@retasc/cli 1.10.0 → 1.12.0

package/dist/auth.js

@@ -1,6 +1,7 @@
 import { ConvexHttpClient } from "convex/browser";
 import { makeFunctionReference } from "convex/server";
 import { loadConfig, patchConfig } from "./config.js";
+import { ask, isInteractive } from "./lib/prompt.js";
 // The GitHub OAuth App's PUBLIC client id (safe to ship — device flow needs no
 // secret). Baked in so `retasc login` works out-of-the-box; override via env.
 const GITHUB_CLIENT_ID = process.env.RETASC_GITHUB_CLIENT_ID ?? "Ov23linqRy875IU8OYTW";
@@ -8,9 +9,16 @@ const DEVICE_CODE_URL = "https://github.com/login/device/code";
 const TOKEN_URL = "https://github.com/login/oauth/access_token";
 const GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 // Convex Auth's own public sign-in action. We call it with the "github-device"
-// credentials provider; it verifies the GitHub token server-side and returns a
-// session ({ tokens: { token, refreshToken } }).
+// or "google-device" credentials provider; it verifies the upstream token
+// server-side and returns a session ({ tokens: { token, refreshToken } }).
 const signIn = makeFunctionReference("auth:signIn");
+// RTSC-508 — the Google device flow's two legs, both server-side. Google, unlike
+// GitHub, requires a client SECRET on the token exchange, and a published npm
+// package cannot hold one. So there is deliberately no Google client id in this
+// file either: the CLI never talks to Google directly, so it never needs one, and
+// rotating that client becomes a Convex env change with no CLI release.
+const googleDeviceStart = makeFunctionReference("googleDevice:start");
+const googleDevicePoll = makeFunctionReference("googleDevice:poll");
 async function postForm(url, body) {
     const res = await fetch(url, {
         method: "POST",
@@ -20,11 +28,14 @@ async function postForm(url, body) {
     return res.json();
 }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-/**
- * Run the full GitHub device-flow login and persist the resulting Convex Auth
- * session to ~/.retasc/config.json. Prints the user code + verification URL.
- */
-export async function deviceLogin() {
+/** Print the two lines a human has to act on, identically for both doors. */
+function announceCode(where, url, code) {
+    console.log(`\n  Open: ${url}`);
+    console.log(`  Enter code: ${code}\n`);
+    console.log(`  Waiting for ${where} authorization…`);
+}
+/** Run GitHub's device flow (talking to GitHub directly) and return its access token. */
+async function githubDeviceToken() {
     if (!GITHUB_CLIENT_ID) {
         throw new Error("GitHub client id not configured. Set RETASC_GITHUB_CLIENT_ID (the OAuth App's public Client ID).");
     }
@@ -35,13 +46,10 @@ export async function deviceLogin() {
     if (!start.device_code) {
         throw new Error(`GitHub device-flow start failed: ${JSON.stringify(start)}`);
     }
-    console.log(`\n  Open: ${start.verification_uri}`);
-    console.log(`  Enter code: ${start.user_code}\n`);
-    console.log("  Waiting for authorization…");
+    announceCode("GitHub", start.verification_uri, start.user_code);
     // Poll GitHub for the access token.
     let intervalMs = (start.interval || 5) * 1000;
     const deadline = Date.now() + start.expires_in * 1000;
-    let githubToken = "";
     while (Date.now() < deadline) {
         await sleep(intervalMs);
         const r = await postForm(TOKEN_URL, {
@@ -49,10 +57,8 @@ export async function deviceLogin() {
             device_code: start.device_code,
             grant_type: GRANT,
         });
-        if (r.access_token) {
-            githubToken = r.access_token;
-            break;
-        }
+        if (r.access_token)
+            return r.access_token;
         if (r.error === "authorization_pending")
             continue;
         if (r.error === "slow_down") {
@@ -61,20 +67,113 @@ export async function deviceLogin() {
         }
         throw new Error(`GitHub authorization failed: ${r.error_description ?? r.error}`);
     }
-    if (!githubToken)
-        throw new Error("Timed out waiting for GitHub authorization.");
-    // Exchange the GitHub token for a Retasc (Convex Auth) session.
+    throw new Error("Timed out waiting for GitHub authorization.");
+}
+/**
+ * Run Google's device flow and return its access token (RTSC-508).
+ *
+ * Structurally the same as the GitHub one, with the two Google calls made by the
+ * backend rather than from here — see the note on the function references above.
+ * The loop, the interval back-off and the deadline stay client-side: the wait is
+ * as long as a human takes to find their browser, which is not something to hold
+ * a Convex action open for.
+ */
+async function googleDeviceToken(convex) {
+    const start = (await convex.action(googleDeviceStart, {}));
+    announceCode("Google", start.verificationUrl, start.userCode);
+    let intervalMs = (start.intervalSeconds || 5) * 1000;
+    const deadline = Date.now() + start.expiresInSeconds * 1000;
+    while (Date.now() < deadline) {
+        await sleep(intervalMs);
+        // Anything terminal — declined, expired, misconfigured — is thrown by the
+        // backend as a readable userError and propagates to the caller's `fail`.
+        const r = (await convex.action(googleDevicePoll, { deviceCode: start.deviceCode }));
+        if (r.status === "ok")
+            return r.googleToken;
+        if (r.status === "slowDown")
+            intervalMs += 5000;
+    }
+    throw new Error("Timed out waiting for Google authorization.");
+}
+/**
+ * Which door, when the caller didn't say (RTSC-508).
+ *
+ * Asked rather than defaulted because the person who needs the second door is
+ * precisely the one who cannot be expected to know a flag exists: they signed up
+ * through the web Dash with Google, and a GitHub-only prompt is a dead end they
+ * have no way to read as one. One keystroke, and only when someone is there to
+ * press it.
+ *
+ * Non-interactive runs keep today's behaviour exactly — GitHub, no prompt — so
+ * nothing scripted against `retasc login` changes.
+ */
+export async function chooseProvider(
+// Injected so the question can be pinned by tests. Picking the wrong door is
+// not a typo you correct on the next run: it signs you in as a SECOND identity
+// with its own membership, and nothing in the CLI can merge them back. Same
+// reasoning as `identityLoop`'s deps — the loud path is the one that must be
+// provable, and a live run only ever exercises the quiet one.
+deps = {}) {
+    const askFn = deps.askFn ?? ask;
+    const interactive = deps.interactive ?? isInteractive;
+    if (!interactive())
+        return "github";
+    // A default exists ONLY when it is a recorded fact about this human — the door
+    // they last signed in through successfully. That is the whole rule. Defaulting
+    // to GitHub because most people use it would be assuming an answer to a
+    // question whose wrong answer is a second identity, for exactly the person
+    // this feature exists to serve. A remembered door assumes nothing: it already
+    // worked for them once.
+    const remembered = deps.remembered;
+    const DOORS = [
+        { key: "github", slot: "1", label: "GitHub" },
+        { key: "google", slot: "2", label: "Google" },
+    ];
+    console.log("\nHow do you sign in to Retasc?");
+    for (const d of DOORS) {
+        console.log(`  ${d.slot}) ${d.label}${d.key === remembered ? "   (last used)" : ""}`);
+    }
+    const rememberedSlot = DOORS.find((d) => d.key === remembered)?.slot;
+    for (let attempt = 0; attempt < 3; attempt++) {
+        const a = await askFn(rememberedSlot ? `Choose a number [${rememberedSlot}]: ` : "Choose a number: ");
+        // Empty is an answer only when there is something true to answer WITH.
+        if (a === "" && remembered)
+            return remembered;
+        const hit = DOORS.find((d) => d.slot === a);
+        if (hit)
+            return hit.key;
+        console.log("Please enter 1 or 2.");
+    }
+    throw new Error("no valid choice — aborting");
+}
+/**
+ * Run a device-flow login and persist the resulting Convex Auth session to
+ * ~/.retasc/config.json. Prints the user code + verification URL.
+ *
+ * With no `provider`, asks which door when a human is present and falls back to
+ * GitHub when one isn't.
+ */
+export async function deviceLogin(provider) {
     const cfg = loadConfig();
+    const door = provider ?? (await chooseProvider({ remembered: cfg.loginProvider }));
     const convex = new ConvexHttpClient(cfg.deploymentUrl);
+    // Exchange the upstream token for a Retasc (Convex Auth) session. The token is
+    // used here and never stored: the session is the only credential that persists.
+    const params = door === "google"
+        ? { googleToken: await googleDeviceToken(convex) }
+        : { githubToken: await githubDeviceToken() };
     const res = await convex.action(signIn, {
-        provider: "github-device",
-        params: { githubToken },
+        provider: door === "google" ? "google-device" : "github-device",
+        params,
     });
     const tokens = res?.tokens;
     if (!tokens?.token) {
         throw new Error("Sign-in did not return a session token.");
     }
-    patchConfig({ token: tokens.token, refreshToken: tokens.refreshToken });
+    // Record the door only now, on the far side of a sign-in that actually worked.
+    // Written here rather than at the point of choosing so a failed or abandoned
+    // attempt can never become next time's default.
+    patchConfig({ token: tokens.token, refreshToken: tokens.refreshToken, loginProvider: door });
 }
 /**
  * Does this thrown error clearly mean "this refresh token can never mint a new

package/dist/commands/bind.js

@@ -1,5 +1,3 @@
-import { createInterface } from "node:readline/promises";
-import { stdin, stdout } from "node:process";
 import { api, cliError } from "../api.js";
 import { deviceLogin } from "../auth.js";
 import { loadConfig } from "../config.js";
@@ -7,34 +5,14 @@ import { installMarker } from "./mcp.js";
 import { readLocalBinding, resolveBinding } from "../lib/binding.js";
 import { getBinding, setBinding, newWorkspaceId } from "../lib/keystore.js";
 import { resolveLauncher, launcherNote, selfCommand } from "../lib/launcher.js";
+import { ask, confirm, isInteractive } from "../lib/prompt.js";
 import { clean } from "../lib/text.js";
 import { VERSION } from "../version.js";
-export function isInteractive() {
-    return Boolean(stdin.isTTY && stdout.isTTY);
-}
-export async function ask(question) {
-    const rl = createInterface({ input: stdin, output: stdout });
-    try {
-        // readline's question() NEVER settles when stdin hits EOF (Ctrl-D, or a
-        // closed pipe) — it silently drops the callback rather than resolving ""
-        // or throwing, so a bare `await` here wedges the CLI with no output and no
-        // exit. Race the close event so callers fail fast instead (RTSC-269).
-        const closed = new Promise((_, reject) => rl.once("close", () => reject(new Error("input closed"))));
-        closed.catch(() => { }); // the normal path closes rl too; that loser rejection is expected
-        return (await Promise.race([rl.question(question), closed])).trim();
-    }
-    finally {
-        rl.close();
-    }
-}
-export async function confirm(question, assumeYes) {
-    if (assumeYes)
-        return true;
-    if (!isInteractive())
-        return false;
-    const a = (await ask(`${question} [y/N] `)).toLowerCase();
-    return a === "y" || a === "yes";
-}
+// RTSC-508: `ask`/`confirm`/`isInteractive` now live in lib/prompt.ts so `auth.ts`
+// can use them without closing an import cycle (bind → auth → bind). Re-exported
+// here because they have been part of this module's surface since RTSC-269, and
+// moving the import in every call site would be churn for no gain.
+export { ask, confirm, isInteractive };
 /**
  * Render a numbered menu and read one answer, optionally with a trailing extra option.
  *
@@ -299,7 +277,33 @@ export async function completeWorkspaceSetup(args) {
     catch {
         /* binding written; whoami confirmation is best-effort */
     }
+    // RTSC-519 — say that setup FINISHED, and what to do with it.
+    //
+    // Here rather than in either command, because it is true of both and this is the tail
+    // they share. `join` said it and `bind` did not, so the person who set up their own org
+    // was left reading a status line and guessing whether anything else was required — while
+    // the invited teammate, who arrived through the other command, was told. A line in one
+    // caller is a line the other has to remember; a line here is one neither can lose.
+    //
+    // AFTER the confirmation, and after everything that can throw, so it is only ever
+    // printed by a run that actually finished. Nothing below it can fail.
+    if (isInteractive())
+        console.log(`\n${NEXT_STEP}`);
 }
+/**
+ * What to do with a workspace that is now set up.
+ *
+ * "or restart it if it's already open" is the load-bearing half. `.mcp.json` is read when
+ * an MCP client starts, so an agent already running on this folder will not see Retasc
+ * until it restarts — the same trap RTSC-496 records for the Dash's version of this
+ * handover, where the screen otherwise waits forever on an agent that can never call in.
+ * It bites harder here: `bind` is routinely run from inside a session already open on the
+ * folder being bound.
+ *
+ * Deliberately NOT "run `retasc next`". The agent pulls work over MCP; the CLI's claim
+ * commands are a human convenience, and naming one here would teach the wrong first move.
+ */
+export const NEXT_STEP = "Start your agent in this folder, or restart it if it's already open, and it'll pull from the queue.";
 /**
  * Sign in first when there is no session at all (RTSC-481, extended to `join` by RTSC-492).
  *
@@ -317,7 +321,10 @@ export async function ensureSignedIn() {
     if (!isInteractive()) {
         throw new Error("Not signed in. Run `retasc login` first (no TTY here for the device flow).");
     }
-    console.error("Not signed in yet — authenticating with GitHub first…");
+    // RTSC-508: don't name a provider here. `deviceLogin` asks which door, and
+    // announcing "GitHub" before the question would be wrong for the invited
+    // teammate who signed up through Google — the exact person `join` is for.
+    console.error("Not signed in yet — let's do that first.");
     await deviceLogin();
 }
 export async function bindAction(opts) {

package/dist/commands/identity.js

@@ -50,15 +50,19 @@ function report(outcome, orgLabel) {
             console.log("Run this again after a migration — each import brings its own people across.");
             return;
         case "answered":
-            // The permanent decline. Worth its own wording: from in here it is indistinguishable
-            // from "none", and someone who declined during an earlier import and now has a real
-            // placeholder from a NEW one would otherwise read "nothing waiting" as the truth.
-            console.log(`You've already said none of the imported people in ${orgLabel} are you.`);
-            console.log("That answer covers the whole org, including later migrations.");
-            console.log("If a newer import did carry you across, an owner can link it from the Team page.");
+            // They have answered here before, and nothing is left from a tool they haven't
+            // answered about. It differs from "none" only in being able to say what already
+            // happened; the advice is identical, because it is now TRUE for both.
+            //
+            // RTSC-507 rewrote this. It used to read "that answer covers the whole org,
+            // including later migrations" and send them to an owner — because one decline really
+            // did shut them out of every future import. That sentence existed only to describe a
+            // bug, and it goes in the same release the bug does.
+            console.log(`You've answered about every tool imported into ${orgLabel} so far.`);
+            console.log("Run this again after the next migration — each one is asked about separately.");
             return;
         case "declined":
-            console.log("Noted — you won't be asked again.");
+            console.log("Noted. That covers those tools only, so a later import will ask again.");
             return;
         case "left":
             console.log("Nothing linked. Run `retasc identity` again whenever you want to look.");

package/dist/commands/join.js

@@ -16,6 +16,24 @@ const UNKNOWN_SOURCE = "another tool";
  * number of migrated tools.
  */
 const MAX_IDENTITY_ROUNDS = 10;
+/**
+ * The tools on screen, named the way they'd be read aloud (RTSC-507).
+ *
+ * The twin of `sourcePhrase` in `dash/src/lib/ghostPrompt.ts`, duplicated rather than
+ * shared because the two live in separate packages with no common build — the same reason
+ * `UNKNOWN_SOURCE` above is a second copy of the Dash's constant. Keep the two in step:
+ * they answer the same question in front of the same irreversible decision.
+ */
+export function sourcePhrase(ghosts) {
+    const names = [...new Set(ghosts.map((g) => clean(g.sourceLabel ?? UNKNOWN_SOURCE)))].sort((a, b) => 
+    // Keep the vague fallback last, so a known tool always leads.
+    a === UNKNOWN_SOURCE ? 1 : b === UNKNOWN_SOURCE ? -1 : a.localeCompare(b));
+    if (names.length <= 1)
+        return names[0] ?? UNKNOWN_SOURCE;
+    if (names.length === 2)
+        return `${names[0]} and ${names[1]}`;
+    return `${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}`;
+}
 /** How one row reads: the person, and the tool they were carried in from. */
 function ghostRow(g) {
     // BOTH fields are third-party text: the name was typed by someone in ClickUp/Jira/Asana
@@ -62,13 +80,16 @@ deps = {}) {
         let ghosts;
         try {
             const res = await d.claimableGhosts({ orgId });
-            // Two different endings the server returns on one shape. "Answered" is this human's
-            // permanent org-wide decline; "none" is simply an empty list, and they can be asked
-            // again after the next migration. `join` treats both as silence; `identity` does not.
-            if (res.asked)
-                return claimedAny ? "claimed" : "answered";
-            if (!res.ghosts.length)
-                return claimedAny ? "claimed" : "none";
+            // An empty list is the only ending now (RTSC-507). `asked` no longer gates anything
+            // — it used to mean "declined, permanently", and branching on it FIRST is exactly
+            // what hid a later migration's placeholders for good. It now only picks the wording:
+            // "you've answered everything so far" reads differently from "nothing was ever
+            // imported here", and both are empty. `join` treats them alike; `identity` does not.
+            if (!res.ghosts.length) {
+                if (claimedAny)
+                    return "claimed";
+                return res.asked ? "answered" : "none";
+            }
             ghosts = res.ghosts;
         }
         catch (e) {
@@ -80,14 +101,18 @@ deps = {}) {
             ? `\nWhen ${orgLabel ?? "this org"} migrated, some people were carried across.\n` +
                 "One of them may be you:"
             : "\nAnything else here you recognise?");
-        // "Don't ask again" is not decoration. Declining writes `ghostPromptDismissedAt` on the
-        // member row and `claimGhost` refuses for good afterwards, org-wide — so a bare "none
-        // of these are me" would read as "none of these ClickUp ones" and quietly close the
-        // door on a second tool's placeholder too.
+        // RTSC-507 — the row says what the answer COVERS, because that is what changed.
+        // Declining used to write one org-wide flag that shut the person out of every later
+        // migration, so the row had to carry the warning "don't ask again". It now records
+        // only the tools on screen, so a bare "none of these are me" is finally the literal
+        // truth, and naming the tools is what makes the answer safe to give.
         // Compared by REFERENCE below, not by a magic id value: a sentinel that is merely a
-        // row with an empty id would let any future ghost with a falsy id read as a decline —
-        // and a decline is permanent.
-        const NONE = { id: "", name: "None of these are me (don't ask again)", sourceLabel: null };
+        // row with an empty id would let any future ghost with a falsy id read as a decline.
+        const NONE = {
+            id: "",
+            name: `None of these are me (covers ${sourcePhrase(ghosts)} only)`,
+            sourceLabel: null,
+        };
         // No label: the heading above is the prompt, and `choose` would print a second one.
         const chosen = await pickExisting("", [...ghosts, NONE], (g) => (g === NONE ? g.name : ghostRow(g)), d.askFn);
         if (chosen === NONE) {
@@ -96,10 +121,10 @@ deps = {}) {
             }
             catch (e) {
                 console.error(`  ! ${formatError(e).message}`);
-                // NOT "declined". A caller answers that with "you won't be asked again", and the
-                // write is the only thing that makes it true — the flag never landed, so they WILL
-                // be asked again. The error is already on stderr; `unavailable` adds no second
-                // sentence on top of it rather than a reassuring false one.
+                // NOT "declined". A caller answers that with "noted", and the write is the only
+                // thing that makes it true — nothing landed, so these tools WILL be offered again.
+                // The error is already on stderr; `unavailable` adds no second sentence on top of
+                // it rather than a reassuring false one.
                 return "unavailable";
             }
             return "declined";
@@ -212,7 +237,6 @@ export async function joinAction(link, opts) {
         console.error(`  Resume with:  ${resume}`);
         throw e;
     }
-    if (isInteractive()) {
-        console.log("\nStart your agent in this folder and it'll pull from the queue.");
-    }
+    // RTSC-519 — the closing line moved into `completeWorkspaceSetup`, the tail both commands
+    // already share, so `bind` gets it too. Saying it here as well would say it twice.
 }

package/dist/config.js

@@ -55,6 +55,12 @@ export function loadConfig() {
         user: stored.user,
         defaultOrgId: stored.defaultOrgId,
         defaultProjectPrefix: stored.defaultProjectPrefix,
+        // Validated on read, not trusted: this value decides which door a bare Enter
+        // takes, and the file is hand-editable. Anything unrecognised reads as "never
+        // recorded", which falls back to asking outright.
+        loginProvider: stored.loginProvider === "github" || stored.loginProvider === "google"
+            ? stored.loginProvider
+            : undefined,
     };
 }
 /** Move a corrupt config aside to a unique sibling so a human can recover any

package/dist/index.js

@@ -38,12 +38,23 @@ function fail(e) {
     process.exit(1);
 }
 // --- auth ------------------------------------------------------------------
+// RTSC-508: two doors, not one. Google sign-in shipped for the web Dash first, so
+// an account can exist that GitHub has never heard of — and for that human every
+// login-gated command here was unreachable. With no flag the command ASKS, which
+// is the only form that helps someone who doesn't know a flag exists.
 program
     .command("login")
-    .description("Sign in with GitHub (device flow).")
-    .action(async () => {
+    .description("Sign in with GitHub or Google (device flow).")
+    .option("--github", "Sign in with GitHub, without being asked")
+    .option("--google", "Sign in with Google, without being asked")
+    .action(async (opts) => {
     try {
-        await deviceLogin();
+        // Naming both is a contradiction, not a preference — and quietly picking
+        // one could sign them in through the door that mints a SECOND identity,
+        // which nothing in the CLI can undo.
+        if (opts.github && opts.google)
+            return fail("Pass --github or --google, not both.");
+        await deviceLogin(opts.google ? "google" : opts.github ? "github" : undefined);
         const me = (await api.me());
         const u = me?.user ?? {};
         console.log(`\n✓ Signed in${u.name ? ` as ${u.name}` : ""}${u.email ? ` <${u.email}>` : ""}.`);

package/dist/lib/prompt.js

@@ -0,0 +1,38 @@
+import { createInterface } from "node:readline/promises";
+import { stdin, stdout } from "node:process";
+// The terminal-input primitives, extracted from commands/bind.ts (RTSC-508).
+//
+// They moved because `auth.ts` needs to ask a question too — which door to sign
+// in through — and importing it from `commands/bind.ts` would close a cycle:
+// bind already imports `deviceLogin` from auth. Duplicating `ask` instead would
+// have meant duplicating the EOF race fix below, which is exactly the kind of
+// thing that gets fixed once and then silently rots in the copy.
+//
+// `commands/bind.ts` re-exports all three, so every existing call site is
+// unchanged.
+export function isInteractive() {
+    return Boolean(stdin.isTTY && stdout.isTTY);
+}
+export async function ask(question) {
+    const rl = createInterface({ input: stdin, output: stdout });
+    try {
+        // readline's question() NEVER settles when stdin hits EOF (Ctrl-D, or a
+        // closed pipe) — it silently drops the callback rather than resolving ""
+        // or throwing, so a bare `await` here wedges the CLI with no output and no
+        // exit. Race the close event so callers fail fast instead (RTSC-269).
+        const closed = new Promise((_, reject) => rl.once("close", () => reject(new Error("input closed"))));
+        closed.catch(() => { }); // the normal path closes rl too; that loser rejection is expected
+        return (await Promise.race([rl.question(question), closed])).trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+export async function confirm(question, assumeYes) {
+    if (assumeYes)
+        return true;
+    if (!isInteractive())
+        return false;
+    const a = (await ask(`${question} [y/N] `)).toLowerCase();
+    return a === "y" || a === "yes";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.10.0",
+  "version": "1.12.0",
   "description": "Retasc CLI — sign in with GitHub, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {