@retasc/cli 1.24.0 → 1.26.0

package/CHANGELOG.md

@@ -6,6 +6,32 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.26.0 (2026-08-19)
+
+- **RTSC-670** — `retasc bind` can sign you in again. It has opened with the device flow
+  since 1.20-era, but a leftover session guard in the command wrapper exited first, so on
+  a machine that had never signed in — the only state a new owner is ever in — `bind`
+  printed "Not signed in" and stopped. Owner onboarding dead-ended at its first
+  documented command, on every release for three weeks. The guard was correct when it was
+  written and became redundant the moment `bind` grew its own sign-in; nothing noticed
+  because no test ran the CLI with no session. Four now do.
+- **RTSC-671** — errors name the command you actually ran. Told to `npx @retasc/cli bind`
+  and then answered with "Run `retasc login` first", you were pointed at a binary that
+  invocation never installs — a recoverable stumble turned into a dead end. Every "run X
+  first" message now renders `npx -y @retasc/cli@<version> …` or `retasc …` to match how
+  you started it.
+
+## 1.25.0 (2026-08-19)
+
+- **RTSC-669** — the invite project picker takes several projects. 1.24.0 shipped it
+  single-select, which left "two of these four" expressible nowhere: the workaround —
+  repeating `--project-id` — needs ids that nothing in the CLI lists, which is the gap
+  the picker existed to close. Answer `2,4` (or `2 4`) and the invite grants exactly
+  those. Naming every project collapses to all projects, so the grant follows the org as
+  it grows rather than freezing today's list. `1) All projects` can't be combined with
+  individual ones: that's a contradiction about the widest grant there is, so it re-asks
+  instead of guessing which half you meant.
+
 ## 1.24.0 (2026-08-19)
 
 - **RTSC-667** — `retasc members invite` asks instead of demanding ids. It used to

package/dist/api.js

@@ -2,6 +2,8 @@ import { ConvexHttpClient } from "convex/browser";
 import { makeFunctionReference } from "convex/server";
 import { loadConfig } from "./config.js";
 import { refreshSession, deviceLogin } from "./auth.js";
+import { selfCommand } from "./lib/launcher.js";
+import { VERSION } from "./version.js";
 // Typed-ish references to the public management functions in convex/manage.ts.
 // The CLI is a standalone package, so we reference functions by name rather than
 // importing the parent's generated api.
@@ -163,7 +165,7 @@ async function withAuth(call) {
         if (await refreshSession())
             return await call();
         if (!process.stdout.isTTY) {
-            throw new Error("Session expired and could not refresh. Run `retasc login`.");
+            throw new Error(`Session expired and could not refresh. Run \`${selfCommand(VERSION)} login\`.`);
         }
         console.error("Session expired — re-authenticating with GitHub…");
         await deviceLogin();

package/dist/commands/bind.js

@@ -493,7 +493,7 @@ export async function ensureSignedIn() {
     if (loadConfig().token)
         return;
     if (!isInteractive()) {
-        throw new Error("Not signed in. Run `retasc login` first (no TTY here for the device flow).");
+        throw new Error(`Not signed in. Run \`${selfCommand(VERSION)} login\` first (no TTY here for the device flow).`);
     }
     // RTSC-508: don't name a provider here. `deviceLogin` asks which door, and
     // announcing "GitHub" before the question would be wrong for the invited

package/dist/commands/identity.js

@@ -1,6 +1,8 @@
 import { api } from "../api.js";
 import { clean } from "../lib/text.js";
 import { isInteractive } from "./bind.js";
+import { selfCommand } from "../lib/launcher.js";
+import { VERSION } from "../version.js";
 import { identityLoop } from "./join.js";
 /**
  * Which org's placeholders to offer.
@@ -65,7 +67,7 @@ function report(outcome, orgLabel) {
             console.log("Noted. That covers those tools only, so a later import will ask again.");
             return;
         case "left":
-            console.log("Nothing linked. Run `retasc identity` again whenever you want to look.");
+            console.log(`Nothing linked. Run \`${selfCommand(VERSION)} identity\` again whenever you want to look.`);
             return;
         case "skipped":
             // Only reachable non-interactively; the interactive guard below catches that first.

package/dist/commands/invite.js

@@ -1,9 +1,36 @@
 import { cliError } from "../api.js";
 import { pickExisting, isInteractive, ask } from "./bind.js";
 import { clean } from "../lib/text.js";
-/** The "every project" entry in the project menu. A symbol, so it can never collide
- *  with a project id, however a future id is shaped. */
-const ALL = Symbol("all-projects");
+/**
+ * Parse an answer to the multi-select prompt into 1-based positions (RTSC-669).
+ *
+ * Exported for its tests: this is the whole of the input rule, and the rule is the part
+ * that goes wrong. Returns null for anything that isn't a clean selection, so every
+ * rejection re-prompts rather than resolving to a subset of what was typed — picking
+ * SOME of the projects somebody listed is worse than picking none, because they would
+ * never see which ones went missing.
+ *
+ * `max` is the highest offerable position.
+ */
+export function parseSelection(answer, max) {
+    const tokens = answer.split(/[\s,]+/).filter(Boolean);
+    if (!tokens.length)
+        return null;
+    const out = [];
+    for (const t of tokens) {
+        // Digits ONLY. `Number()` alone accepts "0x4", "4e0", "+4" and "4.0", and RTSC-269
+        // is the record of what happens when a non-canonical spelling reaches a branch it
+        // was never meant to: a typo picked the destructive option instead of re-asking.
+        if (!/^\d+$/.test(t))
+            return null;
+        const n = Number(t);
+        if (n < 1 || n > max)
+            return null;
+        if (!out.includes(n))
+            out.push(n); // "2,2" is a typo, not a double selection
+    }
+    return out;
+}
 /**
  * Which org is this invite for?
  *
@@ -31,9 +58,22 @@ export async function chooseInviteOrg(orgs, opts = {}) {
 /**
  * Which projects may the invitee reach? `undefined` ⇒ every project.
  *
+ * MULTI-select (RTSC-669), because the data model always was: `projectIds` is an array
+ * and the Dash modal has picked any combination since RTSC-665. Shipping a single-select
+ * picker here left "two of these four" expressible nowhere — the documented workaround,
+ * repeating `--project-id`, needs ids that nothing in the CLI lists, which is the very
+ * gap the picker was added to close.
+ *
+ * Hand-rolled rather than widened out of `choose`/`pickExisting`: those are single-select
+ * by contract and `bind`, `join` and the identity prompt all rely on it. Teaching them to
+ * return "one or many" would put that ambiguity into every picker in the product to serve
+ * one caller.
+ *
  * The menu's FIRST entry is "All projects" — an explicit option, never the thing you
- * get by not answering. Handing someone the whole org should be a choice somebody
- * made; that is the same call the Dash's invite form makes, for the same reason.
+ * get by not answering, and never combinable with the others (that is a contradiction
+ * about the widest grant there is, so it re-prompts rather than resolving). Handing
+ * someone the whole org should be a choice somebody made; that is the same call the
+ * Dash's invite form makes, for the same reason.
  *
  * Two cases skip the question and mean "every project", which is what this command has
  * always done when no project was named:
@@ -47,6 +87,35 @@ export async function chooseInviteProjects(projects, opts = {}) {
     const interactive = opts.interactive ?? isInteractive();
     if (!interactive)
         return undefined;
-    const chosen = await pickExisting("Which projects can they see", [ALL, ...projects], (p) => (p === ALL ? "All projects" : clean(p.name)), opts.askFn ?? ask);
-    return chosen === ALL ? undefined : [chosen.id];
+    const askFn = opts.askFn ?? ask;
+    console.log("\nWhich projects can they see:");
+    console.log("  1) All projects");
+    projects.forEach((p, i) => console.log(`  ${i + 2}) ${clean(p.name)}`));
+    const max = projects.length + 1;
+    // Three attempts then abort, the cap `choose` uses: an EOF stdin returns "" forever,
+    // and a prompt that re-asks forever is a hang rather than a failure.
+    for (let attempt = 0; attempt < 3; attempt++) {
+        const picked = parseSelection(await askFn("Choose a number, or several (e.g. 2,4): "), max);
+        if (!picked) {
+            console.log(`Please enter numbers between 1 and ${max}, separated by commas.`);
+            continue;
+        }
+        const wantsAll = picked.includes(1);
+        if (wantsAll && picked.length > 1) {
+            // Not resolvable either way, so it must not be resolved. "All projects AND
+            // Marketing" is a contradiction about the widest grant in the product, and
+            // guessing which half they meant is how someone hands over an org by accident.
+            console.log("1) All projects can't be combined with individual projects. Pick one or the other.");
+            continue;
+        }
+        if (wantsAll)
+            return undefined;
+        const chosen = picked.map((n) => projects[n - 2]);
+        // Naming every project IS "all projects", and storing it as a list would freeze the
+        // grant at today's set — a project added next month would be missing from a scope
+        // its author chose as everything. `normalizeInviteScope` collapses this server-side
+        // too; doing it here as well keeps the confirmation honest about what was granted.
+        return chosen.length === projects.length ? undefined : chosen.map((p) => p.id);
+    }
+    throw new Error("no valid choice — aborting");
 }

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { Command } from "commander";
 import { VERSION } from "./version.js";
+import { selfCommand } from "./lib/launcher.js";
 import { loadConfig, patchConfig, saveConfig, configPath, isLoggedIn } from "./config.js";
 import { installMcp, normalizeScope } from "./commands/mcp.js";
 import { installGate, resolveGatePrefix } from "./commands/gate.js";
@@ -25,7 +26,10 @@ program
     .version(VERSION);
 function requireLogin() {
     if (!isLoggedIn()) {
-        console.error("Not signed in. Run `retasc login` first.");
+        // RTSC-671 — `selfCommand` renders the form they actually used. The docs send a
+        // new owner through `npx @retasc/cli`, which never puts `retasc` on PATH, so naming
+        // it here answers a failure with a second `command not found`.
+        console.error(`Not signed in. Run \`${selfCommand(VERSION)} login\` first.`);
         process.exit(1);
     }
 }
@@ -87,7 +91,7 @@ program
     // confirm scope before any work. Resolved from the local key, server-enforced.
     const local = readLocalBinding(process.cwd());
     if (local?.markerOnly) {
-        console.log("This folder → has a Retasc marker but no key on this machine. Run `retasc bind`.\n");
+        console.log(`This folder → has a Retasc marker but no key on this machine. Run \`${selfCommand(VERSION)} bind\`.\n`);
     }
     else if (local) {
         try {
@@ -107,10 +111,10 @@ program
         }
     }
     else {
-        console.log("This folder → not bound. Run `retasc bind`.\n");
+        console.log(`This folder → not bound. Run \`${selfCommand(VERSION)} bind\`.\n`);
     }
     if (!isLoggedIn()) {
-        console.log("Not signed in (management). Run `retasc login` to manage orgs/projects.");
+        console.log(`Not signed in (management). Run \`${selfCommand(VERSION)} login\` to manage orgs/projects.`);
         return;
     }
     try {
@@ -200,7 +204,16 @@ program
         await setupFromToken(opts.setup, opts).catch(fail);
         return;
     }
-    requireLogin();
+    // NO requireLogin here (RTSC-670). `bindAction` opens with `ensureSignedIn`, which
+    // runs the device flow when there is no session — that IS the documented first step
+    // of owner onboarding, and it is the only state a new owner is ever in. This guard
+    // predated that (it was correct in 285ec74, when bindAction had no sign-in of its
+    // own) and `ensureSignedIn` arriving in 72182c3 left it in front of a door it
+    // permanently closed: every `bind` on a fresh machine exited 1 before reaching it.
+    //
+    // `ensureSignedIn` also refuses BETTER — it says why ("no TTY here for the device
+    // flow") where this said only that you weren't signed in, which is the diagnosis
+    // that sends someone looking in the wrong place.
     await bindAction(opts).catch(fail);
 });
 // `retasc doctor` — verify this folder's binding + flag any illegal global server.
@@ -527,7 +540,7 @@ gate
         if (r.source !== "--prefix")
             console.log(`Prefix ${r.prefix} — from ${r.source}.`);
         if (r.source === "global config") {
-            console.log("  (This folder isn't bound — `retasc bind` makes the prefix folder-scoped.)");
+            console.log(`  (This folder isn't bound — \`${selfCommand(VERSION)} bind\` makes the prefix folder-scoped.)`);
         }
         if (r.shadowedDefault) {
             console.log(`  ⚠ Ignoring global default prefix ${r.shadowedDefault} — this folder's binding wins.`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@retasc/cli",
-  "version": "1.24.0",
-  "description": "Retasc CLI — the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
+  "version": "1.26.0",
+  "description": "Retasc CLI \u2014 the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {
     "retasc": "dist/index.js"