@retasc/cli 1.23.0 → 1.25.0

package/CHANGELOG.md

@@ -6,6 +6,39 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.25.0 (2026-08-19)
+
+- **RTSC-669** — the invite project picker takes several projects. 1.24.0 shipped it
+  single-select, which left "two of these four" expressible nowhere: the workaround —
+  repeating `--project-id` — needs ids that nothing in the CLI lists, which is the gap
+  the picker existed to close. Answer `2,4` (or `2 4`) and the invite grants exactly
+  those. Naming every project collapses to all projects, so the grant follows the org as
+  it grows rather than freezing today's list. `1) All projects` can't be combined with
+  individual ones: that's a contradiction about the widest grant there is, so it re-asks
+  instead of guessing which half you meant.
+
+## 1.24.0 (2026-08-19)
+
+- **RTSC-667** — `retasc members invite` asks instead of demanding ids. It used to
+  require `--org-id`, and the new `--project-id` made that worse: nothing in the CLI
+  lists project ids, so a scoped invite meant fetching one from the Dash. Run it with no
+  flags in a terminal and it asks which org (only the ones you can actually invite into)
+  and which projects, with **All projects** as the first option rather than the thing you
+  get by not answering. It asks nothing when there is nothing to choose — one eligible
+  org, or fewer than two projects — and a script with no TTY behaves exactly as before.
+  The flags still work and still win.
+- **RTSC-666** — the PROJECTS column in `retasc members list` comma-joins, so two
+  projects read as `XTRO, XTRO Marketing` rather than running together.
+- **RTSC-664** — invite someone to one project, not the whole org. Membership was org-level,
+  so anyone you invited read every project you had. `retasc members invite` now takes
+  `--project-id <id>`, repeatable, and the invitee lands scoped to exactly those projects.
+  Omitting it still grants every project, so an existing script keeps its behaviour untouched
+  and an org that never scopes anyone never notices this shipped. `retasc members list` gains
+  a PROJECTS column naming what each code confers, with `All` for the unscoped ones — an
+  unscoped invite is the WIDEST grant, and a column that rendered it as a dash would read as
+  "none". Enforcement is server-side at every door, agent auth included: a key whose project
+  leaves its principal's scope stops authenticating on its very next call.
+
 ## 1.23.0 (2026-08-17)
 
 - **RTSC-660** — the proxy attaches files for you. Attaching a file was the one Retasc write

package/dist/api.js

@@ -180,6 +180,7 @@ export const api = {
     mintKey: (args) => withAuth(() => client().action(fns.mintKey, args)),
     rotateKey: (args) => withAuth(() => client().action(fns.rotateKey, args)),
     revokeKey: (args) => withAuth(() => client().mutation(fns.revokeKey, args)),
+    // `projectIds` omitted ⇒ every project (RTSC-664).
     createInvite: (args) => withAuth(() => client().action(fns.createInvite, args)),
     acceptInvite: (args) => withAuth(() => client().mutation(fns.acceptInvite, args)),
     listInvites: (args) => withAuth(() => client().query(fns.listInvites, args)),

package/dist/commands/invite.js

@@ -0,0 +1,121 @@
+import { cliError } from "../api.js";
+import { pickExisting, isInteractive, ask } from "./bind.js";
+import { clean } from "../lib/text.js";
+/**
+ * Parse an answer to the multi-select prompt into 1-based positions (RTSC-669).
+ *
+ * Exported for its tests: this is the whole of the input rule, and the rule is the part
+ * that goes wrong. Returns null for anything that isn't a clean selection, so every
+ * rejection re-prompts rather than resolving to a subset of what was typed — picking
+ * SOME of the projects somebody listed is worse than picking none, because they would
+ * never see which ones went missing.
+ *
+ * `max` is the highest offerable position.
+ */
+export function parseSelection(answer, max) {
+    const tokens = answer.split(/[\s,]+/).filter(Boolean);
+    if (!tokens.length)
+        return null;
+    const out = [];
+    for (const t of tokens) {
+        // Digits ONLY. `Number()` alone accepts "0x4", "4e0", "+4" and "4.0", and RTSC-269
+        // is the record of what happens when a non-canonical spelling reaches a branch it
+        // was never meant to: a typo picked the destructive option instead of re-asking.
+        if (!/^\d+$/.test(t))
+            return null;
+        const n = Number(t);
+        if (n < 1 || n > max)
+            return null;
+        if (!out.includes(n))
+            out.push(n); // "2,2" is a typo, not a double selection
+    }
+    return out;
+}
+/**
+ * Which org is this invite for?
+ *
+ * Only orgs the caller can actually invite into are offered. The owner/admin gate is
+ * enforced server-side (`requireOwnerOrAdmin`), and offering a plain member an org they
+ * will be refused reads as permission — the same rule `pickExisting`'s own header
+ * states. Orgs mid-delete are dropped for the same reason: `acceptInvite` refuses them.
+ */
+export async function chooseInviteOrg(orgs, opts = {}) {
+    const eligible = orgs.filter((o) => !o.deleting && o.role !== "member");
+    if (eligible.length === 0) {
+        cliError("FORBIDDEN", "You can't invite anyone: you're not an owner or admin of any org.", "Ask an owner of the org you want to invite into to send the invite, or to make you an admin.");
+    }
+    // One choice is not a choice. The confirmation line names the org afterwards, so
+    // nothing is silently assumed on the caller's behalf.
+    if (eligible.length === 1)
+        return eligible[0].id;
+    const interactive = opts.interactive ?? isInteractive();
+    if (!interactive) {
+        cliError("AMBIGUOUS", `You're an owner or admin of ${eligible.length} orgs, so one has to be named.`, `Pass --org-id <id>: ${eligible.map((o) => `${clean(o.name)}=${o.id}`).join(", ")}`);
+    }
+    const chosen = await pickExisting("Which org", eligible, (o) => (o.slug ? `${clean(o.name)} (${clean(o.slug)})` : clean(o.name)), opts.askFn ?? ask);
+    return chosen.id;
+}
+/**
+ * Which projects may the invitee reach? `undefined` ⇒ every project.
+ *
+ * MULTI-select (RTSC-669), because the data model always was: `projectIds` is an array
+ * and the Dash modal has picked any combination since RTSC-665. Shipping a single-select
+ * picker here left "two of these four" expressible nowhere — the documented workaround,
+ * repeating `--project-id`, needs ids that nothing in the CLI lists, which is the very
+ * gap the picker was added to close.
+ *
+ * Hand-rolled rather than widened out of `choose`/`pickExisting`: those are single-select
+ * by contract and `bind`, `join` and the identity prompt all rely on it. Teaching them to
+ * return "one or many" would put that ambiguity into every picker in the product to serve
+ * one caller.
+ *
+ * The menu's FIRST entry is "All projects" — an explicit option, never the thing you
+ * get by not answering, and never combinable with the others (that is a contradiction
+ * about the widest grant there is, so it re-prompts rather than resolving). Handing
+ * someone the whole org should be a choice somebody made; that is the same call the
+ * Dash's invite form makes, for the same reason.
+ *
+ * Two cases skip the question and mean "every project", which is what this command has
+ * always done when no project was named:
+ *   • fewer than two projects — there is nothing to choose between
+ *   • no TTY — a script that named no project keeps its behaviour, and prompting a
+ *     pipeline is how a release hangs CI rather than failing it
+ */
+export async function chooseInviteProjects(projects, opts = {}) {
+    if (projects.length < 2)
+        return undefined;
+    const interactive = opts.interactive ?? isInteractive();
+    if (!interactive)
+        return undefined;
+    const askFn = opts.askFn ?? ask;
+    console.log("\nWhich projects can they see:");
+    console.log("  1) All projects");
+    projects.forEach((p, i) => console.log(`  ${i + 2}) ${clean(p.name)}`));
+    const max = projects.length + 1;
+    // Three attempts then abort, the cap `choose` uses: an EOF stdin returns "" forever,
+    // and a prompt that re-asks forever is a hang rather than a failure.
+    for (let attempt = 0; attempt < 3; attempt++) {
+        const picked = parseSelection(await askFn("Choose a number, or several (e.g. 2,4): "), max);
+        if (!picked) {
+            console.log(`Please enter numbers between 1 and ${max}, separated by commas.`);
+            continue;
+        }
+        const wantsAll = picked.includes(1);
+        if (wantsAll && picked.length > 1) {
+            // Not resolvable either way, so it must not be resolved. "All projects AND
+            // Marketing" is a contradiction about the widest grant in the product, and
+            // guessing which half they meant is how someone hands over an org by accident.
+            console.log("1) All projects can't be combined with individual projects. Pick one or the other.");
+            continue;
+        }
+        if (wantsAll)
+            return undefined;
+        const chosen = picked.map((n) => projects[n - 2]);
+        // Naming every project IS "all projects", and storing it as a list would freeze the
+        // grant at today's set — a project added next month would be missing from a scope
+        // its author chose as everything. `normalizeInviteScope` collapses this server-side
+        // too; doing it here as well keeps the confirmation honest about what was granted.
+        return chosen.length === projects.length ? undefined : chosen.map((p) => p.id);
+    }
+    throw new Error("no valid choice — aborting");
+}

package/dist/index.js

@@ -7,6 +7,7 @@ import { installGate, resolveGatePrefix } from "./commands/gate.js";
 import { claimAction } from "./commands/claim.js";
 import { bindAction, setupFromToken } from "./commands/bind.js";
 import { joinAction } from "./commands/join.js";
+import { chooseInviteOrg, chooseInviteProjects } from "./commands/invite.js";
 import { identityAction } from "./commands/identity.js";
 import { importAction } from "./commands/import.js";
 import { doctorAction } from "./commands/doctor.js";
@@ -357,12 +358,32 @@ const members = program.command("members").description("Invite people to an org
 members
     .command("invite")
     .description("Mint a single-use invite code for an org (owner or admin). Shown once.")
-    .requiredOption("--org-id <id>")
+    // RTSC-667 — no longer REQUIRED. Omit it in a terminal and you are asked which org,
+    // from the ones you can actually invite into. It stays available because a script
+    // has nobody to ask.
+    .option("--org-id <id>", "Which org (asked if omitted)")
     .option("--expires-days <n>", "Days until the code expires (1–30, default 7)", (v) => parseInt(v, 10))
+    // RTSC-664. Repeatable, and OMITTED MEANS EVERY PROJECT — the behaviour this
+    // command has always had, so an existing script keeps working untouched. RTSC-667
+    // adds the question a human gets instead, with "All projects" as an explicit first
+    // option rather than the thing you get by not answering.
+    .option("--project-id <id>", "Limit the invitee to this project (repeatable; asked if omitted, all if skipped)", (v, prev) => [...prev, v], [])
     .action(async (opts) => {
     requireLogin();
     try {
-        const res = (await api.createInvite({ orgId: opts.orgId, expiresInDays: opts.expiresDays }));
+        // Ask only for what the command line didn't answer, and fetch only for what we
+        // are about to ask: naming --org-id must not cost a round trip for a question
+        // nobody sees.
+        const orgId = opts.orgId ?? (await chooseInviteOrg(((await api.me()).orgs ?? [])));
+        const named = opts.projectId ?? [];
+        const projectIds = named.length
+            ? named
+            : await chooseInviteProjects((await api.listProjects({ orgId })).projects ?? []);
+        const res = (await api.createInvite({
+            orgId,
+            expiresInDays: opts.expiresDays,
+            ...(projectIds ? { projectIds } : {}),
+        }));
         console.log(`✓ Invite code: ${res.code}`);
         console.log(`  Expires ${new Date(res.expiresAt).toISOString().slice(0, 10)}. Single-use — shown once.`);
         // RTSC-492: one command, and one that needs nothing installed first. `join` signs

package/dist/lib/format.js

@@ -145,9 +145,17 @@ export function keyListView(rows, now = Date.now()) {
         : body;
 }
 export function inviteListView(rows) {
-    return table(["CODE", "ROLE", "STATUS", "INVITED BY", "EXPIRES"], rows.map((i) => [
+    return table(["CODE", "ROLE", "PROJECTS", "STATUS", "INVITED BY", "EXPIRES"], rows.map((i) => [
         clean(i.displayPrefix ?? "—"),
         clean(i.role ?? "—"),
+        // "All" rather than a dash: an unscoped invite grants MORE than a scoped one,
+        // and a column that renders the widest grant as an em dash reads as "none".
+        //
+        // RTSC-666 — comma-joined, not space-joined. A space was unambiguous while the
+        // server sent PREFIXES, which never contain one; it sends names now, so two
+        // projects rendered as "XTRO XTRO Marketing" — three words, or one badly named
+        // thing, but not two projects. Matches how the Dash joins the same list.
+        i.projects == null ? "All" : clean(i.projects.join(", ") || "—"),
         clean(i.status ?? "—"),
         clean(i.invitedBy ?? "—"),
         // Only a LIVE invite has a deadline worth reading. On a spent one the date is

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@retasc/cli",
-  "version": "1.23.0",
-  "description": "Retasc CLI — the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
+  "version": "1.25.0",
+  "description": "Retasc CLI \u2014 the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {
     "retasc": "dist/index.js"