@retasc/cli 1.11.0 → 1.13.0

package/dist/commands/bind.js

@@ -277,7 +277,33 @@ export async function completeWorkspaceSetup(args) {
     catch {
         /* binding written; whoami confirmation is best-effort */
     }
+    // RTSC-519 — say that setup FINISHED, and what to do with it.
+    //
+    // Here rather than in either command, because it is true of both and this is the tail
+    // they share. `join` said it and `bind` did not, so the person who set up their own org
+    // was left reading a status line and guessing whether anything else was required — while
+    // the invited teammate, who arrived through the other command, was told. A line in one
+    // caller is a line the other has to remember; a line here is one neither can lose.
+    //
+    // AFTER the confirmation, and after everything that can throw, so it is only ever
+    // printed by a run that actually finished. Nothing below it can fail.
+    if (isInteractive())
+        console.log(`\n${NEXT_STEP}`);
 }
+/**
+ * What to do with a workspace that is now set up.
+ *
+ * "or restart it if it's already open" is the load-bearing half. `.mcp.json` is read when
+ * an MCP client starts, so an agent already running on this folder will not see Retasc
+ * until it restarts — the same trap RTSC-496 records for the Dash's version of this
+ * handover, where the screen otherwise waits forever on an agent that can never call in.
+ * It bites harder here: `bind` is routinely run from inside a session already open on the
+ * folder being bound.
+ *
+ * Deliberately NOT "run `retasc next`". The agent pulls work over MCP; the CLI's claim
+ * commands are a human convenience, and naming one here would teach the wrong first move.
+ */
+export const NEXT_STEP = "Start your agent in this folder, or restart it if it's already open, and it'll pull from the queue.";
 /**
  * Sign in first when there is no session at all (RTSC-481, extended to `join` by RTSC-492).
  *

package/dist/commands/identity.js

@@ -50,15 +50,19 @@ function report(outcome, orgLabel) {
             console.log("Run this again after a migration — each import brings its own people across.");
             return;
         case "answered":
-            // The permanent decline. Worth its own wording: from in here it is indistinguishable
-            // from "none", and someone who declined during an earlier import and now has a real
-            // placeholder from a NEW one would otherwise read "nothing waiting" as the truth.
-            console.log(`You've already said none of the imported people in ${orgLabel} are you.`);
-            console.log("That answer covers the whole org, including later migrations.");
-            console.log("If a newer import did carry you across, an owner can link it from the Team page.");
+            // They have answered here before, and nothing is left from a tool they haven't
+            // answered about. It differs from "none" only in being able to say what already
+            // happened; the advice is identical, because it is now TRUE for both.
+            //
+            // RTSC-507 rewrote this. It used to read "that answer covers the whole org,
+            // including later migrations" and send them to an owner — because one decline really
+            // did shut them out of every future import. That sentence existed only to describe a
+            // bug, and it goes in the same release the bug does.
+            console.log(`You've answered about every tool imported into ${orgLabel} so far.`);
+            console.log("Run this again after the next migration — each one is asked about separately.");
             return;
         case "declined":
-            console.log("Noted — you won't be asked again.");
+            console.log("Noted. That covers those tools only, so a later import will ask again.");
             return;
         case "left":
             console.log("Nothing linked. Run `retasc identity` again whenever you want to look.");

package/dist/commands/join.js

@@ -16,6 +16,24 @@ const UNKNOWN_SOURCE = "another tool";
  * number of migrated tools.
  */
 const MAX_IDENTITY_ROUNDS = 10;
+/**
+ * The tools on screen, named the way they'd be read aloud (RTSC-507).
+ *
+ * The twin of `sourcePhrase` in `dash/src/lib/ghostPrompt.ts`, duplicated rather than
+ * shared because the two live in separate packages with no common build — the same reason
+ * `UNKNOWN_SOURCE` above is a second copy of the Dash's constant. Keep the two in step:
+ * they answer the same question in front of the same irreversible decision.
+ */
+export function sourcePhrase(ghosts) {
+    const names = [...new Set(ghosts.map((g) => clean(g.sourceLabel ?? UNKNOWN_SOURCE)))].sort((a, b) => 
+    // Keep the vague fallback last, so a known tool always leads.
+    a === UNKNOWN_SOURCE ? 1 : b === UNKNOWN_SOURCE ? -1 : a.localeCompare(b));
+    if (names.length <= 1)
+        return names[0] ?? UNKNOWN_SOURCE;
+    if (names.length === 2)
+        return `${names[0]} and ${names[1]}`;
+    return `${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}`;
+}
 /** How one row reads: the person, and the tool they were carried in from. */
 function ghostRow(g) {
     // BOTH fields are third-party text: the name was typed by someone in ClickUp/Jira/Asana
@@ -62,13 +80,16 @@ deps = {}) {
         let ghosts;
         try {
             const res = await d.claimableGhosts({ orgId });
-            // Two different endings the server returns on one shape. "Answered" is this human's
-            // permanent org-wide decline; "none" is simply an empty list, and they can be asked
-            // again after the next migration. `join` treats both as silence; `identity` does not.
-            if (res.asked)
-                return claimedAny ? "claimed" : "answered";
-            if (!res.ghosts.length)
-                return claimedAny ? "claimed" : "none";
+            // An empty list is the only ending now (RTSC-507). `asked` no longer gates anything
+            // — it used to mean "declined, permanently", and branching on it FIRST is exactly
+            // what hid a later migration's placeholders for good. It now only picks the wording:
+            // "you've answered everything so far" reads differently from "nothing was ever
+            // imported here", and both are empty. `join` treats them alike; `identity` does not.
+            if (!res.ghosts.length) {
+                if (claimedAny)
+                    return "claimed";
+                return res.asked ? "answered" : "none";
+            }
             ghosts = res.ghosts;
         }
         catch (e) {
@@ -80,14 +101,18 @@ deps = {}) {
             ? `\nWhen ${orgLabel ?? "this org"} migrated, some people were carried across.\n` +
                 "One of them may be you:"
             : "\nAnything else here you recognise?");
-        // "Don't ask again" is not decoration. Declining writes `ghostPromptDismissedAt` on the
-        // member row and `claimGhost` refuses for good afterwards, org-wide — so a bare "none
-        // of these are me" would read as "none of these ClickUp ones" and quietly close the
-        // door on a second tool's placeholder too.
+        // RTSC-507 — the row says what the answer COVERS, because that is what changed.
+        // Declining used to write one org-wide flag that shut the person out of every later
+        // migration, so the row had to carry the warning "don't ask again". It now records
+        // only the tools on screen, so a bare "none of these are me" is finally the literal
+        // truth, and naming the tools is what makes the answer safe to give.
         // Compared by REFERENCE below, not by a magic id value: a sentinel that is merely a
-        // row with an empty id would let any future ghost with a falsy id read as a decline —
-        // and a decline is permanent.
-        const NONE = { id: "", name: "None of these are me (don't ask again)", sourceLabel: null };
+        // row with an empty id would let any future ghost with a falsy id read as a decline.
+        const NONE = {
+            id: "",
+            name: `None of these are me (covers ${sourcePhrase(ghosts)} only)`,
+            sourceLabel: null,
+        };
         // No label: the heading above is the prompt, and `choose` would print a second one.
         const chosen = await pickExisting("", [...ghosts, NONE], (g) => (g === NONE ? g.name : ghostRow(g)), d.askFn);
         if (chosen === NONE) {
@@ -96,10 +121,10 @@ deps = {}) {
             }
             catch (e) {
                 console.error(`  ! ${formatError(e).message}`);
-                // NOT "declined". A caller answers that with "you won't be asked again", and the
-                // write is the only thing that makes it true — the flag never landed, so they WILL
-                // be asked again. The error is already on stderr; `unavailable` adds no second
-                // sentence on top of it rather than a reassuring false one.
+                // NOT "declined". A caller answers that with "noted", and the write is the only
+                // thing that makes it true — nothing landed, so these tools WILL be offered again.
+                // The error is already on stderr; `unavailable` adds no second sentence on top of
+                // it rather than a reassuring false one.
                 return "unavailable";
             }
             return "declined";
@@ -212,7 +237,6 @@ export async function joinAction(link, opts) {
         console.error(`  Resume with:  ${resume}`);
         throw e;
     }
-    if (isInteractive()) {
-        console.log("\nStart your agent in this folder and it'll pull from the queue.");
-    }
+    // RTSC-519 — the closing line moved into `completeWorkspaceSetup`, the tail both commands
+    // already share, so `bind` gets it too. Saying it here as well would say it twice.
 }

package/dist/index.js

@@ -11,6 +11,7 @@ import { identityAction } from "./commands/identity.js";
 import { doctorAction } from "./commands/doctor.js";
 import { billingAction } from "./commands/billing.js";
 import { isNetworkError, readLocalBinding, resolveBinding } from "./lib/binding.js";
+import { whoamiView, orgCreatedView, projectCreatedView, keyListView, inviteListView, } from "./lib/format.js";
 import { tidyAction, doneAction } from "./commands/tidy.js";
 import { runProxy } from "./proxy.js";
 import { deviceLogin } from "./auth.js";
@@ -77,7 +78,8 @@ program
 program
     .command("whoami")
     .description("Show THIS folder's org/project binding, plus the signed-in user and their orgs.")
-    .action(async () => {
+    .option("--json", "Emit the raw payload instead of the summary.")
+    .action(async (opts) => {
     // RTSC-91 (§13): lead with the binding for the folder you're in — the same
     // "you are in org X / project Y" heads-up the agent gets — so a human can
     // confirm scope before any work. Resolved from the local key, server-enforced.
@@ -111,7 +113,9 @@ program
     }
     try {
         const me = await api.me();
-        console.log(JSON.stringify(me, null, 2));
+        // RTSC-521: the binding block above is untouched — it was already the good half of
+        // this command. Only the payload dump becomes a summary.
+        console.log(opts.json ? JSON.stringify(me, null, 2) : whoamiView(me));
     }
     catch (e) {
         fail(e);
@@ -200,11 +204,12 @@ org
     .command("create")
     .requiredOption("--name <name>")
     .option("--slug <slug>")
+    .option("--json", "Emit the raw payload instead of the summary.")
     .action(async (opts) => {
     requireLogin();
     try {
-        const res = await api.createOrg({ name: opts.name, slug: opts.slug });
-        console.log(JSON.stringify(res, null, 2));
+        const res = (await api.createOrg({ name: opts.name, slug: opts.slug }));
+        console.log(opts.json ? JSON.stringify(res, null, 2) : orgCreatedView(res, opts.name));
     }
     catch (e) {
         fail(e);
@@ -216,11 +221,16 @@ project
     .requiredOption("--org-id <id>")
     .requiredOption("--name <name>")
     .requiredOption("--prefix <PREFIX>")
+    .option("--json", "Emit the raw payload instead of the summary.")
     .action(async (opts) => {
     requireLogin();
     try {
-        const res = await api.createProject({ orgId: opts.orgId, name: opts.name, prefix: opts.prefix });
-        console.log(JSON.stringify(res, null, 2));
+        const res = (await api.createProject({
+            orgId: opts.orgId,
+            name: opts.name,
+            prefix: opts.prefix,
+        }));
+        console.log(opts.json ? JSON.stringify(res, null, 2) : projectCreatedView(res, opts.name));
     }
     catch (e) {
         fail(e);
@@ -279,12 +289,14 @@ key
 });
 key
     .command("list")
+    .description("List an org's agent keys, newest first.")
     .requiredOption("--org-id <id>")
+    .option("--json", "Emit the raw payload instead of the table.")
     .action(async (opts) => {
     requireLogin();
     try {
-        const res = await api.listKeys({ orgId: opts.orgId });
-        console.log(JSON.stringify(res, null, 2));
+        const res = (await api.listKeys({ orgId: opts.orgId }));
+        console.log(opts.json ? JSON.stringify(res, null, 2) : keyListView(res));
     }
     catch (e) {
         fail(e);
@@ -347,11 +359,12 @@ members
     .command("list")
     .description("List an org's invites and their status (owner only).")
     .requiredOption("--org-id <id>")
+    .option("--json", "Emit the raw payload instead of the table.")
     .action(async (opts) => {
     requireLogin();
     try {
-        const res = await api.listInvites({ orgId: opts.orgId });
-        console.log(JSON.stringify(res, null, 2));
+        const res = (await api.listInvites({ orgId: opts.orgId }));
+        console.log(opts.json ? JSON.stringify(res, null, 2) : inviteListView(res));
     }
     catch (e) {
         fail(e);

package/dist/lib/format.js

@@ -0,0 +1,157 @@
+import { clean } from "./text.js";
+// RTSC-521 — the CLI's human-readable views.
+//
+// Five commands used to answer a person with `JSON.stringify(res, null, 2)`, including
+// `whoami`, which is the command someone runs to find out who they are. The one fact they
+// wanted was a bracket to parse, next to a Convex document id that means nothing to them.
+//
+// The "it's good for the agent" defence does not apply: agents never see CLI stdout. They
+// talk to MCP directly, and `whoami` exists there as its own tool. Nothing was reading
+// these payloads but a human.
+//
+// PURE, and returning strings rather than printing them, for two reasons. Tests can pin the
+// wording without scraping stdout, and every one of these values came off the wire — so
+// `clean()` belongs at the point of formatting, once, rather than at each interpolation
+// where a later line can forget it.
+//
+// The shape follows `commands/billing.ts`, which already got this right: an aligned summary
+// by default, `--json` for the raw payload. It is one pattern, not two.
+/** Width of the label column. Matches billing.ts's `row()` so the CLI reads as one tool. */
+const LABEL = 13;
+/** One `label   value` line. Multi-line values stay hung under the value column. */
+export function labelled(rows) {
+    return rows
+        .map(([label, value]) => {
+        const [head, ...rest] = String(value).split("\n");
+        const pad = " ".repeat(LABEL);
+        return [`${label.padEnd(LABEL)}${head}`, ...rest.map((r) => `${pad}${r}`)].join("\n");
+    })
+        .join("\n");
+}
+/**
+ * An aligned table, or a plain sentence when there is nothing in it.
+ *
+ * `empty` is required rather than optional: a list command that prints a bare header row
+ * and nothing else reads like a failure, and every caller has something truer to say.
+ */
+export function table(headers, rows, empty) {
+    if (rows.length === 0)
+        return empty;
+    const widths = headers.map((h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? "").length)));
+    // The last column is never padded — trailing spaces are invisible until someone copies
+    // a line out of their terminal and finds them.
+    const line = (cells) => cells.map((c, i) => (i === cells.length - 1 ? c : c.padEnd(widths[i]))).join("  ").trimEnd();
+    return [line(headers), ...rows.map(line)].join("\n");
+}
+/**
+ * How long ago, in the coarsest unit that is still true.
+ *
+ * A raw epoch is the specific thing this issue exists to remove: a revoked key reading as
+ * `1785660358922` is a number someone skims past, and "revoked" is the fact.
+ */
+export function ago(ms, now = Date.now()) {
+    if (ms == null)
+        return "never";
+    const s = Math.max(0, Math.round((now - ms) / 1000));
+    if (s < 60)
+        return "just now";
+    const m = Math.round(s / 60);
+    if (m < 60)
+        return `${m}m ago`;
+    const h = Math.round(m / 60);
+    if (h < 24)
+        return `${h}h ago`;
+    return `${Math.round(h / 24)}d ago`;
+}
+/** A date a human can read, for a deadline rather than an elapsed time. */
+export function day(ms) {
+    return ms == null ? "—" : new Date(ms).toISOString().slice(0, 10);
+}
+/**
+ * Who you are, and where you can act.
+ *
+ * The user id is dropped: nothing a person types accepts it. The org id is KEPT, because
+ * the very next command genuinely wants it (`retasc bind --org-id …`, `members invite
+ * --org-id …`) — the same reason the Dash surfaces it on the Settings page.
+ */
+export function whoamiView(me) {
+    const u = me.user ?? {};
+    const who = [u.name, u.email && `<${u.email}>`].filter(Boolean).map(clean).join(" ");
+    const orgs = me.orgs ?? [];
+    return labelled([
+        ["Signed in", who || "unknown"],
+        [
+            "Orgs",
+            // Said in words. An empty array printed as `[]` is the exact moment this command
+            // stops answering the question it was asked.
+            orgs.length === 0
+                ? "none"
+                : orgs
+                    .map((o) => {
+                    const bits = [clean(o.name)];
+                    if (o.slug)
+                        bits.push(`(${clean(o.slug)})`);
+                    const tail = [o.role && clean(o.role), o.deleting && "DELETING"].filter(Boolean);
+                    // `o.id` is Convex-generated and so not attacker-influenced today. Cleaned
+                    // anyway: this function's job is that nothing reaches a terminal unsanitised,
+                    // and one raw interpolation is how the next field added here gets missed.
+                    return `${bits.join(" ")}${tail.length ? ` · ${tail.join(" · ")}` : ""}\n  ${clean(o.id)}`;
+                })
+                    .join("\n"),
+        ],
+    ]);
+}
+export function orgCreatedView(res, name) {
+    // `ownerMemberId` is deliberately not shown. It comes back in the payload and there is no
+    // command that takes it, so printing it is noise a reader has to decide to ignore.
+    return [
+        `✓ Created org "${clean(name)}"${res.slug ? ` (${clean(res.slug)})` : ""}.`,
+        "",
+        labelled([["Org id", clean(res.orgId ?? "—")]]),
+        "",
+        `Next:  retasc bind --org-id ${clean(res.orgId ?? "<id>")}`,
+    ].join("\n");
+}
+export function projectCreatedView(res, name) {
+    return [
+        `✓ Created project "${clean(name)}"${res.prefix ? ` (${clean(res.prefix)})` : ""}.`,
+        "",
+        labelled([["Project id", clean(res.projectId ?? "—")]]),
+        "",
+        `Issues here will be numbered ${clean(res.prefix ?? "PREFIX")}-1, ${clean(res.prefix ?? "PREFIX")}-2, and so on.`,
+    ].join("\n");
+}
+/**
+ * The org's agent keys.
+ *
+ * Session keys (RTSC-50) are folded into a count rather than listed. They are auto-minted
+ * per session and can outnumber the real workspace keys many to one, which is why the Dash
+ * groups them too — a list where the manageable rows are lost among machine-minted children
+ * is a list nobody reads.
+ */
+export function keyListView(rows, now = Date.now()) {
+    const workspace = rows.filter((k) => !k.parentKeyId);
+    const sessions = rows.length - workspace.length;
+    const body = table(["KEY", "PROJECT", "AGENT", "RUNTIME", "LAST USED"], workspace.map((k) => [
+        clean(k.displayPrefix ?? k.name ?? "—"),
+        clean(k.project ?? "—"),
+        clean(k.agent ?? "—"),
+        clean(k.runtime ?? "—"),
+        // State first: a revoked key that reads as a date is one someone counts as live.
+        k.revokedAt ? "revoked" : ago(k.lastUsedAt, now),
+    ]), "No keys yet. Mint one with `retasc key mint`.");
+    return sessions > 0
+        ? `${body}\n\n(${sessions} session key${sessions === 1 ? "" : "s"} not shown — auto-minted per agent session.)`
+        : body;
+}
+export function inviteListView(rows) {
+    return table(["CODE", "ROLE", "STATUS", "INVITED BY", "EXPIRES"], rows.map((i) => [
+        clean(i.displayPrefix ?? "—"),
+        clean(i.role ?? "—"),
+        clean(i.status ?? "—"),
+        clean(i.invitedBy ?? "—"),
+        // Only a LIVE invite has a deadline worth reading. On a spent one the date is
+        // still in the payload and still means nothing.
+        i.status === "pending" ? day(i.expiresAt) : "—",
+    ]), "No invites yet. Create one with `retasc members invite --org-id <id>`.");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.11.0",
+  "version": "1.13.0",
   "description": "Retasc CLI — sign in with GitHub, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {