@retasc/cli 1.10.0 → 1.11.0

package/dist/auth.js

@@ -1,6 +1,7 @@
 import { ConvexHttpClient } from "convex/browser";
 import { makeFunctionReference } from "convex/server";
 import { loadConfig, patchConfig } from "./config.js";
+import { ask, isInteractive } from "./lib/prompt.js";
 // The GitHub OAuth App's PUBLIC client id (safe to ship — device flow needs no
 // secret). Baked in so `retasc login` works out-of-the-box; override via env.
 const GITHUB_CLIENT_ID = process.env.RETASC_GITHUB_CLIENT_ID ?? "Ov23linqRy875IU8OYTW";
@@ -8,9 +9,16 @@ const DEVICE_CODE_URL = "https://github.com/login/device/code";
 const TOKEN_URL = "https://github.com/login/oauth/access_token";
 const GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 // Convex Auth's own public sign-in action. We call it with the "github-device"
-// credentials provider; it verifies the GitHub token server-side and returns a
-// session ({ tokens: { token, refreshToken } }).
+// or "google-device" credentials provider; it verifies the upstream token
+// server-side and returns a session ({ tokens: { token, refreshToken } }).
 const signIn = makeFunctionReference("auth:signIn");
+// RTSC-508 — the Google device flow's two legs, both server-side. Google, unlike
+// GitHub, requires a client SECRET on the token exchange, and a published npm
+// package cannot hold one. So there is deliberately no Google client id in this
+// file either: the CLI never talks to Google directly, so it never needs one, and
+// rotating that client becomes a Convex env change with no CLI release.
+const googleDeviceStart = makeFunctionReference("googleDevice:start");
+const googleDevicePoll = makeFunctionReference("googleDevice:poll");
 async function postForm(url, body) {
     const res = await fetch(url, {
         method: "POST",
@@ -20,11 +28,14 @@ async function postForm(url, body) {
     return res.json();
 }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-/**
- * Run the full GitHub device-flow login and persist the resulting Convex Auth
- * session to ~/.retasc/config.json. Prints the user code + verification URL.
- */
-export async function deviceLogin() {
+/** Print the two lines a human has to act on, identically for both doors. */
+function announceCode(where, url, code) {
+    console.log(`\n  Open: ${url}`);
+    console.log(`  Enter code: ${code}\n`);
+    console.log(`  Waiting for ${where} authorization…`);
+}
+/** Run GitHub's device flow (talking to GitHub directly) and return its access token. */
+async function githubDeviceToken() {
     if (!GITHUB_CLIENT_ID) {
         throw new Error("GitHub client id not configured. Set RETASC_GITHUB_CLIENT_ID (the OAuth App's public Client ID).");
     }
@@ -35,13 +46,10 @@ export async function deviceLogin() {
     if (!start.device_code) {
         throw new Error(`GitHub device-flow start failed: ${JSON.stringify(start)}`);
     }
-    console.log(`\n  Open: ${start.verification_uri}`);
-    console.log(`  Enter code: ${start.user_code}\n`);
-    console.log("  Waiting for authorization…");
+    announceCode("GitHub", start.verification_uri, start.user_code);
     // Poll GitHub for the access token.
     let intervalMs = (start.interval || 5) * 1000;
     const deadline = Date.now() + start.expires_in * 1000;
-    let githubToken = "";
     while (Date.now() < deadline) {
         await sleep(intervalMs);
         const r = await postForm(TOKEN_URL, {
@@ -49,10 +57,8 @@ export async function deviceLogin() {
             device_code: start.device_code,
             grant_type: GRANT,
         });
-        if (r.access_token) {
-            githubToken = r.access_token;
-            break;
-        }
+        if (r.access_token)
+            return r.access_token;
         if (r.error === "authorization_pending")
             continue;
         if (r.error === "slow_down") {
@@ -61,20 +67,113 @@ export async function deviceLogin() {
         }
         throw new Error(`GitHub authorization failed: ${r.error_description ?? r.error}`);
     }
-    if (!githubToken)
-        throw new Error("Timed out waiting for GitHub authorization.");
-    // Exchange the GitHub token for a Retasc (Convex Auth) session.
+    throw new Error("Timed out waiting for GitHub authorization.");
+}
+/**
+ * Run Google's device flow and return its access token (RTSC-508).
+ *
+ * Structurally the same as the GitHub one, with the two Google calls made by the
+ * backend rather than from here — see the note on the function references above.
+ * The loop, the interval back-off and the deadline stay client-side: the wait is
+ * as long as a human takes to find their browser, which is not something to hold
+ * a Convex action open for.
+ */
+async function googleDeviceToken(convex) {
+    const start = (await convex.action(googleDeviceStart, {}));
+    announceCode("Google", start.verificationUrl, start.userCode);
+    let intervalMs = (start.intervalSeconds || 5) * 1000;
+    const deadline = Date.now() + start.expiresInSeconds * 1000;
+    while (Date.now() < deadline) {
+        await sleep(intervalMs);
+        // Anything terminal — declined, expired, misconfigured — is thrown by the
+        // backend as a readable userError and propagates to the caller's `fail`.
+        const r = (await convex.action(googleDevicePoll, { deviceCode: start.deviceCode }));
+        if (r.status === "ok")
+            return r.googleToken;
+        if (r.status === "slowDown")
+            intervalMs += 5000;
+    }
+    throw new Error("Timed out waiting for Google authorization.");
+}
+/**
+ * Which door, when the caller didn't say (RTSC-508).
+ *
+ * Asked rather than defaulted because the person who needs the second door is
+ * precisely the one who cannot be expected to know a flag exists: they signed up
+ * through the web Dash with Google, and a GitHub-only prompt is a dead end they
+ * have no way to read as one. One keystroke, and only when someone is there to
+ * press it.
+ *
+ * Non-interactive runs keep today's behaviour exactly — GitHub, no prompt — so
+ * nothing scripted against `retasc login` changes.
+ */
+export async function chooseProvider(
+// Injected so the question can be pinned by tests. Picking the wrong door is
+// not a typo you correct on the next run: it signs you in as a SECOND identity
+// with its own membership, and nothing in the CLI can merge them back. Same
+// reasoning as `identityLoop`'s deps — the loud path is the one that must be
+// provable, and a live run only ever exercises the quiet one.
+deps = {}) {
+    const askFn = deps.askFn ?? ask;
+    const interactive = deps.interactive ?? isInteractive;
+    if (!interactive())
+        return "github";
+    // A default exists ONLY when it is a recorded fact about this human — the door
+    // they last signed in through successfully. That is the whole rule. Defaulting
+    // to GitHub because most people use it would be assuming an answer to a
+    // question whose wrong answer is a second identity, for exactly the person
+    // this feature exists to serve. A remembered door assumes nothing: it already
+    // worked for them once.
+    const remembered = deps.remembered;
+    const DOORS = [
+        { key: "github", slot: "1", label: "GitHub" },
+        { key: "google", slot: "2", label: "Google" },
+    ];
+    console.log("\nHow do you sign in to Retasc?");
+    for (const d of DOORS) {
+        console.log(`  ${d.slot}) ${d.label}${d.key === remembered ? "   (last used)" : ""}`);
+    }
+    const rememberedSlot = DOORS.find((d) => d.key === remembered)?.slot;
+    for (let attempt = 0; attempt < 3; attempt++) {
+        const a = await askFn(rememberedSlot ? `Choose a number [${rememberedSlot}]: ` : "Choose a number: ");
+        // Empty is an answer only when there is something true to answer WITH.
+        if (a === "" && remembered)
+            return remembered;
+        const hit = DOORS.find((d) => d.slot === a);
+        if (hit)
+            return hit.key;
+        console.log("Please enter 1 or 2.");
+    }
+    throw new Error("no valid choice — aborting");
+}
+/**
+ * Run a device-flow login and persist the resulting Convex Auth session to
+ * ~/.retasc/config.json. Prints the user code + verification URL.
+ *
+ * With no `provider`, asks which door when a human is present and falls back to
+ * GitHub when one isn't.
+ */
+export async function deviceLogin(provider) {
     const cfg = loadConfig();
+    const door = provider ?? (await chooseProvider({ remembered: cfg.loginProvider }));
     const convex = new ConvexHttpClient(cfg.deploymentUrl);
+    // Exchange the upstream token for a Retasc (Convex Auth) session. The token is
+    // used here and never stored: the session is the only credential that persists.
+    const params = door === "google"
+        ? { googleToken: await googleDeviceToken(convex) }
+        : { githubToken: await githubDeviceToken() };
     const res = await convex.action(signIn, {
-        provider: "github-device",
-        params: { githubToken },
+        provider: door === "google" ? "google-device" : "github-device",
+        params,
     });
     const tokens = res?.tokens;
     if (!tokens?.token) {
         throw new Error("Sign-in did not return a session token.");
     }
-    patchConfig({ token: tokens.token, refreshToken: tokens.refreshToken });
+    // Record the door only now, on the far side of a sign-in that actually worked.
+    // Written here rather than at the point of choosing so a failed or abandoned
+    // attempt can never become next time's default.
+    patchConfig({ token: tokens.token, refreshToken: tokens.refreshToken, loginProvider: door });
 }
 /**
  * Does this thrown error clearly mean "this refresh token can never mint a new

package/dist/commands/bind.js

@@ -1,5 +1,3 @@
-import { createInterface } from "node:readline/promises";
-import { stdin, stdout } from "node:process";
 import { api, cliError } from "../api.js";
 import { deviceLogin } from "../auth.js";
 import { loadConfig } from "../config.js";
@@ -7,34 +5,14 @@ import { installMarker } from "./mcp.js";
 import { readLocalBinding, resolveBinding } from "../lib/binding.js";
 import { getBinding, setBinding, newWorkspaceId } from "../lib/keystore.js";
 import { resolveLauncher, launcherNote, selfCommand } from "../lib/launcher.js";
+import { ask, confirm, isInteractive } from "../lib/prompt.js";
 import { clean } from "../lib/text.js";
 import { VERSION } from "../version.js";
-export function isInteractive() {
-    return Boolean(stdin.isTTY && stdout.isTTY);
-}
-export async function ask(question) {
-    const rl = createInterface({ input: stdin, output: stdout });
-    try {
-        // readline's question() NEVER settles when stdin hits EOF (Ctrl-D, or a
-        // closed pipe) — it silently drops the callback rather than resolving ""
-        // or throwing, so a bare `await` here wedges the CLI with no output and no
-        // exit. Race the close event so callers fail fast instead (RTSC-269).
-        const closed = new Promise((_, reject) => rl.once("close", () => reject(new Error("input closed"))));
-        closed.catch(() => { }); // the normal path closes rl too; that loser rejection is expected
-        return (await Promise.race([rl.question(question), closed])).trim();
-    }
-    finally {
-        rl.close();
-    }
-}
-export async function confirm(question, assumeYes) {
-    if (assumeYes)
-        return true;
-    if (!isInteractive())
-        return false;
-    const a = (await ask(`${question} [y/N] `)).toLowerCase();
-    return a === "y" || a === "yes";
-}
+// RTSC-508: `ask`/`confirm`/`isInteractive` now live in lib/prompt.ts so `auth.ts`
+// can use them without closing an import cycle (bind → auth → bind). Re-exported
+// here because they have been part of this module's surface since RTSC-269, and
+// moving the import in every call site would be churn for no gain.
+export { ask, confirm, isInteractive };
 /**
  * Render a numbered menu and read one answer, optionally with a trailing extra option.
  *
@@ -317,7 +295,10 @@ export async function ensureSignedIn() {
     if (!isInteractive()) {
         throw new Error("Not signed in. Run `retasc login` first (no TTY here for the device flow).");
     }
-    console.error("Not signed in yet — authenticating with GitHub first…");
+    // RTSC-508: don't name a provider here. `deviceLogin` asks which door, and
+    // announcing "GitHub" before the question would be wrong for the invited
+    // teammate who signed up through Google — the exact person `join` is for.
+    console.error("Not signed in yet — let's do that first.");
     await deviceLogin();
 }
 export async function bindAction(opts) {

package/dist/config.js

@@ -55,6 +55,12 @@ export function loadConfig() {
         user: stored.user,
         defaultOrgId: stored.defaultOrgId,
         defaultProjectPrefix: stored.defaultProjectPrefix,
+        // Validated on read, not trusted: this value decides which door a bare Enter
+        // takes, and the file is hand-editable. Anything unrecognised reads as "never
+        // recorded", which falls back to asking outright.
+        loginProvider: stored.loginProvider === "github" || stored.loginProvider === "google"
+            ? stored.loginProvider
+            : undefined,
     };
 }
 /** Move a corrupt config aside to a unique sibling so a human can recover any

package/dist/index.js

@@ -38,12 +38,23 @@ function fail(e) {
     process.exit(1);
 }
 // --- auth ------------------------------------------------------------------
+// RTSC-508: two doors, not one. Google sign-in shipped for the web Dash first, so
+// an account can exist that GitHub has never heard of — and for that human every
+// login-gated command here was unreachable. With no flag the command ASKS, which
+// is the only form that helps someone who doesn't know a flag exists.
 program
     .command("login")
-    .description("Sign in with GitHub (device flow).")
-    .action(async () => {
+    .description("Sign in with GitHub or Google (device flow).")
+    .option("--github", "Sign in with GitHub, without being asked")
+    .option("--google", "Sign in with Google, without being asked")
+    .action(async (opts) => {
     try {
-        await deviceLogin();
+        // Naming both is a contradiction, not a preference — and quietly picking
+        // one could sign them in through the door that mints a SECOND identity,
+        // which nothing in the CLI can undo.
+        if (opts.github && opts.google)
+            return fail("Pass --github or --google, not both.");
+        await deviceLogin(opts.google ? "google" : opts.github ? "github" : undefined);
         const me = (await api.me());
         const u = me?.user ?? {};
         console.log(`\n✓ Signed in${u.name ? ` as ${u.name}` : ""}${u.email ? ` <${u.email}>` : ""}.`);

package/dist/lib/prompt.js

@@ -0,0 +1,38 @@
+import { createInterface } from "node:readline/promises";
+import { stdin, stdout } from "node:process";
+// The terminal-input primitives, extracted from commands/bind.ts (RTSC-508).
+//
+// They moved because `auth.ts` needs to ask a question too — which door to sign
+// in through — and importing it from `commands/bind.ts` would close a cycle:
+// bind already imports `deviceLogin` from auth. Duplicating `ask` instead would
+// have meant duplicating the EOF race fix below, which is exactly the kind of
+// thing that gets fixed once and then silently rots in the copy.
+//
+// `commands/bind.ts` re-exports all three, so every existing call site is
+// unchanged.
+export function isInteractive() {
+    return Boolean(stdin.isTTY && stdout.isTTY);
+}
+export async function ask(question) {
+    const rl = createInterface({ input: stdin, output: stdout });
+    try {
+        // readline's question() NEVER settles when stdin hits EOF (Ctrl-D, or a
+        // closed pipe) — it silently drops the callback rather than resolving ""
+        // or throwing, so a bare `await` here wedges the CLI with no output and no
+        // exit. Race the close event so callers fail fast instead (RTSC-269).
+        const closed = new Promise((_, reject) => rl.once("close", () => reject(new Error("input closed"))));
+        closed.catch(() => { }); // the normal path closes rl too; that loser rejection is expected
+        return (await Promise.race([rl.question(question), closed])).trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+export async function confirm(question, assumeYes) {
+    if (assumeYes)
+        return true;
+    if (!isInteractive())
+        return false;
+    const a = (await ask(`${question} [y/N] `)).toLowerCase();
+    return a === "y" || a === "yes";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "description": "Retasc CLI — sign in with GitHub, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {