return;
+    }
+    for (const item of allItems) {
+      if (item.type !== "skills") continue;
+      item.namespace = options.role;
+      item.relativePath = `skills/${options.role}/${item.name}`;
+    }
+  }
   if (allItems.length === 0) {
     if (pendingTeamConfig !== null) {
       await pushTeamConfigOnly(localConfig, teamConfig, options);
@@ -11452,7 +11481,7 @@ async function pushCore(localConfig, teamConfig, options) {
       return;
     }
     pushSpin.succeed(`Pushed branch ${branchName}`);
-    await createPrWithFallback(
+    const prUrl = await createPrWithFallback(
       teamConfig,
       localConfig,
       branchName,
@@ -11460,6 +11489,9 @@ async function pushCore(localConfig, teamConfig, options) {
       `Pushed ${selectedItems.length} resource(s):
 ${selectedItems.map((i) => `- [${i.type}] ${i.name}`).join("\n")}`
     );
+    if (!prUrl) {
+      process.exitCode = 1;
+    }
     await checkoutMaster(localConfig.repo.localPath);
   } catch (e) {
     pushSpin.fail(`Push failed: ${e.message}`);
@@ -11475,6 +11507,7 @@ ${selectedItems.map((i) => `- [${i.type}] ${i.name}`).join("\n")}`
         );
       }
     }
+    process.exitCode = 1;
     return;
   }
   const state = await loadStateForScope(localConfig.scope, localConfig.projectRoot);
@@ -11516,16 +11549,20 @@ async function pushTeamConfigOnly(localConfig, teamConfig, options) {
       return;
     }
     pushSpin.succeed(`Pushed branch ${branchName}`);
-    await createPrWithFallback(
+    const prUrl = await createPrWithFallback(
       teamConfig,
       localConfig,
       branchName,
       commitMsg,
       "Updated team config (teamai.yaml)"
     );
+    if (!prUrl) {
+      process.exitCode = 1;
+    }
     await checkoutMaster(localConfig.repo.localPath);
   } catch (e) {
     pushSpin.fail(`Push failed: ${e.message}`);
+    process.exitCode = 1;
     return;
   }
 }
@@ -11784,6 +11821,8 @@ async function pushRepoBranch(localPath, message, files, branchName) {
   await git.add(files);
   const status2 = await git.status();
   if (status2.staged.length === 0) {
+    await git.reset(["--hard", "HEAD"]);
+    await git.clean("f", ["-d"]);
     const defaultBranch = await getDefaultBranch(localPath);
     log.debug(`Nothing to commit, switching back to ${defaultBranch}`);
     await switchToDefaultBranch(git, defaultBranch);
@@ -11792,6 +11831,8 @@ async function pushRepoBranch(localPath, message, files, branchName) {
   }
   const diffOutput = await git.diff(["--cached", "--unified=0"]);
   if (isMetadataOnlyDiff(diffOutput)) {
+    await git.reset(["--hard", "HEAD"]);
+    await git.clean("f", ["-d"]);
     const defaultBranch = await getDefaultBranch(localPath);
     log.debug(`Only metadata/timestamp changes detected, switching back to ${defaultBranch}`);
     await switchToDefaultBranch(git, defaultBranch);
@@ -15740,8 +15781,18 @@ async function reportUsageToTeam(repoPath, username, options) {
         log.debug(`Skipping report: ${repoPath} is not a dedicated team-repo root (safety guard)`);
         return;
       }
-      await resetToCleanMaster(git, repoPath);
-      await pullRepo(repoPath);
+      const yamlPath = path48.join(repoPath, "teamai.yaml");
+      const workingContent = await readFileSafe(yamlPath);
+      const committedContent = workingContent === null ? null : await getFileContentAtRev(repoPath, "HEAD", "teamai.yaml");
+      const pendingTeamConfig = workingContent !== null && (committedContent === null || committedContent.toString() !== workingContent) ? workingContent : null;
+      try {
+        await resetToCleanMaster(git, repoPath);
+        await pullRepo(repoPath);
+      } finally {
+        if (pendingTeamConfig !== null) {
+          await writeFile(yamlPath, pendingTeamConfig);
+        }
+      }
     }
     if (hasUsage || hasInterventions || hasPromptTokens) {
       const statsDir = path48.join(writeRoot, "stats");
@@ -16460,7 +16511,7 @@ async function scanRoleAwareSkills(localConfig, namespaces) {
   }
   return [...items.values()];
 }
-async function cleanupInactiveNamespaceSkills(teamConfig, localConfig, activeSkillNames, inactiveSkillNames) {
+async function cleanupInactiveNamespaceSkills(teamConfig, localConfig, retainedSkillNames, inactiveSkillNames) {
   const baseDir = resolveBaseDir(localConfig);
   for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
     if (isAgentDisabled(localConfig, tool)) continue;
@@ -16470,7 +16521,7 @@ async function cleanupInactiveNamespaceSkills(teamConfig, localConfig, activeSki
     const localSkillNames = await listDirs(path50.join(baseDir, toolPath.skills));
     for (const skillName of localSkillNames) {
       if (BUILTIN_SKILL_NAMES.has(skillName)) continue;
-      if (activeSkillNames.has(skillName)) continue;
+      if (retainedSkillNames.has(skillName)) continue;
       if (!inactiveSkillNames.has(skillName)) continue;
       const localSkillDir = path50.join(baseDir, toolPath.skills, skillName);
       await remove(localSkillDir);
@@ -16618,7 +16669,11 @@ async function pullForScope(localConfig, options, policy = {}) {
       let tagIncluded = [];
       if (hasActiveTagSubscriptions) {
         const tagResult = filterByTags(allTeamSkills, tagsConfig, subscribedTags, "skills");
-        tagIncluded = tagResult.included;
+        const subscribedTagSet = new Set(subscribedTags);
+        tagIncluded = tagResult.included.filter((item) => {
+          const itemTags = tagsConfig.skills[item.name];
+          return itemTags?.some((tag) => subscribedTagSet.has(tag));
+        });
         skippedByTags = tagResult.skipped.length;
       }
       const merged = /* @__PURE__ */ new Map();
@@ -16718,7 +16773,7 @@ async function pullForScope(localConfig, options, policy = {}) {
       await cleanupInactiveNamespaceSkills(
         freshConfig,
         localConfig,
-        roleContext.activeSkillNames,
+        desiredSkillNames ?? roleContext.activeSkillNames,
         roleContext.inactiveSkillNames
       );
     }
@@ -18963,6 +19018,14 @@ async function collectTeamRuleNames(repoPath) {
     files.filter((f) => f.endsWith(".md")).map((f) => f.replace(/\.md$/, ""))
   );
 }
+async function collectTeamAgentNames(repoPath) {
+  const teamAgentsDir = path58.join(repoPath, "agents");
+  if (!await pathExists(teamAgentsDir)) return /* @__PURE__ */ new Set();
+  const files = await listFiles(teamAgentsDir);
+  return new Set(
+    files.filter((file) => file.endsWith(".yaml") || file.endsWith(".md")).map((file) => path58.basename(file).replace(/\.(yaml|md)$/, ""))
+  );
+}
 function isEmptyHooksResidue(parsed) {
   if (parsed == null || !("hooks" in parsed) || typeof parsed.hooks !== "object" || parsed.hooks == null) return false;
   const entries = Object.values(parsed.hooks);
@@ -18976,7 +19039,7 @@ function opencodePluginTargets(baseDir, scope) {
   }
   return targets;
 }
-async function discoverToolResources(tool, toolPath, baseDir, teamSkillNames, teamRuleNames, managedHooksPath, scope) {
+async function discoverToolResources(tool, toolPath, baseDir, teamSkillNames, teamRuleNames, teamAgentNames, managedHooksPath, scope) {
   const res = {
     hookFiles: [],
     openclawHookDirs: [],
@@ -19022,12 +19085,18 @@ async function discoverToolResources(tool, toolPath, baseDir, teamSkillNames, te
     }
   }
   if (toolPath.skills) {
-    const skillsDir = path58.join(baseDir, toolPath.skills);
-    if (await pathExists(skillsDir)) {
-      const dirs = await listDirs(skillsDir);
-      for (const dir of dirs) {
-        if (teamSkillNames.has(dir)) {
-          res.skillDirs.push(path58.join(skillsDir, dir));
+    const skillRoots = /* @__PURE__ */ new Set([path58.join(baseDir, toolPath.skills)]);
+    if (tool === "openclaw") {
+      const workspaceDir = await resolveOpenclawWorkspaceDir();
+      if (workspaceDir) skillRoots.add(path58.join(workspaceDir, "skills"));
+    }
+    for (const skillsDir of skillRoots) {
+      if (await pathExists(skillsDir)) {
+        const dirs = await listDirs(skillsDir);
+        for (const dir of dirs) {
+          if (teamSkillNames.has(dir)) {
+            res.skillDirs.push(path58.join(skillsDir, dir));
+          }
         }
       }
     }
@@ -19048,11 +19117,11 @@ async function discoverToolResources(tool, toolPath, baseDir, teamSkillNames, te
   if (toolPath.agents) {
     const agentsDir = path58.join(baseDir, toolPath.agents);
     if (await pathExists(agentsDir)) {
-      for (const name of BUILTIN_AGENT_NAMES) {
-        const agentFile = path58.join(agentsDir, `${name}.md`);
-        if (await pathExists(agentFile)) {
-          res.agentFiles.push(agentFile);
-        }
+      for (const file of await listFiles(agentsDir)) {
+        if (!file.endsWith(".md") && !file.endsWith(".toml")) continue;
+        const name = path58.basename(file).replace(/\.(md|toml)$/, "");
+        if (!teamAgentNames.has(name) && !BUILTIN_AGENT_NAMES.has(name)) continue;
+        res.agentFiles.push(path58.join(agentsDir, file));
       }
     }
   }
@@ -19066,6 +19135,7 @@ async function buildRemovalPlan(localConfig, teamConfig, agentFilter) {
   for (const name of BUILTIN_SKILL_NAMES) teamSkillNames.add(name);
   const teamRuleNames = await collectTeamRuleNames(repoPath);
   for (const name of BUILTIN_RULE_NAMES) teamRuleNames.add(name);
+  const teamAgentNames = await collectTeamAgentNames(repoPath);
   const localAgentManifestPath = path58.join(
     getUserHome(),
     ".teamai",
@@ -19090,7 +19160,16 @@ async function buildRemovalPlan(localConfig, teamConfig, agentFilter) {
   for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
     perTool.set(
       tool,
-      await discoverToolResources(tool, toolPath, baseDir, teamSkillNames, teamRuleNames, managedHooksPath, localConfig.scope)
+      await discoverToolResources(
+        tool,
+        toolPath,
+        baseDir,
+        teamSkillNames,
+        teamRuleNames,
+        teamAgentNames,
+        managedHooksPath,
+        localConfig.scope
+      )
     );
   }
   let includeShared;
@@ -19207,7 +19286,10 @@ function printSummary(plan, agentFilter) {
     console.log("");
   }
   if (plan.skillDirs.length > 0) {
-    console.log(`   Skills (${plan.skillDirs.length} directories)`);
+    console.log(`   Skills (${plan.skillDirs.length} directories):`);
+    for (const skillDir of plan.skillDirs) {
+      console.log(`     ${skillDir}`);
+    }
     console.log("");
   }
   if (plan.ruleFiles.length > 0) {
@@ -19215,7 +19297,10 @@ function printSummary(plan, agentFilter) {
     console.log("");
   }
   if (plan.agentFiles.length > 0) {
-    console.log(`   Agents (${plan.agentFiles.length} files)`);
+    console.log(`   Agents (${plan.agentFiles.length} files):`);
+    for (const agentFile of plan.agentFiles) {
+      console.log(`     ${agentFile}`);
+    }
     console.log("");
   }
   if (plan.mcpServers.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamai-cli",
-  "version": "0.21.0-beta.3",
+  "version": "0.21.0-beta.8",
   "description": "TeamAI — the team harness for AI agents (skill sync + shared knowledge base, powered by Git)",
   "type": "module",
   "bin": {