teamai-cli 0.24.0-beta.8 → 0.24.0-beta.9

package/CHANGELOG.md

@@ -11,6 +11,8 @@ All notable changes to this project will be documented in this file. See [standa
 
 ### 🐛 Bug Fixes
 
+- The GitHub and CNB providers resolve their CLI to a launchable absolute path and start it through cross-spawn, so on Windows they no longer answer "installed" while every call fails silently ([#520](https://github.com/Tencent/teamai-cli/pull/520)).
+- `enabledAgents` now also gates CLI builtin deploy, CLAUDE.md-class injects, and last-pull skip-sync targets, so an already-installed tool outside the whitelist is not written to ([#510](https://github.com/Tencent/teamai-cli/issues/510)).
 - `teamai status` counts rule files in subdirectories recursively ([#437](https://github.com/Tencent/teamai-cli/pull/437)).
 - Codex Stop-phase contribution hints are deferred to the next prompt, so the host no longer rejects `additionalContext` ([#441](https://github.com/Tencent/teamai-cli/pull/441)).
 

package/README.md

@@ -199,6 +199,8 @@ teamai codebase --reconcile --output /path/to/repo # map product docs to code pa
 teamai codebase --lint --output /path/to/repo # check the locally extracted graph
 ```
 
+Extract writes `teamwiki/evidence/code/<project>/_manifest.json` even when AI enrichment is skipped or produces nothing, so `--deep-enrich` can start.
+
 The graph stores components, interfaces, configs, and cross-repo import edges. `teamai recall` uses it for graph-boosted re-ranking.
 When a recall hit comes from a codebase page, the result includes a `Sources:` line listing the relevant source file paths — giving agents a direct starting point for code changes instead of re-exploring the repo.
 

package/README.zh-CN.md

@@ -199,6 +199,8 @@ teamai codebase --reconcile --output /path/to/repo # 将产品文档映射到代
 teamai codebase --lint --output /path/to/repo # 检查本地提取的图谱
 ```
 
+只要 extract 发现了组件，就会写入 `teamwiki/evidence/code/<project>/_manifest.json`（包括跳过 AI 增强或增强没有产出的情况），因此 `--deep-enrich` 可以接着跑。
+
 图谱存储组件、接口、配置和跨仓库依赖边。`teamai recall` 利用图谱进行增强排名。
 当召回命中 codebase 页面时，结果会附带一行 `Sources:`，列出相关源文件路径，供 agent 直接作为代码改动的入口，无需重新探索代码库。
 

package/dist/index.js

@@ -171,6 +171,7 @@ __export(fs_exports, {
   listFiles: () => listFiles,
   listFilesRecursive: () => listFilesRecursive,
   pathExists: () => pathExists,
+  pruneEmptyDirs: () => pruneEmptyDirs,
   readFileSafe: () => readFileSafe,
   readJson: () => readJson,
   remove: () => remove,
@@ -255,6 +256,32 @@ async function copyDir(src, dest) {
     filter: (srcPath) => !isIgnored(path2.basename(srcPath))
   });
 }
+async function pruneEmptyDirs(target) {
+  const expanded = expandHome(target);
+  let entries;
+  try {
+    const stat8 = await fse.lstat(expanded);
+    if (!stat8.isDirectory() || stat8.isSymbolicLink()) return false;
+    entries = await fse.readdir(expanded, { withFileTypes: true });
+  } catch {
+    return false;
+  }
+  let empty = true;
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (!await pruneEmptyDirs(path2.join(expanded, entry.name))) empty = false;
+    } else {
+      empty = false;
+    }
+  }
+  if (!empty) return false;
+  try {
+    await fse.rmdir(expanded);
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function copyFile(src, dest) {
   const destExpanded = expandHome(dest);
   await fse.ensureDir(path2.dirname(destExpanded));
@@ -3215,7 +3242,7 @@ async function deployBuiltinRules(teamConfig, localConfig, options) {
       log.debug(`Skipping built-in rules for ${tool}: tool not installed`);
       continue;
     }
-    if (localConfig && isAgentDisabled(localConfig, tool)) continue;
+    if (localConfig && isAgentExcluded(localConfig, tool)) continue;
     const rulesDir = path14.join(baseDir, toolPath.rules);
     if (!await pathExists(rulesDir)) continue;
     try {
@@ -3454,7 +3481,7 @@ var init_pre_push_sync = __esm({
 });
 
 // src/providers/types.ts
-var RepoNotFoundError;
+var RepoNotFoundError, OrganizationNotFoundError, RepoCreatePermissionError;
 var init_types2 = __esm({
   "src/providers/types.ts"() {
     "use strict";
@@ -3464,6 +3491,26 @@ var init_types2 = __esm({
         this.name = "RepoNotFoundError";
       }
     };
+    OrganizationNotFoundError = class extends Error {
+      org;
+      createUrl;
+      constructor(org, createUrl) {
+        super(`Organization "${org}" not found.`);
+        this.name = "OrganizationNotFoundError";
+        this.org = org;
+        this.createUrl = createUrl;
+      }
+    };
+    RepoCreatePermissionError = class extends Error {
+      repo;
+      createUrl;
+      constructor(repo, createUrl) {
+        super(`No permission to create repo "${repo}".`);
+        this.name = "RepoCreatePermissionError";
+        this.repo = repo;
+        this.createUrl = createUrl;
+      }
+    };
   }
 });
 
@@ -4026,20 +4073,82 @@ var init_tgit = __esm({
   }
 });
 
-// src/providers/github/gh-cli.ts
-import { execSync as execSync2, spawnSync as spawnSync2 } from "child_process";
-function getGhPath() {
+// src/utils/cli-path.ts
+import { execFileSync } from "child_process";
+import { existsSync } from "fs";
+function pickWindowsCommand(whereOutput) {
+  const lines = whereOutput.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0);
+  for (const ext of WIN_EXEC_EXTENSIONS) {
+    const hit = lines.find((line) => line.toLowerCase().endsWith(ext));
+    if (hit !== void 0) return hit;
+  }
+  return null;
+}
+function whereOnWindows(cmd) {
   try {
-    const which = execSync2("which gh", {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
+    const out = execFileSync("where", [cmd], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      shell: false,
+      timeout: CLI_DETECT_TIMEOUT_MS
     });
-    const trimmed = which.trim();
-    return trimmed || null;
+    const p = pickWindowsCommand(out);
+    return p !== null && existsSync(p) ? p : null;
   } catch {
     return null;
   }
 }
+function whichOnPosix(cmd) {
+  try {
+    const p = execFileSync("bash", ["-lc", `command -v ${cmd}`], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      shell: false,
+      timeout: CLI_DETECT_TIMEOUT_MS
+    }).trim();
+    if (p && existsSync(p)) return p;
+  } catch {
+  }
+  try {
+    const p = execFileSync("zsh", ["-lc", `command -v ${cmd}`], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      shell: false,
+      timeout: CLI_DETECT_TIMEOUT_MS
+    }).trim();
+    if (p && existsSync(p)) return p;
+  } catch {
+  }
+  try {
+    const p = execFileSync("which", [cmd], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      shell: false,
+      timeout: CLI_DETECT_TIMEOUT_MS
+    }).trim();
+    if (p && existsSync(p)) return p;
+  } catch {
+  }
+  return null;
+}
+function resolveCliPath(cmd, platform = process.platform) {
+  return platform === "win32" ? whereOnWindows(cmd) : whichOnPosix(cmd);
+}
+var CLI_DETECT_TIMEOUT_MS, WIN_EXEC_EXTENSIONS;
+var init_cli_path = __esm({
+  "src/utils/cli-path.ts"() {
+    "use strict";
+    CLI_DETECT_TIMEOUT_MS = 5e3;
+    WIN_EXEC_EXTENSIONS = [".exe", ".cmd", ".bat"];
+  }
+});
+
+// src/providers/github/gh-cli.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import crossSpawn from "cross-spawn";
+function getGhPath() {
+  return resolveCliPath("gh");
+}
 function isGhInstalled() {
   return getGhPath() !== null;
 }
@@ -4052,14 +4161,14 @@ function ghExec(args, options) {
   }
   log.debug(`gh exec: ${ghPath} ${args.join(" ")}`);
   if (options?.inheritStdio) {
-    const result2 = spawnSync2(ghPath, args, {
+    const result2 = crossSpawn.sync(ghPath, args, {
       stdio: "inherit",
       env: { ...process.env, ...options.env ?? {} },
       cwd: options.cwd
     });
     return { stdout: "", stderr: "", status: result2.status ?? 1 };
   }
-  const result = spawnSync2(ghPath, args, {
+  const result = crossSpawn.sync(ghPath, args, {
     env: { ...process.env, ...options?.env ?? {} },
     encoding: "utf-8",
     maxBuffer: 10 * 1024 * 1024,
@@ -4307,6 +4416,7 @@ var init_gh_cli = __esm({
   "src/providers/github/gh-cli.ts"() {
     "use strict";
     init_logger();
+    init_cli_path();
     GITHUB_API = "https://api.github.com";
     RepoNotFoundError3 = class extends Error {
       constructor(repo) {
@@ -4569,14 +4679,20 @@ var init_github = __esm({
 });
 
 // src/providers/cnb/cnb-cli.ts
-import { execSync as execSync3, spawnSync as spawnSync3 } from "child_process";
+import { execSync as execSync2, spawnSync as spawnSync3 } from "child_process";
+import crossSpawn2 from "cross-spawn";
 function cnbExec(args, options) {
-  log.debug(`cnb exec: cnb ${args.join(" ")}`);
+  const cnbPath = resolveCliPath("cnb");
+  if (!cnbPath) {
+    log.debug("cnb CLI not found on PATH");
+    return { stdout: "", stderr: "cnb CLI not found on PATH", status: 127 };
+  }
+  log.debug(`cnb exec: ${cnbPath} ${args.join(" ")}`);
   if (options?.inheritStdio) {
-    const r2 = spawnSync3("cnb", args, { stdio: "inherit", env: { ...process.env }, cwd: options.cwd });
+    const r2 = crossSpawn2.sync(cnbPath, args, { stdio: "inherit", env: { ...process.env }, cwd: options.cwd });
     return { stdout: "", stderr: "", status: r2.status ?? 1 };
   }
-  const r = spawnSync3("cnb", args, {
+  const r = crossSpawn2.sync(cnbPath, args, {
     env: { ...process.env },
     encoding: "utf-8",
     maxBuffer: 10 * 1024 * 1024,
@@ -4598,12 +4714,7 @@ function assertCnbApiOk(out, action) {
   }
 }
 function isCnbInstalled() {
-  try {
-    execSync3("which cnb", { stdio: ["pipe", "pipe", "pipe"] });
-    return true;
-  } catch {
-    return false;
-  }
+  return resolveCliPath("cnb") !== null;
 }
 async function ensureCnbInstalled() {
   if (isCnbInstalled()) {
@@ -4612,7 +4723,7 @@ async function ensureCnbInstalled() {
   }
   const spin = spinner("Installing cnb CLI (@cnbcool/cnb-cli)...").start();
   try {
-    execSync3("npm install -g @cnbcool/cnb-cli", { stdio: ["pipe", "pipe", "pipe"], timeout: 12e4 });
+    execSync2("npm install -g @cnbcool/cnb-cli", { stdio: ["pipe", "pipe", "pipe"], timeout: 12e4 });
     if (!isCnbInstalled()) throw new Error("cnb not found on PATH after install");
     spin.succeed("cnb CLI installed");
   } catch (e) {
@@ -4646,7 +4757,7 @@ function cnbWhoami() {
 }
 function cnbLogin() {
   log.info("Starting cnb authentication (OAuth2 device flow)...");
-  const r = cnbExec(["login"], { inheritStdio: true });
+  const r = cnbExec(["login", "--host", CNB_HOST], { inheritStdio: true });
   if (r.status !== 0) throw new Error("cnb login failed. Please try again.");
 }
 function ensureCnbAuthenticated() {
@@ -4693,13 +4804,47 @@ function cnbRepoClone(repo, localPath) {
     const sanitized = out.replace(/cnb:[^@]+@/g, "cnb:***@").trim();
     throw new Error(`git clone failed: ${sanitized}`);
   }
+  if (!token) {
+    const cfg = spawnSync3("git", ["config", "--local", "credential.helper", "!cnb git-credential"], {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+      cwd: localPath
+    });
+    if (cfg.status !== 0) {
+      log.warn(`Could not persist CNB credential helper: ${(cfg.stderr ?? "").trim()}. Push/pull may prompt for credentials.`);
+    }
+  }
+}
+function cnbOrganizationCreateUrl() {
+  return `https://${CNB_HOST}/new/groups`;
+}
+function cnbRepoCreateUrl() {
+  return `https://${CNB_HOST}/new/repos`;
+}
+function cnbOrganizationExists(org) {
+  const r = cnbExec(["organizations", "get-group", "--group", org]);
+  const out = r.stdout || r.stderr;
+  if (/(?:^|["\s])status["\s:]+\s*200\b/.test(out)) return true;
+  if (/(?:^|["\s])status["\s:]+\s*404\b/.test(out) || /not found|不存在/i.test(out)) return false;
+  throw new Error(`cnb get-group failed for "${org}": ${out || `exit ${r.status}`}`);
 }
 async function cnbCreateRepo(owner, repo) {
-  const r = cnbExec(["repositories", "create-repo", "--slug", owner, "--name", repo]);
-  if (r.status !== 0) {
-    throw new Error(`cnb create-repo failed: ${r.stderr || r.stdout}`);
+  try {
+    const r = cnbExec(["repositories", "create-repo", "--slug", owner, "--name", repo]);
+    if (r.status !== 0) {
+      throw new Error(`cnb create-repo failed: ${r.stderr || r.stdout}`);
+    }
+    assertCnbApiOk(r.stdout, "create-repo");
+  } catch (e) {
+    const msg = e.message;
+    if (/HTTP 404|not found|不存在/i.test(msg)) {
+      throw new OrganizationNotFoundError(owner, cnbOrganizationCreateUrl());
+    }
+    if (/HTTP 403|scope|permission|forbidden|权限/i.test(msg)) {
+      throw new RepoCreatePermissionError(`${owner}/${repo}`, cnbRepoCreateUrl());
+    }
+    throw e;
   }
-  assertCnbApiOk(r.stdout, "create-repo");
 }
 function cnbPullCreate(opts) {
   const args = [
@@ -4732,6 +4877,8 @@ var init_cnb_cli = __esm({
   "src/providers/cnb/cnb-cli.ts"() {
     "use strict";
     init_logger();
+    init_cli_path();
+    init_types2();
     CNB_HOST = process.env.TEAMAI_CNB_HOST?.trim() || "cnb.cool";
     CnbRepoNotFoundError = class extends Error {
       constructor(repo) {
@@ -4781,6 +4928,12 @@ var init_cnb = __esm({
       async createRepo(owner, repo) {
         await cnbCreateRepo(owner, repo);
       }
+      organizationExists(org) {
+        return cnbOrganizationExists(org);
+      }
+      getOrganizationCreateUrl() {
+        return cnbOrganizationCreateUrl();
+      }
       async createPullRequest(opts) {
         return cnbPullCreate({
           repo: opts.repo,
@@ -6320,6 +6473,8 @@ __export(providers_exports, {
   GitCodeProvider: () => GitCodeProvider,
   GitHubProvider: () => GitHubProvider,
   GitLabProvider: () => GitLabProvider,
+  OrganizationNotFoundError: () => OrganizationNotFoundError,
+  RepoCreatePermissionError: () => RepoCreatePermissionError,
   RepoNotFoundError: () => RepoNotFoundError,
   TGitProvider: () => TGitProvider,
   detectProvider: () => detectProvider,
@@ -6394,7 +6549,7 @@ async function deployBuiltinSkills(teamConfig, localConfig, options) {
       log.debug(`Skipping built-in skill deployment for ${tool}: tool not installed`);
       continue;
     }
-    if (localConfig && isAgentDisabled(localConfig, tool)) continue;
+    if (localConfig && isAgentExcluded(localConfig, tool)) continue;
     for (const skillName of skillNames) {
       const srcDir = path18.join(builtinDir, skillName);
       const destDir = await resolveSkillDestination(tool, toolPath.skills, baseDir, skillName, srcDir);
@@ -6740,7 +6895,7 @@ var init_session_id = __esm({
 
 // src/pid-monitor.ts
 import fs9 from "fs";
-import { execSync as execSync4 } from "child_process";
+import { execSync as execSync3 } from "child_process";
 function getParentPid(pid) {
   try {
     const stat8 = fs9.readFileSync(`/proc/${pid}/stat`, "utf-8");
@@ -6752,7 +6907,7 @@ function getParentPid(pid) {
   } catch {
   }
   try {
-    const out = execSync4(`ps -o ppid= -p ${pid}`, {
+    const out = execSync3(`ps -o ppid= -p ${pid}`, {
       encoding: "utf-8",
       timeout: 2e3,
       stdio: ["pipe", "pipe", "pipe"]
@@ -6769,7 +6924,7 @@ function getProcessComm(pid) {
   } catch {
   }
   try {
-    const out = execSync4(`ps -o comm= -p ${pid}`, {
+    const out = execSync3(`ps -o comm= -p ${pid}`, {
       encoding: "utf-8",
       timeout: 2e3,
       stdio: ["pipe", "pipe", "pipe"]
@@ -7878,7 +8033,7 @@ var init_agent_version = __esm({
 // src/machine-id.ts
 import crypto2 from "crypto";
 import fs11 from "fs";
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 import os6 from "os";
 function getMachineId() {
   if (cachedMachineId !== null) return cachedMachineId;
@@ -7904,7 +8059,7 @@ function detectMachineId(platform = process.platform) {
   return id || os6.hostname() || "";
 }
 function readDarwinMachineId() {
-  const out = execFileSync("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
+  const out = execFileSync2("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
     encoding: "utf-8",
     timeout: 3e3
   });
@@ -7912,7 +8067,7 @@ function readDarwinMachineId() {
   return match ? match[1].trim() : "";
 }
 function readWindowsMachineId() {
-  const out = execFileSync(
+  const out = execFileSync2(
     "reg",
     ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"],
     { encoding: "utf-8", timeout: 3e3 }
@@ -11765,9 +11920,16 @@ async function scanTeamRepoNamespaces(repoPath) {
   for (const dir of topDirs) {
     const dirPath = path29.join(teamSkillsDir, dir);
     const hasSkillMd = await pathExists(path29.join(dirPath, "SKILL.md"));
-    if (!hasSkillMd) {
-      namespaces.push(dir);
+    if (hasSkillMd) continue;
+    const subDirs = await listDirs(dirPath);
+    let holdsSkill = false;
+    for (const subDir of subDirs) {
+      if (await pathExists(path29.join(dirPath, subDir, "SKILL.md"))) {
+        holdsSkill = true;
+        break;
+      }
     }
+    if (holdsSkill) namespaces.push(dir);
   }
   return namespaces;
 }
@@ -13182,7 +13344,7 @@ async function deployBuiltinAgents(teamConfig, localConfig, options) {
       log.debug(`Skipping built-in agent deployment for ${tool}: tool not installed`);
       continue;
     }
-    if (localConfig && isAgentDisabled(localConfig, tool)) continue;
+    if (localConfig && isAgentExcluded(localConfig, tool)) continue;
     if (!ALL_SUPPORTED_TOOLS.includes(tool)) {
       log.warn(
         `Skipping built-in agent deployment for ${tool}: unsupported agent format; disable this target or add a native renderer`
@@ -15700,6 +15862,15 @@ async function initSelfRepo(options) {
   log.info("  4. Push your business repo (e.g. `git push -u origin HEAD`) so teammates get the .teamai/ knowledge and are auto-initialized on clone.");
   closePrompt();
 }
+function guideWebCreation(kind, name, url) {
+  log.info(`${kind} "${name}" can't be created from the CLI (insufficient token permission).`);
+  if (url) {
+    log.info(`Create it here, then re-run this command:`);
+    log.info(`  ${url}`);
+  } else {
+    log.info(`Create the ${kind} on the platform, then re-run this command.`);
+  }
+}
 async function init(options) {
   if (options.http) {
     return initHttp(options.http, options);
@@ -15851,6 +16022,23 @@ async function init(options) {
     } catch (e) {
       if (e instanceof RepoNotFoundError) {
         cloneSpin.info(`Repo ${repoInfo.owner}/${repoInfo.repo} does not exist`);
+        if (typeof provider.organizationExists === "function") {
+          let orgMissing = false;
+          try {
+            orgMissing = !provider.organizationExists(repoInfo.owner);
+          } catch (checkErr) {
+            log.debug(`Organization check failed: ${checkErr.message}`);
+          }
+          if (orgMissing) {
+            cloneSpin.info(`Organization "${repoInfo.owner}" does not exist`);
+            guideWebCreation(
+              "organization",
+              repoInfo.owner,
+              provider.getOrganizationCreateUrl?.() ?? null
+            );
+            process.exit(1);
+          }
+        }
         const confirmed = await askConfirmation(
           `Create repo ${repoInfo.owner}/${repoInfo.repo}? [Y/n] `,
           true
@@ -15864,6 +16052,16 @@ async function init(options) {
           await provider.createRepo(repoInfo.owner, repoInfo.repo);
           createSpin.succeed(`Repo ${repoInfo.owner}/${repoInfo.repo} created`);
         } catch (ce) {
+          if (ce instanceof OrganizationNotFoundError) {
+            createSpin.fail(`Organization "${ce.org}" does not exist`);
+            guideWebCreation("organization", ce.org, ce.createUrl ?? null);
+            process.exit(1);
+          }
+          if (ce instanceof RepoCreatePermissionError) {
+            createSpin.fail(`No permission to create repo "${ce.repo}" from the CLI`);
+            guideWebCreation("repo", ce.repo, ce.createUrl ?? null);
+            process.exit(1);
+          }
           const msg = ce.message;
           if (/already been taken|already exists/i.test(msg)) {
             createSpin.info(`Repo ${repoInfo.owner}/${repoInfo.repo} already exists, retrying clone`);
@@ -16244,6 +16442,9 @@ ${items.map((i) => `- [${i.type}] ${i.name}`).join("\n")}`
       items: toPendingItems(items)
     });
     await checkoutMaster(localConfig.repo.localPath);
+    for (const rel of pushedFiles) {
+      await pruneEmptyDirs(path45.resolve(localConfig.repo.localPath, rel));
+    }
     return true;
   } catch (e) {
     pushSpin.fail(`Push failed: ${e.message}`);
@@ -22024,7 +22225,7 @@ async function refreshTeamRepo(localConfig) {
     if (!apiKey) {
       throw new Error("No API key configured. Re-run `teamai init --http <url> --token <key>` or set TEAMAI_API_TOKEN.");
     }
-    return { label: "HTTP (report/sync delivery)", version: null, reportingOnly: true, submodulesFailed: false };
+    return { label: "HTTP (report/sync delivery)", version: null, reportingOnly: true, submodulesFailed: false, submodulesChanged: false };
   }
   if (localConfig.repo.kind === "self") {
     try {
@@ -22038,7 +22239,7 @@ async function refreshTeamRepo(localConfig) {
     } catch {
       version3 = null;
     }
-    return { label: "single-repo (knowledge on main)", version: version3, reportingOnly: false, submodulesFailed: false };
+    return { label: "single-repo (knowledge on main)", version: version3, reportingOnly: false, submodulesFailed: false, submodulesChanged: false };
   }
   const result = await pullRepo(localConfig.repo.localPath);
   try {
@@ -22054,17 +22255,34 @@ async function refreshTeamRepo(localConfig) {
     version2 = null;
   }
   let submodulesFailed = false;
+  let submodulesChanged = false;
   try {
     const teamConfig = await loadTeamConfig(localConfig.repo.localPath);
     if (teamConfig?.submodules) {
-      await createGit2(localConfig.repo.localPath).submoduleUpdate(["--init"]);
-      log.debug("Submodules updated");
+      const git = createGit2(localConfig.repo.localPath);
+      let before = null;
+      try {
+        before = await git.subModule(["status"]);
+      } catch {
+        before = null;
+      }
+      await git.submoduleUpdate(["--init"]);
+      let after = null;
+      try {
+        after = await git.subModule(["status"]);
+      } catch {
+        after = null;
+      }
+      submodulesChanged = before === null || before !== after;
+      log.debug(
+        submodulesChanged ? "Submodules updated (tree changed \u2014 full sync this pull)" : "Submodules updated (no change)"
+      );
     }
   } catch (e) {
     submodulesFailed = true;
     log.warn(`Submodule update failed for ${localConfig.repo.localPath}: ${e.message}`);
   }
-  return { label: result, version: version2, reportingOnly: false, submodulesFailed };
+  return { label: result, version: version2, reportingOnly: false, submodulesFailed, submodulesChanged };
 }
 async function usageReportDisabled(repoPath) {
   return (await loadTeamConfig(repoPath))?.usageReport === false;
@@ -22183,7 +22401,7 @@ async function skillSafeToRemove(deployedDir, source) {
 async function cleanupInactiveNamespaceSkills(teamConfig, localConfig, retainedSkillNames, inactiveSkillNames, inactiveSkillSources) {
   const baseDir = resolveBaseDir(localConfig);
   for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
-    if (isAgentDisabled(localConfig, tool)) continue;
+    if (isAgentExcluded(localConfig, tool)) continue;
     if (!toolPath.skills) continue;
     if (!await ResourceHandler.isToolInstalled(toolPath.skills, baseDir)) continue;
     if (!await pathExists(path65.join(baseDir, toolPath.skills))) continue;
@@ -22244,7 +22462,7 @@ async function getInstalledResourceTargets(teamConfig, localConfig) {
   const baseDir = resolveBaseDir(localConfig);
   const targets = [];
   for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
-    if (isAgentDisabled(localConfig, tool)) continue;
+    if (isAgentExcluded(localConfig, tool)) continue;
     const resourcePaths = [toolPath.skills, toolPath.rules, toolPath.agents].filter((resourcePath) => !!resourcePath);
     for (const resourcePath of resourcePaths) {
       if (await ResourceHandler.isToolInstalled(resourcePath, baseDir)) {
@@ -22268,18 +22486,20 @@ async function pullForScope(localConfig, options, policy = {}) {
   let currentRev = null;
   let reportingOnly = false;
   let submodulesFailed = false;
+  let submodulesChanged = false;
   try {
     const refresh = await refreshTeamRepo(localConfig);
     currentRev = refresh.version;
     reportingOnly = refresh.reportingOnly;
     submodulesFailed = refresh.submodulesFailed;
+    submodulesChanged = refresh.submodulesChanged;
     pullSpin.succeed(`[${scopeLabel}] Team repo: ${refresh.label}`);
   } catch (e) {
     pullSpin.fail(`[${scopeLabel}] Pull failed: ${e.message}`);
     return;
   }
   let currentTargets = null;
-  if (!options.force && !options.dryRun) {
+  if (!options.force && !options.dryRun && !submodulesChanged) {
     try {
       const state = await loadStateForScope(localConfig);
       if (currentRev && state[revisionField] && state[revisionField] === currentRev) {
@@ -22460,7 +22680,7 @@ async function pullForScope(localConfig, options, policy = {}) {
         const dir = toolPath[toolPathField];
         if (!dir) continue;
         if (!await ResourceHandler.isToolInstalled(dir, baseDir)) continue;
-        if (isAgentDisabled(localConfig, tool)) continue;
+        if (isAgentExcluded(localConfig, tool)) continue;
         const extensions = type === "rules" ? [.../* @__PURE__ */ new Set([ruleFileExtensionForTool(tool), ".md"])] : [ext];
         for (const name of tombstones) {
           for (const extension of extensions) {
@@ -22490,7 +22710,7 @@ async function pullForScope(localConfig, options, policy = {}) {
   if (!options.dryRun && desiredSkillNames && knownRepoSkillNames) {
     const baseDir = resolveBaseDir(localConfig);
     for (const [tool, toolPath] of Object.entries(scopedToolPaths(freshConfig, localConfig))) {
-      if (isAgentDisabled(localConfig, tool)) continue;
+      if (isAgentExcluded(localConfig, tool)) continue;
       if (!toolPath.skills) continue;
       if (!await ResourceHandler.isToolInstalled(toolPath.skills, baseDir)) continue;
       const skillsDir = path65.join(baseDir, toolPath.skills);
@@ -22609,7 +22829,7 @@ async function pullForScope(localConfig, options, policy = {}) {
           if (compiled) {
             const baseDir = resolveBaseDir(localConfig);
             for (const [tool, toolPath] of Object.entries(scopedToolPaths(freshConfig, localConfig))) {
-              if (isAgentDisabled(localConfig, tool)) continue;
+              if (isAgentExcluded(localConfig, tool)) continue;
               if (!toolPath.claudemd) continue;
               if (toolPath.rules && !await ResourceHandler.isToolInstalled(toolPath.rules, baseDir)) continue;
               const claudeMdPath = path65.join(baseDir, toolPath.claudemd);
@@ -22639,7 +22859,7 @@ async function pullForScope(localConfig, options, policy = {}) {
         if (compiled) {
           const baseDir = resolveBaseDir(localConfig);
           for (const [tool, toolPath] of Object.entries(scopedToolPaths(freshConfig, localConfig))) {
-            if (isAgentDisabled(localConfig, tool)) continue;
+            if (isAgentExcluded(localConfig, tool)) continue;
             if (!toolPath.claudemd) continue;
             if (toolPath.rules && !await ResourceHandler.isToolInstalled(toolPath.rules, baseDir)) continue;
             const claudeMdPath = path65.join(baseDir, toolPath.claudemd);
@@ -22818,7 +23038,7 @@ async function injectRecallBlockIntoTools(config, localConfig, scopeLabel) {
     const recallBlock = compileRecallRulesBlock();
     let injected = 0;
     for (const [tool, toolPath] of Object.entries(scopedToolPaths(config, localConfig))) {
-      if (isAgentDisabled(localConfig, tool)) continue;
+      if (isAgentExcluded(localConfig, tool)) continue;
       if (!toolPath.claudemd || !toolPath.agents) continue;
       if (!await ResourceHandler.isToolInstalled(toolPath.agents, baseDir)) continue;
       const claudeMdPath = path65.join(baseDir, toolPath.claudemd);
@@ -27057,67 +27277,7 @@ __export(ai_client_exports, {
   pickWindowsCommand: () => pickWindowsCommand,
   resolveCliPath: () => resolveCliPath
 });
-import { execFileSync as execFileSync2 } from "child_process";
 import spawn2 from "cross-spawn";
-import { existsSync } from "fs";
-function pickWindowsCommand(whereOutput) {
-  const lines = whereOutput.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0);
-  for (const ext of WIN_EXEC_EXTENSIONS) {
-    const hit = lines.find((line) => line.toLowerCase().endsWith(ext));
-    if (hit !== void 0) return hit;
-  }
-  return null;
-}
-function whereOnWindows(cmd) {
-  try {
-    const out = execFileSync2("where", [cmd], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      shell: false,
-      timeout: CLI_DETECT_TIMEOUT_MS
-    });
-    const p = pickWindowsCommand(out);
-    return p !== null && existsSync(p) ? p : null;
-  } catch {
-    return null;
-  }
-}
-function whichOnPosix(cmd) {
-  try {
-    const p = execFileSync2("bash", ["-lc", `command -v ${cmd}`], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      shell: false,
-      timeout: CLI_DETECT_TIMEOUT_MS
-    }).trim();
-    if (p && existsSync(p)) return p;
-  } catch {
-  }
-  try {
-    const p = execFileSync2("zsh", ["-lc", `command -v ${cmd}`], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      shell: false,
-      timeout: CLI_DETECT_TIMEOUT_MS
-    }).trim();
-    if (p && existsSync(p)) return p;
-  } catch {
-  }
-  try {
-    const p = execFileSync2("which", [cmd], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      shell: false,
-      timeout: CLI_DETECT_TIMEOUT_MS
-    }).trim();
-    if (p && existsSync(p)) return p;
-  } catch {
-  }
-  return null;
-}
-function resolveCliPath(cmd, platform = process.platform) {
-  return platform === "win32" ? whereOnWindows(cmd) : whichOnPosix(cmd);
-}
 function detectClaudeCli() {
   for (const cmd of ALLOWED_CLI_CANDIDATES) {
     const absPath = resolveCliPath(cmd);
@@ -27232,11 +27392,13 @@ async function runWithConcurrency(tasks, concurrency) {
   await Promise.all(promises);
   return results;
 }
-var ALLOWED_CLI_CANDIDATES, CLI_DETECT_TIMEOUT_MS, WIN_EXEC_EXTENSIONS, DEFAULT_TIMEOUT_MS, DEFAULT_CONCURRENCY, _cliInfo;
+var ALLOWED_CLI_CANDIDATES, DEFAULT_TIMEOUT_MS, DEFAULT_CONCURRENCY, _cliInfo;
 var init_ai_client = __esm({
   "src/utils/ai-client.ts"() {
     "use strict";
     init_logger();
+    init_cli_path();
+    init_cli_path();
     ALLOWED_CLI_CANDIDATES = [
       "claude",
       "claude-internal",
@@ -27248,8 +27410,6 @@ var init_ai_client = __esm({
       "workbuddy",
       "openclaw"
     ];
-    CLI_DETECT_TIMEOUT_MS = 5e3;
-    WIN_EXEC_EXTENSIONS = [".exe", ".cmd", ".bat"];
     DEFAULT_TIMEOUT_MS = 6e5;
     DEFAULT_CONCURRENCY = 3;
   }
@@ -33182,7 +33342,7 @@ var init_import_iwiki = __esm({
 });
 
 // src/providers/github/mr-fetch.ts
-import { execSync as execSync5 } from "child_process";
+import { execSync as execSync4 } from "child_process";
 import https2 from "https";
 function parseGitHubPRUrl(url) {
   const match = url.match(/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/);
@@ -33269,12 +33429,12 @@ async function fetchGitHubPR(url) {
   const repoArg = `${owner}/${repo}`;
   log.debug(`fetchGitHubPR: ${repoArg}#${number}`);
   try {
-    const viewOutput = execSync5(
+    const viewOutput = execSync4(
       `gh pr view ${number} --repo ${repoArg} --json title,body,author,mergedAt,commits`,
       { maxBuffer: 10 * 1024 * 1024, encoding: "utf8" }
     );
     const prView = JSON.parse(viewOutput);
-    const rawDiff = execSync5(
+    const rawDiff = execSync4(
       `gh pr diff ${number} --repo ${repoArg}`,
       { maxBuffer: 50 * 1024 * 1024, encoding: "utf8" }
     );
@@ -33688,7 +33848,7 @@ var init_import_mr = __esm({
 });
 
 // src/codebase.ts
-import { execSync as execSync6 } from "child_process";
+import { execSync as execSync5 } from "child_process";
 import fs36 from "fs";
 import path103 from "path";
 import matter12 from "gray-matter";
@@ -33704,7 +33864,7 @@ ${commitMessages}`);
     log.debug(`gatherRepoContext: git log \u5931\u8D25 \u2014 ${String(err)}`);
   }
   try {
-    const rawTree = execSync6(
+    const rawTree = execSync5(
       'find . -maxdepth 4 -not -path "*/.git/*" -not -path "*/node_modules/*" -not -path "*/__pycache__/*" -not -path "*/dist/*" -not -path "*/.claude/worktrees/*" -not -name "*.js.map"',
       { cwd: repoPath, encoding: "utf-8" }
     );
@@ -36853,9 +37013,12 @@ var init_templates = __esm({
 // src/enrich-with-ai.ts
 var enrich_with_ai_exports = {};
 __export(enrich_with_ai_exports, {
+  buildFallbackManifest: () => buildFallbackManifest,
+  describeEvidenceManifest: () => describeEvidenceManifest,
   edgeProvenanceRank: () => edgeProvenanceRank,
   edgeReason: () => edgeReason,
   enrichWithAI: () => enrichWithAI,
+  groupFactsByModule: () => groupFactsByModule,
   parseEdgeProvenance: () => parseEdgeProvenance,
   writeManifest: () => writeManifest
 });
@@ -36925,6 +37088,62 @@ function resolveImportToModule(importerFile, importPath) {
   if (first.startsWith("@")) return void 0;
   return first;
 }
+function groupFactsByModule(facts) {
+  const modules = /* @__PURE__ */ new Map();
+  for (const fact of facts) {
+    if (fact.kind === "relation") continue;
+    const mod = fact.file.split("/")[0] || "_root";
+    const existing = modules.get(mod) ?? [];
+    existing.push(fact);
+    modules.set(mod, existing);
+  }
+  return modules;
+}
+function isSafeSlug(name) {
+  try {
+    assertSafeResourceName(name);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function buildFallbackManifest(ctx) {
+  const moduleNames = [...ctx.modules.keys()].filter(isSafeSlug);
+  const componentNames = [...new Set(
+    ctx.facts.filter((f) => f.kind === "component").map((f) => f.name)
+  )].filter(isSafeSlug);
+  const slugs = moduleNames.length > 0 ? moduleNames : componentNames;
+  if (slugs.length === 0) return null;
+  const components = slugs.map((name) => {
+    const moduleFacts = ctx.modules.get(name) ?? ctx.facts.filter((f) => f.name === name);
+    const entrypoints = moduleFacts.filter((f) => f.kind === "component").filter((f) => /handler|route|controller|endpoint|main|server|app/i.test(f.name)).slice(0, 5).map((f) => `${f.name} (${f.file}:${f.lineStart})`);
+    return {
+      slug: name,
+      docPath: `evidence/code/${ctx.project}/${name}.md`,
+      title: name,
+      category: "component",
+      confidence: "EXTRACTED",
+      ...entrypoints.length > 0 ? { entrypoints } : {}
+    };
+  });
+  return {
+    schemaVersion: "team-wiki.codebase-output-manifest.v2",
+    project: ctx.project,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    components,
+    edges: []
+  };
+}
+function describeEvidenceManifest(source, componentCount) {
+  if (source === "fallback") {
+    const noun = componentCount === 1 ? "component" : "components";
+    return `Wrote fallback _manifest.json (${componentCount} ${noun}, no AI enrich)`;
+  }
+  if (source === "none") {
+    return "AI enrich produced no manifest; deep-enrich will have no components";
+  }
+  return void 0;
+}
 async function enrichWithAI(ctx) {
   const moduleEntries = [...ctx.modules.entries()].filter(([, facts]) => facts.length >= 5);
   if (moduleEntries.length === 0) {
@@ -37063,6 +37282,7 @@ var init_enrich_with_ai = __esm({
     "use strict";
     init_ai_client();
     init_logger();
+    init_path_safety();
   }
 });
 
@@ -37584,39 +37804,53 @@ async function extractCodebase(opts) {
   const repoGraph = mergeGraphs(graph, overlay);
   await saveGraphIndex(wikiRoot, repoGraph);
   let aiDomains = [];
+  let manifestSource = "none";
+  let manifestComponentCount = 0;
+  const {
+    enrichWithAI: enrichWithAI2,
+    writeManifest: writeManifest2,
+    buildFallbackManifest: buildFallbackManifest2,
+    groupFactsByModule: groupFactsByModule2,
+    describeEvidenceManifest: describeEvidenceManifest2
+  } = await Promise.resolve().then(() => (init_enrich_with_ai(), enrich_with_ai_exports));
+  const modules = groupFactsByModule2(facts);
   if (opts.skipEnrich) {
     if (!opts.json) console.log(chalk3.dim("  [AI enrich: skipped (--skip-enrich)]"));
-  } else try {
-    const { enrichWithAI: enrichWithAI2, writeManifest: writeManifest2 } = await Promise.resolve().then(() => (init_enrich_with_ai(), enrich_with_ai_exports));
-    const modules = /* @__PURE__ */ new Map();
-    for (const fact of facts) {
-      if (fact.kind === "relation") continue;
-      const mod = fact.file.split("/")[0] || "_root";
-      const existing = modules.get(mod) ?? [];
-      existing.push(fact);
-      modules.set(mod, existing);
-    }
-    const enrichResult = await enrichWithAI2({ project, facts, interfaceInventory, modules });
-    if (enrichResult) {
-      await writeManifest2(enrichResult.manifest, evidenceDir);
-      aiDomains = enrichResult.domains;
-      const domainMeta = {
-        domain: enrichResult.repoDomain || (enrichResult.domains[0]?.name ?? ""),
-        description: enrichResult.repoDescription || "",
-        keywords: enrichResult.repoKeywords || [],
-        components: enrichResult.domains[0]?.components ?? []
-      };
-      await writeFile10(path112.join(evidenceDir, "_domains.json"), JSON.stringify(domainMeta, null, 2), "utf-8");
+  } else {
+    try {
+      const enrichResult = await enrichWithAI2({ project, facts, interfaceInventory, modules });
+      if (enrichResult) {
+        await writeManifest2(enrichResult.manifest, evidenceDir);
+        manifestSource = "ai";
+        manifestComponentCount = enrichResult.manifest.components.length;
+        aiDomains = enrichResult.domains;
+        const domainMeta = {
+          domain: enrichResult.repoDomain || (enrichResult.domains[0]?.name ?? ""),
+          description: enrichResult.repoDescription || "",
+          keywords: enrichResult.repoKeywords || [],
+          components: enrichResult.domains[0]?.components ?? []
+        };
+        await writeFile10(path112.join(evidenceDir, "_domains.json"), JSON.stringify(domainMeta, null, 2), "utf-8");
+        if (!opts.json) {
+          const domainLabel = domainMeta.domain || "uncategorized";
+          console.log(`  AI enrich: ${enrichResult.manifest.components.length} modules, domain=${domainLabel}`);
+        }
+      }
+    } catch (e) {
       if (!opts.json) {
-        const domainLabel = domainMeta.domain || "uncategorized";
-        console.log(`  AI enrich: ${enrichResult.manifest.components.length} modules, domain=${domainLabel}`);
+        console.log(chalk3.dim(`  [AI enrich skipped: ${e.message}]`));
       }
     }
-  } catch (e) {
-    if (!opts.json) {
-      console.log(chalk3.dim(`  [AI enrich skipped: ${e.message}]`));
+  }
+  if (manifestSource === "none") {
+    const fallback = buildFallbackManifest2({ project, facts, modules });
+    if (fallback && fallback.components.length > 0) {
+      await writeManifest2(fallback, evidenceDir);
+      manifestSource = "fallback";
+      manifestComponentCount = fallback.components.length;
     }
   }
+  const manifestNote = describeEvidenceManifest2(manifestSource, manifestComponentCount);
   const moduleSummaries = buildModuleSummaries(facts, graph, project);
   if (moduleSummaries.size > 0) {
     const modulesDir = path112.join(evidenceDir, "modules");
@@ -37727,7 +37961,13 @@ async function extractCodebase(opts) {
     facts: { total: facts.length, byKind },
     graph: { nodes: repoGraph.nodes.length, edges: repoGraph.edges.length },
     incremental: !!opts.incremental && !!changedFiles,
-    outputDir: wikiRoot
+    outputDir: wikiRoot,
+    manifest: {
+      written: manifestSource !== "none",
+      source: manifestSource,
+      components: manifestComponentCount,
+      ...manifestNote ? { note: manifestNote } : {}
+    }
   };
   if (opts.json) {
     console.log(JSON.stringify(result, null, 2));
@@ -37745,6 +37985,9 @@ async function extractCodebase(opts) {
       console.log(`  Call chains: ${callChains.length} chains (max depth ${Math.max(...callChains.map((c) => c.depth))})`);
     }
     console.log(`  Output: ${wikiRoot}`);
+    if (manifestNote) {
+      console.log(`  ${manifestNote}`);
+    }
   }
 }
 var init_codebase_extract = __esm({
@@ -38013,7 +38256,8 @@ var init_repo_cache = __esm({
 // src/deep-enrich.ts
 var deep_enrich_exports = {};
 __export(deep_enrich_exports, {
-  deepEnrich: () => deepEnrich
+  deepEnrich: () => deepEnrich,
+  runHiddenDeepEnrich: () => runHiddenDeepEnrich
 });
 import { readFile as readFile11, writeFile as writeFile11, readdir as readdir4, mkdir as mkdir8, unlink as unlink2 } from "fs/promises";
 import path114 from "path";
@@ -38595,6 +38839,18 @@ async function invalidateStaleAiDocs(docsDir, slugs) {
   await removeIfExists(architectureDocPath(docsDir));
   await removeIfExists(path114.join(docsDir, "graph-g5-scenarios.md"));
 }
+async function runHiddenDeepEnrich(opts) {
+  const wikiRoot = opts.wikiRoot ?? path114.join(process.cwd(), ".teamai", "team-repo", "teamwiki");
+  const evidenceDir = path114.join(wikiRoot, "evidence", "code", opts.project);
+  const result = await deepEnrich({
+    project: opts.project,
+    evidenceDir,
+    wikiRoot,
+    maxModules: opts.maxModules
+  });
+  if (!result.complete) process.exitCode = 1;
+  return result;
+}
 async function deepEnrich(opts) {
   const { project, evidenceDir } = opts;
   const docsDir = path114.join(evidenceDir, "docs");
@@ -40807,7 +41063,7 @@ async function codebaseCmd(opts) {
       componentCount = 0;
     }
     if (componentCount === 0) {
-      console.log(`No components in evidence for project "${project}". Run \`teamai codebase --extract\` first.`);
+      console.log(`No components in _manifest.json for project "${project}".`);
       process.exitCode = 1;
       return;
     }
@@ -42451,11 +42707,12 @@ ciCmd.command("extract-mr").description("Extract knowledge from MR/PR and post a
   await ciExtractMr2({ ...globalOpts, ...cmdOpts });
 });
 program.command("deep-enrich", { hidden: true }).description("Run deep AI knowledge generation for an imported repo").requiredOption("--project <slug>", "Project slug (directory name in evidence/code/)").option("--wiki-root <path>", "Teamwiki root path").option("--max-modules <n>", "Max modules to process (cost control)", parseInt).action(async (cmdOpts) => {
-  const p = await import("path");
-  const wikiRoot = cmdOpts.wikiRoot ?? p.join(process.cwd(), ".teamai", "team-repo", "teamwiki");
-  const evidenceDir = p.join(wikiRoot, "evidence", "code", cmdOpts.project);
-  const { deepEnrich: deepEnrich2 } = await Promise.resolve().then(() => (init_deep_enrich(), deep_enrich_exports));
-  await deepEnrich2({ project: cmdOpts.project, evidenceDir, wikiRoot, maxModules: cmdOpts.maxModules });
+  const { runHiddenDeepEnrich: runHiddenDeepEnrich2 } = await Promise.resolve().then(() => (init_deep_enrich(), deep_enrich_exports));
+  await runHiddenDeepEnrich2({
+    project: cmdOpts.project,
+    wikiRoot: cmdOpts.wikiRoot,
+    maxModules: cmdOpts.maxModules
+  });
 });
 recallCmd.command("feedback").description("Record manual feedback for a recalled document").option("--positive <docId>", "Upvote a document (marks as actually useful)").option("--negative <docId>", "Record negative signal for a document").action(async (cmdOpts) => {
   const { recallFeedback: recallFeedback2 } = await Promise.resolve().then(() => (init_votes(), votes_exports));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamai-cli",
-  "version": "0.24.0-beta.8",
+  "version": "0.24.0-beta.9",
   "description": "TeamAI — Make Every Team AI Native (skill sync + shared knowledge base, powered by Git)",
   "type": "module",
   "bin": {