@retasc/cli 1.24.0 → 1.25.0

package/CHANGELOG.md

@@ -6,6 +6,17 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.25.0 (2026-08-19)
+
+- **RTSC-669** — the invite project picker takes several projects. 1.24.0 shipped it
+  single-select, which left "two of these four" expressible nowhere: the workaround —
+  repeating `--project-id` — needs ids that nothing in the CLI lists, which is the gap
+  the picker existed to close. Answer `2,4` (or `2 4`) and the invite grants exactly
+  those. Naming every project collapses to all projects, so the grant follows the org as
+  it grows rather than freezing today's list. `1) All projects` can't be combined with
+  individual ones: that's a contradiction about the widest grant there is, so it re-asks
+  instead of guessing which half you meant.
+
 ## 1.24.0 (2026-08-19)
 
 - **RTSC-667** — `retasc members invite` asks instead of demanding ids. It used to

package/dist/commands/invite.js

@@ -1,9 +1,36 @@
 import { cliError } from "../api.js";
 import { pickExisting, isInteractive, ask } from "./bind.js";
 import { clean } from "../lib/text.js";
-/** The "every project" entry in the project menu. A symbol, so it can never collide
- *  with a project id, however a future id is shaped. */
-const ALL = Symbol("all-projects");
+/**
+ * Parse an answer to the multi-select prompt into 1-based positions (RTSC-669).
+ *
+ * Exported for its tests: this is the whole of the input rule, and the rule is the part
+ * that goes wrong. Returns null for anything that isn't a clean selection, so every
+ * rejection re-prompts rather than resolving to a subset of what was typed — picking
+ * SOME of the projects somebody listed is worse than picking none, because they would
+ * never see which ones went missing.
+ *
+ * `max` is the highest offerable position.
+ */
+export function parseSelection(answer, max) {
+    const tokens = answer.split(/[\s,]+/).filter(Boolean);
+    if (!tokens.length)
+        return null;
+    const out = [];
+    for (const t of tokens) {
+        // Digits ONLY. `Number()` alone accepts "0x4", "4e0", "+4" and "4.0", and RTSC-269
+        // is the record of what happens when a non-canonical spelling reaches a branch it
+        // was never meant to: a typo picked the destructive option instead of re-asking.
+        if (!/^\d+$/.test(t))
+            return null;
+        const n = Number(t);
+        if (n < 1 || n > max)
+            return null;
+        if (!out.includes(n))
+            out.push(n); // "2,2" is a typo, not a double selection
+    }
+    return out;
+}
 /**
  * Which org is this invite for?
  *
@@ -31,9 +58,22 @@ export async function chooseInviteOrg(orgs, opts = {}) {
 /**
  * Which projects may the invitee reach? `undefined` ⇒ every project.
  *
+ * MULTI-select (RTSC-669), because the data model always was: `projectIds` is an array
+ * and the Dash modal has picked any combination since RTSC-665. Shipping a single-select
+ * picker here left "two of these four" expressible nowhere — the documented workaround,
+ * repeating `--project-id`, needs ids that nothing in the CLI lists, which is the very
+ * gap the picker was added to close.
+ *
+ * Hand-rolled rather than widened out of `choose`/`pickExisting`: those are single-select
+ * by contract and `bind`, `join` and the identity prompt all rely on it. Teaching them to
+ * return "one or many" would put that ambiguity into every picker in the product to serve
+ * one caller.
+ *
  * The menu's FIRST entry is "All projects" — an explicit option, never the thing you
- * get by not answering. Handing someone the whole org should be a choice somebody
- * made; that is the same call the Dash's invite form makes, for the same reason.
+ * get by not answering, and never combinable with the others (that is a contradiction
+ * about the widest grant there is, so it re-prompts rather than resolving). Handing
+ * someone the whole org should be a choice somebody made; that is the same call the
+ * Dash's invite form makes, for the same reason.
  *
  * Two cases skip the question and mean "every project", which is what this command has
  * always done when no project was named:
@@ -47,6 +87,35 @@ export async function chooseInviteProjects(projects, opts = {}) {
     const interactive = opts.interactive ?? isInteractive();
     if (!interactive)
         return undefined;
-    const chosen = await pickExisting("Which projects can they see", [ALL, ...projects], (p) => (p === ALL ? "All projects" : clean(p.name)), opts.askFn ?? ask);
-    return chosen === ALL ? undefined : [chosen.id];
+    const askFn = opts.askFn ?? ask;
+    console.log("\nWhich projects can they see:");
+    console.log("  1) All projects");
+    projects.forEach((p, i) => console.log(`  ${i + 2}) ${clean(p.name)}`));
+    const max = projects.length + 1;
+    // Three attempts then abort, the cap `choose` uses: an EOF stdin returns "" forever,
+    // and a prompt that re-asks forever is a hang rather than a failure.
+    for (let attempt = 0; attempt < 3; attempt++) {
+        const picked = parseSelection(await askFn("Choose a number, or several (e.g. 2,4): "), max);
+        if (!picked) {
+            console.log(`Please enter numbers between 1 and ${max}, separated by commas.`);
+            continue;
+        }
+        const wantsAll = picked.includes(1);
+        if (wantsAll && picked.length > 1) {
+            // Not resolvable either way, so it must not be resolved. "All projects AND
+            // Marketing" is a contradiction about the widest grant in the product, and
+            // guessing which half they meant is how someone hands over an org by accident.
+            console.log("1) All projects can't be combined with individual projects. Pick one or the other.");
+            continue;
+        }
+        if (wantsAll)
+            return undefined;
+        const chosen = picked.map((n) => projects[n - 2]);
+        // Naming every project IS "all projects", and storing it as a list would freeze the
+        // grant at today's set — a project added next month would be missing from a scope
+        // its author chose as everything. `normalizeInviteScope` collapses this server-side
+        // too; doing it here as well keeps the confirmation honest about what was granted.
+        return chosen.length === projects.length ? undefined : chosen.map((p) => p.id);
+    }
+    throw new Error("no valid choice — aborting");
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@retasc/cli",
-  "version": "1.24.0",
-  "description": "Retasc CLI — the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
+  "version": "1.25.0",
+  "description": "Retasc CLI \u2014 the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {
     "retasc": "dist/index.js"