@retasc/cli 1.23.0 → 1.24.0

package/CHANGELOG.md

@@ -6,6 +6,28 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.24.0 (2026-08-19)
+
+- **RTSC-667** — `retasc members invite` asks instead of demanding ids. It used to
+  require `--org-id`, and the new `--project-id` made that worse: nothing in the CLI
+  lists project ids, so a scoped invite meant fetching one from the Dash. Run it with no
+  flags in a terminal and it asks which org (only the ones you can actually invite into)
+  and which projects, with **All projects** as the first option rather than the thing you
+  get by not answering. It asks nothing when there is nothing to choose — one eligible
+  org, or fewer than two projects — and a script with no TTY behaves exactly as before.
+  The flags still work and still win.
+- **RTSC-666** — the PROJECTS column in `retasc members list` comma-joins, so two
+  projects read as `XTRO, XTRO Marketing` rather than running together.
+- **RTSC-664** — invite someone to one project, not the whole org. Membership was org-level,
+  so anyone you invited read every project you had. `retasc members invite` now takes
+  `--project-id <id>`, repeatable, and the invitee lands scoped to exactly those projects.
+  Omitting it still grants every project, so an existing script keeps its behaviour untouched
+  and an org that never scopes anyone never notices this shipped. `retasc members list` gains
+  a PROJECTS column naming what each code confers, with `All` for the unscoped ones — an
+  unscoped invite is the WIDEST grant, and a column that rendered it as a dash would read as
+  "none". Enforcement is server-side at every door, agent auth included: a key whose project
+  leaves its principal's scope stops authenticating on its very next call.
+
 ## 1.23.0 (2026-08-17)
 
 - **RTSC-660** — the proxy attaches files for you. Attaching a file was the one Retasc write

package/dist/api.js

@@ -180,6 +180,7 @@ export const api = {
     mintKey: (args) => withAuth(() => client().action(fns.mintKey, args)),
     rotateKey: (args) => withAuth(() => client().action(fns.rotateKey, args)),
     revokeKey: (args) => withAuth(() => client().mutation(fns.revokeKey, args)),
+    // `projectIds` omitted ⇒ every project (RTSC-664).
     createInvite: (args) => withAuth(() => client().action(fns.createInvite, args)),
     acceptInvite: (args) => withAuth(() => client().mutation(fns.acceptInvite, args)),
     listInvites: (args) => withAuth(() => client().query(fns.listInvites, args)),

package/dist/commands/invite.js

@@ -0,0 +1,52 @@
+import { cliError } from "../api.js";
+import { pickExisting, isInteractive, ask } from "./bind.js";
+import { clean } from "../lib/text.js";
+/** The "every project" entry in the project menu. A symbol, so it can never collide
+ *  with a project id, however a future id is shaped. */
+const ALL = Symbol("all-projects");
+/**
+ * Which org is this invite for?
+ *
+ * Only orgs the caller can actually invite into are offered. The owner/admin gate is
+ * enforced server-side (`requireOwnerOrAdmin`), and offering a plain member an org they
+ * will be refused reads as permission — the same rule `pickExisting`'s own header
+ * states. Orgs mid-delete are dropped for the same reason: `acceptInvite` refuses them.
+ */
+export async function chooseInviteOrg(orgs, opts = {}) {
+    const eligible = orgs.filter((o) => !o.deleting && o.role !== "member");
+    if (eligible.length === 0) {
+        cliError("FORBIDDEN", "You can't invite anyone: you're not an owner or admin of any org.", "Ask an owner of the org you want to invite into to send the invite, or to make you an admin.");
+    }
+    // One choice is not a choice. The confirmation line names the org afterwards, so
+    // nothing is silently assumed on the caller's behalf.
+    if (eligible.length === 1)
+        return eligible[0].id;
+    const interactive = opts.interactive ?? isInteractive();
+    if (!interactive) {
+        cliError("AMBIGUOUS", `You're an owner or admin of ${eligible.length} orgs, so one has to be named.`, `Pass --org-id <id>: ${eligible.map((o) => `${clean(o.name)}=${o.id}`).join(", ")}`);
+    }
+    const chosen = await pickExisting("Which org", eligible, (o) => (o.slug ? `${clean(o.name)} (${clean(o.slug)})` : clean(o.name)), opts.askFn ?? ask);
+    return chosen.id;
+}
+/**
+ * Which projects may the invitee reach? `undefined` ⇒ every project.
+ *
+ * The menu's FIRST entry is "All projects" — an explicit option, never the thing you
+ * get by not answering. Handing someone the whole org should be a choice somebody
+ * made; that is the same call the Dash's invite form makes, for the same reason.
+ *
+ * Two cases skip the question and mean "every project", which is what this command has
+ * always done when no project was named:
+ *   • fewer than two projects — there is nothing to choose between
+ *   • no TTY — a script that named no project keeps its behaviour, and prompting a
+ *     pipeline is how a release hangs CI rather than failing it
+ */
+export async function chooseInviteProjects(projects, opts = {}) {
+    if (projects.length < 2)
+        return undefined;
+    const interactive = opts.interactive ?? isInteractive();
+    if (!interactive)
+        return undefined;
+    const chosen = await pickExisting("Which projects can they see", [ALL, ...projects], (p) => (p === ALL ? "All projects" : clean(p.name)), opts.askFn ?? ask);
+    return chosen === ALL ? undefined : [chosen.id];
+}

package/dist/index.js

@@ -7,6 +7,7 @@ import { installGate, resolveGatePrefix } from "./commands/gate.js";
 import { claimAction } from "./commands/claim.js";
 import { bindAction, setupFromToken } from "./commands/bind.js";
 import { joinAction } from "./commands/join.js";
+import { chooseInviteOrg, chooseInviteProjects } from "./commands/invite.js";
 import { identityAction } from "./commands/identity.js";
 import { importAction } from "./commands/import.js";
 import { doctorAction } from "./commands/doctor.js";
@@ -357,12 +358,32 @@ const members = program.command("members").description("Invite people to an org
 members
     .command("invite")
     .description("Mint a single-use invite code for an org (owner or admin). Shown once.")
-    .requiredOption("--org-id <id>")
+    // RTSC-667 — no longer REQUIRED. Omit it in a terminal and you are asked which org,
+    // from the ones you can actually invite into. It stays available because a script
+    // has nobody to ask.
+    .option("--org-id <id>", "Which org (asked if omitted)")
     .option("--expires-days <n>", "Days until the code expires (1–30, default 7)", (v) => parseInt(v, 10))
+    // RTSC-664. Repeatable, and OMITTED MEANS EVERY PROJECT — the behaviour this
+    // command has always had, so an existing script keeps working untouched. RTSC-667
+    // adds the question a human gets instead, with "All projects" as an explicit first
+    // option rather than the thing you get by not answering.
+    .option("--project-id <id>", "Limit the invitee to this project (repeatable; asked if omitted, all if skipped)", (v, prev) => [...prev, v], [])
     .action(async (opts) => {
     requireLogin();
     try {
-        const res = (await api.createInvite({ orgId: opts.orgId, expiresInDays: opts.expiresDays }));
+        // Ask only for what the command line didn't answer, and fetch only for what we
+        // are about to ask: naming --org-id must not cost a round trip for a question
+        // nobody sees.
+        const orgId = opts.orgId ?? (await chooseInviteOrg(((await api.me()).orgs ?? [])));
+        const named = opts.projectId ?? [];
+        const projectIds = named.length
+            ? named
+            : await chooseInviteProjects((await api.listProjects({ orgId })).projects ?? []);
+        const res = (await api.createInvite({
+            orgId,
+            expiresInDays: opts.expiresDays,
+            ...(projectIds ? { projectIds } : {}),
+        }));
         console.log(`✓ Invite code: ${res.code}`);
         console.log(`  Expires ${new Date(res.expiresAt).toISOString().slice(0, 10)}. Single-use — shown once.`);
         // RTSC-492: one command, and one that needs nothing installed first. `join` signs

package/dist/lib/format.js

@@ -145,9 +145,17 @@ export function keyListView(rows, now = Date.now()) {
         : body;
 }
 export function inviteListView(rows) {
-    return table(["CODE", "ROLE", "STATUS", "INVITED BY", "EXPIRES"], rows.map((i) => [
+    return table(["CODE", "ROLE", "PROJECTS", "STATUS", "INVITED BY", "EXPIRES"], rows.map((i) => [
         clean(i.displayPrefix ?? "—"),
         clean(i.role ?? "—"),
+        // "All" rather than a dash: an unscoped invite grants MORE than a scoped one,
+        // and a column that renders the widest grant as an em dash reads as "none".
+        //
+        // RTSC-666 — comma-joined, not space-joined. A space was unambiguous while the
+        // server sent PREFIXES, which never contain one; it sends names now, so two
+        // projects rendered as "XTRO XTRO Marketing" — three words, or one badly named
+        // thing, but not two projects. Matches how the Dash joins the same list.
+        i.projects == null ? "All" : clean(i.projects.join(", ") || "—"),
         clean(i.status ?? "—"),
         clean(i.invitedBy ?? "—"),
         // Only a LIVE invite has a deadline worth reading. On a spent one the date is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.23.0",
+  "version": "1.24.0",
   "description": "Retasc CLI — the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {