@retasc/cli 1.9.0 → 1.11.0

package/dist/auth.js

@@ -1,6 +1,7 @@
 import { ConvexHttpClient } from "convex/browser";
 import { makeFunctionReference } from "convex/server";
 import { loadConfig, patchConfig } from "./config.js";
+import { ask, isInteractive } from "./lib/prompt.js";
 // The GitHub OAuth App's PUBLIC client id (safe to ship — device flow needs no
 // secret). Baked in so `retasc login` works out-of-the-box; override via env.
 const GITHUB_CLIENT_ID = process.env.RETASC_GITHUB_CLIENT_ID ?? "Ov23linqRy875IU8OYTW";
@@ -8,9 +9,16 @@ const DEVICE_CODE_URL = "https://github.com/login/device/code";
 const TOKEN_URL = "https://github.com/login/oauth/access_token";
 const GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 // Convex Auth's own public sign-in action. We call it with the "github-device"
-// credentials provider; it verifies the GitHub token server-side and returns a
-// session ({ tokens: { token, refreshToken } }).
+// or "google-device" credentials provider; it verifies the upstream token
+// server-side and returns a session ({ tokens: { token, refreshToken } }).
 const signIn = makeFunctionReference("auth:signIn");
+// RTSC-508 — the Google device flow's two legs, both server-side. Google, unlike
+// GitHub, requires a client SECRET on the token exchange, and a published npm
+// package cannot hold one. So there is deliberately no Google client id in this
+// file either: the CLI never talks to Google directly, so it never needs one, and
+// rotating that client becomes a Convex env change with no CLI release.
+const googleDeviceStart = makeFunctionReference("googleDevice:start");
+const googleDevicePoll = makeFunctionReference("googleDevice:poll");
 async function postForm(url, body) {
     const res = await fetch(url, {
         method: "POST",
@@ -20,11 +28,14 @@ async function postForm(url, body) {
     return res.json();
 }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-/**
- * Run the full GitHub device-flow login and persist the resulting Convex Auth
- * session to ~/.retasc/config.json. Prints the user code + verification URL.
- */
-export async function deviceLogin() {
+/** Print the two lines a human has to act on, identically for both doors. */
+function announceCode(where, url, code) {
+    console.log(`\n  Open: ${url}`);
+    console.log(`  Enter code: ${code}\n`);
+    console.log(`  Waiting for ${where} authorization…`);
+}
+/** Run GitHub's device flow (talking to GitHub directly) and return its access token. */
+async function githubDeviceToken() {
     if (!GITHUB_CLIENT_ID) {
         throw new Error("GitHub client id not configured. Set RETASC_GITHUB_CLIENT_ID (the OAuth App's public Client ID).");
     }
@@ -35,13 +46,10 @@ export async function deviceLogin() {
     if (!start.device_code) {
         throw new Error(`GitHub device-flow start failed: ${JSON.stringify(start)}`);
     }
-    console.log(`\n  Open: ${start.verification_uri}`);
-    console.log(`  Enter code: ${start.user_code}\n`);
-    console.log("  Waiting for authorization…");
+    announceCode("GitHub", start.verification_uri, start.user_code);
     // Poll GitHub for the access token.
     let intervalMs = (start.interval || 5) * 1000;
     const deadline = Date.now() + start.expires_in * 1000;
-    let githubToken = "";
     while (Date.now() < deadline) {
         await sleep(intervalMs);
         const r = await postForm(TOKEN_URL, {
@@ -49,10 +57,8 @@ export async function deviceLogin() {
             device_code: start.device_code,
             grant_type: GRANT,
         });
-        if (r.access_token) {
-            githubToken = r.access_token;
-            break;
-        }
+        if (r.access_token)
+            return r.access_token;
         if (r.error === "authorization_pending")
             continue;
         if (r.error === "slow_down") {
@@ -61,20 +67,113 @@ export async function deviceLogin() {
         }
         throw new Error(`GitHub authorization failed: ${r.error_description ?? r.error}`);
     }
-    if (!githubToken)
-        throw new Error("Timed out waiting for GitHub authorization.");
-    // Exchange the GitHub token for a Retasc (Convex Auth) session.
+    throw new Error("Timed out waiting for GitHub authorization.");
+}
+/**
+ * Run Google's device flow and return its access token (RTSC-508).
+ *
+ * Structurally the same as the GitHub one, with the two Google calls made by the
+ * backend rather than from here — see the note on the function references above.
+ * The loop, the interval back-off and the deadline stay client-side: the wait is
+ * as long as a human takes to find their browser, which is not something to hold
+ * a Convex action open for.
+ */
+async function googleDeviceToken(convex) {
+    const start = (await convex.action(googleDeviceStart, {}));
+    announceCode("Google", start.verificationUrl, start.userCode);
+    let intervalMs = (start.intervalSeconds || 5) * 1000;
+    const deadline = Date.now() + start.expiresInSeconds * 1000;
+    while (Date.now() < deadline) {
+        await sleep(intervalMs);
+        // Anything terminal — declined, expired, misconfigured — is thrown by the
+        // backend as a readable userError and propagates to the caller's `fail`.
+        const r = (await convex.action(googleDevicePoll, { deviceCode: start.deviceCode }));
+        if (r.status === "ok")
+            return r.googleToken;
+        if (r.status === "slowDown")
+            intervalMs += 5000;
+    }
+    throw new Error("Timed out waiting for Google authorization.");
+}
+/**
+ * Which door, when the caller didn't say (RTSC-508).
+ *
+ * Asked rather than defaulted because the person who needs the second door is
+ * precisely the one who cannot be expected to know a flag exists: they signed up
+ * through the web Dash with Google, and a GitHub-only prompt is a dead end they
+ * have no way to read as one. One keystroke, and only when someone is there to
+ * press it.
+ *
+ * Non-interactive runs keep today's behaviour exactly — GitHub, no prompt — so
+ * nothing scripted against `retasc login` changes.
+ */
+export async function chooseProvider(
+// Injected so the question can be pinned by tests. Picking the wrong door is
+// not a typo you correct on the next run: it signs you in as a SECOND identity
+// with its own membership, and nothing in the CLI can merge them back. Same
+// reasoning as `identityLoop`'s deps — the loud path is the one that must be
+// provable, and a live run only ever exercises the quiet one.
+deps = {}) {
+    const askFn = deps.askFn ?? ask;
+    const interactive = deps.interactive ?? isInteractive;
+    if (!interactive())
+        return "github";
+    // A default exists ONLY when it is a recorded fact about this human — the door
+    // they last signed in through successfully. That is the whole rule. Defaulting
+    // to GitHub because most people use it would be assuming an answer to a
+    // question whose wrong answer is a second identity, for exactly the person
+    // this feature exists to serve. A remembered door assumes nothing: it already
+    // worked for them once.
+    const remembered = deps.remembered;
+    const DOORS = [
+        { key: "github", slot: "1", label: "GitHub" },
+        { key: "google", slot: "2", label: "Google" },
+    ];
+    console.log("\nHow do you sign in to Retasc?");
+    for (const d of DOORS) {
+        console.log(`  ${d.slot}) ${d.label}${d.key === remembered ? "   (last used)" : ""}`);
+    }
+    const rememberedSlot = DOORS.find((d) => d.key === remembered)?.slot;
+    for (let attempt = 0; attempt < 3; attempt++) {
+        const a = await askFn(rememberedSlot ? `Choose a number [${rememberedSlot}]: ` : "Choose a number: ");
+        // Empty is an answer only when there is something true to answer WITH.
+        if (a === "" && remembered)
+            return remembered;
+        const hit = DOORS.find((d) => d.slot === a);
+        if (hit)
+            return hit.key;
+        console.log("Please enter 1 or 2.");
+    }
+    throw new Error("no valid choice — aborting");
+}
+/**
+ * Run a device-flow login and persist the resulting Convex Auth session to
+ * ~/.retasc/config.json. Prints the user code + verification URL.
+ *
+ * With no `provider`, asks which door when a human is present and falls back to
+ * GitHub when one isn't.
+ */
+export async function deviceLogin(provider) {
     const cfg = loadConfig();
+    const door = provider ?? (await chooseProvider({ remembered: cfg.loginProvider }));
     const convex = new ConvexHttpClient(cfg.deploymentUrl);
+    // Exchange the upstream token for a Retasc (Convex Auth) session. The token is
+    // used here and never stored: the session is the only credential that persists.
+    const params = door === "google"
+        ? { googleToken: await googleDeviceToken(convex) }
+        : { githubToken: await githubDeviceToken() };
     const res = await convex.action(signIn, {
-        provider: "github-device",
-        params: { githubToken },
+        provider: door === "google" ? "google-device" : "github-device",
+        params,
     });
     const tokens = res?.tokens;
     if (!tokens?.token) {
         throw new Error("Sign-in did not return a session token.");
     }
-    patchConfig({ token: tokens.token, refreshToken: tokens.refreshToken });
+    // Record the door only now, on the far side of a sign-in that actually worked.
+    // Written here rather than at the point of choosing so a failed or abandoned
+    // attempt can never become next time's default.
+    patchConfig({ token: tokens.token, refreshToken: tokens.refreshToken, loginProvider: door });
 }
 /**
  * Does this thrown error clearly mean "this refresh token can never mint a new

package/dist/commands/bind.js

@@ -1,5 +1,3 @@
-import { createInterface } from "node:readline/promises";
-import { stdin, stdout } from "node:process";
 import { api, cliError } from "../api.js";
 import { deviceLogin } from "../auth.js";
 import { loadConfig } from "../config.js";
@@ -7,34 +5,14 @@ import { installMarker } from "./mcp.js";
 import { readLocalBinding, resolveBinding } from "../lib/binding.js";
 import { getBinding, setBinding, newWorkspaceId } from "../lib/keystore.js";
 import { resolveLauncher, launcherNote, selfCommand } from "../lib/launcher.js";
+import { ask, confirm, isInteractive } from "../lib/prompt.js";
 import { clean } from "../lib/text.js";
 import { VERSION } from "../version.js";
-export function isInteractive() {
-    return Boolean(stdin.isTTY && stdout.isTTY);
-}
-export async function ask(question) {
-    const rl = createInterface({ input: stdin, output: stdout });
-    try {
-        // readline's question() NEVER settles when stdin hits EOF (Ctrl-D, or a
-        // closed pipe) — it silently drops the callback rather than resolving ""
-        // or throwing, so a bare `await` here wedges the CLI with no output and no
-        // exit. Race the close event so callers fail fast instead (RTSC-269).
-        const closed = new Promise((_, reject) => rl.once("close", () => reject(new Error("input closed"))));
-        closed.catch(() => { }); // the normal path closes rl too; that loser rejection is expected
-        return (await Promise.race([rl.question(question), closed])).trim();
-    }
-    finally {
-        rl.close();
-    }
-}
-export async function confirm(question, assumeYes) {
-    if (assumeYes)
-        return true;
-    if (!isInteractive())
-        return false;
-    const a = (await ask(`${question} [y/N] `)).toLowerCase();
-    return a === "y" || a === "yes";
-}
+// RTSC-508: `ask`/`confirm`/`isInteractive` now live in lib/prompt.ts so `auth.ts`
+// can use them without closing an import cycle (bind → auth → bind). Re-exported
+// here because they have been part of this module's surface since RTSC-269, and
+// moving the import in every call site would be churn for no gain.
+export { ask, confirm, isInteractive };
 /**
  * Render a numbered menu and read one answer, optionally with a trailing extra option.
  *
@@ -317,7 +295,10 @@ export async function ensureSignedIn() {
     if (!isInteractive()) {
         throw new Error("Not signed in. Run `retasc login` first (no TTY here for the device flow).");
     }
-    console.error("Not signed in yet — authenticating with GitHub first…");
+    // RTSC-508: don't name a provider here. `deviceLogin` asks which door, and
+    // announcing "GitHub" before the question would be wrong for the invited
+    // teammate who signed up through Google — the exact person `join` is for.
+    console.error("Not signed in yet — let's do that first.");
     await deviceLogin();
 }
 export async function bindAction(opts) {

package/dist/commands/identity.js

@@ -0,0 +1,96 @@
+import { api } from "../api.js";
+import { clean } from "../lib/text.js";
+import { isInteractive } from "./bind.js";
+import { identityLoop } from "./join.js";
+/**
+ * Which org's placeholders to offer.
+ *
+ * Same rule as `retasc billing`: explicit `--org-id` wins, one membership needs no
+ * question, several must be named. Deliberately NOT the folder binding — that resolves
+ * through an agent key, and this is a question only a signed-in human can answer, so
+ * reading identity off the folder would name an org this person might not even be in.
+ */
+export function resolveOrg(orgs, orgId) {
+    // Org names are human-typed and land in a terminal that acts on escape sequences, the
+    // same rule the ghost rows follow. `clean` here rather than at each interpolation so a
+    // later line added to this list cannot forget it.
+    const list = () => orgs.map((o) => `  ${o.id}  ${clean(o.name)}${o.slug ? ` (${clean(o.slug)})` : ""}`);
+    if (orgId) {
+        const found = orgs.find((o) => o.id === orgId);
+        // REFUSE an id we can't see, rather than passing it through for the server to reject.
+        // The server does not reject it: `memberOf` returns null for a non-member AND for a
+        // suspended one, and `claimableGhosts` maps null to `{asked: true}` — the exact shape a
+        // permanent decline returns. Passing through would make this command answer "you've
+        // already said none of these are you" to someone who simply typed the wrong id, which
+        // is a false statement about their own history and the one thing it must never say.
+        if (!found) {
+            throw new Error(`You're not an active member of ${clean(orgId)} — or that isn't an org id.` +
+                (orgs.length ? `\nOrgs you can ask about:\n${list().join("\n")}` : ""));
+        }
+        return found;
+    }
+    if (orgs.length === 0)
+        throw new Error("You're not a member of any org yet.");
+    if (orgs.length > 1) {
+        throw new Error(`Several orgs — pass --org-id <id>:\n${list().join("\n")}`);
+    }
+    return orgs[0];
+}
+/** What to print once the loop is done. `join` prints nothing; this command must. */
+function report(outcome, orgLabel) {
+    switch (outcome) {
+        case "claimed":
+        case "unavailable":
+            // Both already said their piece, line by line, as they happened.
+            return;
+        case "none":
+            // The common answer, and a genuinely good one — say it plainly rather than exiting
+            // silently, which reads like the command failed to run.
+            console.log(`Nothing waiting for you in ${orgLabel}.`);
+            console.log("Run this again after a migration — each import brings its own people across.");
+            return;
+        case "answered":
+            // The permanent decline. Worth its own wording: from in here it is indistinguishable
+            // from "none", and someone who declined during an earlier import and now has a real
+            // placeholder from a NEW one would otherwise read "nothing waiting" as the truth.
+            console.log(`You've already said none of the imported people in ${orgLabel} are you.`);
+            console.log("That answer covers the whole org, including later migrations.");
+            console.log("If a newer import did carry you across, an owner can link it from the Team page.");
+            return;
+        case "declined":
+            console.log("Noted — you won't be asked again.");
+            return;
+        case "left":
+            console.log("Nothing linked. Run `retasc identity` again whenever you want to look.");
+            return;
+        case "skipped":
+            // Only reachable non-interactively; the interactive guard below catches that first.
+            return;
+    }
+}
+export async function identityAction(opts, deps = {}) {
+    const d = {
+        me: () => api.me(),
+        // One implementation of the irreversible question, shared with `join`. Two surfaces
+        // asking it in two different voices is how someone ends up answering the one they trust
+        // less — the same reason its wording already mirrors the Dash notice.
+        loop: (orgId, orgLabel) => identityLoop(orgId, {}, orgLabel),
+        interactive: isInteractive,
+        ...deps,
+    };
+    // Refuse up front rather than exiting 0 in silence. `identityLoop` returns "skipped"
+    // without a TTY — correct inside `join`, where the folder setup is the point and the
+    // question is optional, and wrong here, where the question IS the command.
+    if (!d.interactive()) {
+        throw new Error("`retasc identity` needs an interactive terminal — linking an imported person is irreversible, so it always asks first.");
+    }
+    const me = await d.me();
+    const org = resolveOrg(me.orgs, opts.orgId);
+    // The NAME alone, not "name (slug)". It lands mid-sentence in both surfaces — "When Acme
+    // migrated…" and "Nothing waiting for you in Acme." The slug only earns its place in the
+    // several-orgs error, where it is there to be copied.
+    const orgLabel = clean(org.name);
+    const outcome = await d.loop(org.id, orgLabel);
+    report(outcome, orgLabel);
+    return outcome;
+}

package/dist/commands/join.js

@@ -53,19 +53,28 @@ deps = {}) {
     // authorship AND their dispatch lane onto your account, irreversibly, and there is no
     // CLI path back. A scripted run has nobody to be wrong on behalf of.
     if (!d.interactive() || opts.yes)
-        return;
+        return "skipped";
+    // Whether anything was linked BEFORE the round that ends the loop. A claim is followed by
+    // another round (a second migrated tool may still be offerable), and that round normally
+    // ends in "nothing left" — which must not erase the claim that just happened.
+    let claimedAny = false;
     for (let round = 0; round < MAX_IDENTITY_ROUNDS; round++) {
         let ghosts;
         try {
             const res = await d.claimableGhosts({ orgId });
-            if (res.asked || !res.ghosts.length)
-                return;
+            // Two different endings the server returns on one shape. "Answered" is this human's
+            // permanent org-wide decline; "none" is simply an empty list, and they can be asked
+            // again after the next migration. `join` treats both as silence; `identity` does not.
+            if (res.asked)
+                return claimedAny ? "claimed" : "answered";
+            if (!res.ghosts.length)
+                return claimedAny ? "claimed" : "none";
             ghosts = res.ghosts;
         }
         catch (e) {
             const { message } = formatError(e);
             console.error(`  ! Couldn't check for imported history (${message}). Carrying on.`);
-            return;
+            return claimedAny ? "claimed" : "unavailable";
         }
         console.log(round === 0
             ? `\nWhen ${orgLabel ?? "this org"} migrated, some people were carried across.\n` +
@@ -87,8 +96,13 @@ deps = {}) {
             }
             catch (e) {
                 console.error(`  ! ${formatError(e).message}`);
+                // NOT "declined". A caller answers that with "you won't be asked again", and the
+                // write is the only thing that makes it true — the flag never landed, so they WILL
+                // be asked again. The error is already on stderr; `unavailable` adds no second
+                // sentence on top of it rather than a reassuring false one.
+                return "unavailable";
             }
-            return;
+            return "declined";
         }
         // Confirm before claiming — it is irreversible and it moves dispatch routing, so it
         // must not be a single keystroke on a row in a list. Same qualitative wording as the
@@ -106,6 +120,7 @@ deps = {}) {
         try {
             const res = await d.claimGhost({ orgId, memberId: chosen.id });
             console.log(`✓ Linked ${clean(res.name)}.`);
+            claimedAny = true;
         }
         catch (e) {
             // SOURCE_ALREADY_CLAIMED, IMPORT_RUNNING, NOT_CLAIMABLE — all readable, all reachable
@@ -114,11 +129,14 @@ deps = {}) {
             console.error(`  ✗ ${code ? `${code}: ` : ""}${message}`);
             if (hint)
                 console.error(`    → ${hint}`);
-            return;
+            return claimedAny ? "claimed" : "unavailable";
         }
         // Claiming one ClickUp identity removes EVERY remaining ClickUp row (`claimableGhosts`
         // filters by spent source), so the next round can only ever offer a different tool.
     }
+    // Round budget spent. Only reachable by declining individual rows over and over — the
+    // list is unchanged each time, so nothing was linked and nothing was answered for good.
+    return claimedAny ? "claimed" : "left";
 }
 export async function joinAction(link, opts) {
     // Client-side, before anything else: the code is what the server matches, and someone

package/dist/config.js

@@ -55,6 +55,12 @@ export function loadConfig() {
         user: stored.user,
         defaultOrgId: stored.defaultOrgId,
         defaultProjectPrefix: stored.defaultProjectPrefix,
+        // Validated on read, not trusted: this value decides which door a bare Enter
+        // takes, and the file is hand-editable. Anything unrecognised reads as "never
+        // recorded", which falls back to asking outright.
+        loginProvider: stored.loginProvider === "github" || stored.loginProvider === "google"
+            ? stored.loginProvider
+            : undefined,
     };
 }
 /** Move a corrupt config aside to a unique sibling so a human can recover any

package/dist/index.js

@@ -7,6 +7,7 @@ import { installGate } from "./commands/gate.js";
 import { claimAction } from "./commands/claim.js";
 import { bindAction } from "./commands/bind.js";
 import { joinAction } from "./commands/join.js";
+import { identityAction } from "./commands/identity.js";
 import { doctorAction } from "./commands/doctor.js";
 import { billingAction } from "./commands/billing.js";
 import { isNetworkError, readLocalBinding, resolveBinding } from "./lib/binding.js";
@@ -37,12 +38,23 @@ function fail(e) {
     process.exit(1);
 }
 // --- auth ------------------------------------------------------------------
+// RTSC-508: two doors, not one. Google sign-in shipped for the web Dash first, so
+// an account can exist that GitHub has never heard of — and for that human every
+// login-gated command here was unreachable. With no flag the command ASKS, which
+// is the only form that helps someone who doesn't know a flag exists.
 program
     .command("login")
-    .description("Sign in with GitHub (device flow).")
-    .action(async () => {
+    .description("Sign in with GitHub or Google (device flow).")
+    .option("--github", "Sign in with GitHub, without being asked")
+    .option("--google", "Sign in with Google, without being asked")
+    .action(async (opts) => {
     try {
-        await deviceLogin();
+        // Naming both is a contradiction, not a preference — and quietly picking
+        // one could sign them in through the door that mints a SECOND identity,
+        // which nothing in the CLI can undo.
+        if (opts.github && opts.google)
+            return fail("Pass --github or --google, not both.");
+        await deviceLogin(opts.google ? "google" : opts.github ? "github" : undefined);
         const me = (await api.me());
         const u = me?.user ?? {};
         console.log(`\n✓ Signed in${u.name ? ` as ${u.name}` : ""}${u.email ? ` <${u.email}>` : ""}.`);
@@ -372,11 +384,30 @@ program
     .option("--project-id <id>", "Which project to bind to (skips the picker)")
     .option("--agent <name>", "Agent member name (default: auto)")
     .option("--runtime <runtime>", "Agent runtime", "claude-code")
-    .option("-y, --yes", "Don't prompt to replace an existing binding, and skip the identity question")
+    // RTSC-477 — name the way back. `--yes` skips the identity question and must never answer
+    // it, so the flag that causes the gap is the right place to say how to close it.
+    .option("-y, --yes", "Don't prompt to replace an existing binding, and skip the identity question (ask it later with `retasc identity`)")
     .allowExcessArguments(false)
     .action(async (link, opts) => {
     await joinAction(link, opts).catch(fail);
 });
+// RTSC-477 — the same question `join` asks, on demand. `join` fires once, at the moment you
+// accept an invite; placeholders arrive with EVERY migration, and claiming is per source, so
+// the question recurs and needed a surface that recurs with it.
+//
+// No `-y/--yes`, and no `identity claim <name>` subcommand, on purpose: a claim is
+// irreversible and moves dispatch routing, so it is never answered on a script's behalf.
+// `allowExcessArguments(false)` therefore rejects `retasc identity claim …` outright rather
+// than ignoring the words and prompting anyway.
+program
+    .command("identity")
+    .description("Link imported history to your account: shows the people a migration carried into this org and asks which one is you.")
+    .option("--org-id <id>", "Which org (defaults to your only one).")
+    .allowExcessArguments(false)
+    .action(async (opts) => {
+    requireLogin();
+    await identityAction({ orgId: opts.orgId }).catch(fail);
+});
 // --- mcp wiring ------------------------------------------------------------
 const mcp = program.command("mcp").description("Wire the Retasc MCP server into your agent.");
 mcp

package/dist/lib/prompt.js

@@ -0,0 +1,38 @@
+import { createInterface } from "node:readline/promises";
+import { stdin, stdout } from "node:process";
+// The terminal-input primitives, extracted from commands/bind.ts (RTSC-508).
+//
+// They moved because `auth.ts` needs to ask a question too — which door to sign
+// in through — and importing it from `commands/bind.ts` would close a cycle:
+// bind already imports `deviceLogin` from auth. Duplicating `ask` instead would
+// have meant duplicating the EOF race fix below, which is exactly the kind of
+// thing that gets fixed once and then silently rots in the copy.
+//
+// `commands/bind.ts` re-exports all three, so every existing call site is
+// unchanged.
+export function isInteractive() {
+    return Boolean(stdin.isTTY && stdout.isTTY);
+}
+export async function ask(question) {
+    const rl = createInterface({ input: stdin, output: stdout });
+    try {
+        // readline's question() NEVER settles when stdin hits EOF (Ctrl-D, or a
+        // closed pipe) — it silently drops the callback rather than resolving ""
+        // or throwing, so a bare `await` here wedges the CLI with no output and no
+        // exit. Race the close event so callers fail fast instead (RTSC-269).
+        const closed = new Promise((_, reject) => rl.once("close", () => reject(new Error("input closed"))));
+        closed.catch(() => { }); // the normal path closes rl too; that loser rejection is expected
+        return (await Promise.race([rl.question(question), closed])).trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+export async function confirm(question, assumeYes) {
+    if (assumeYes)
+        return true;
+    if (!isInteractive())
+        return false;
+    const a = (await ask(`${question} [y/N] `)).toLowerCase();
+    return a === "y" || a === "yes";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.9.0",
+  "version": "1.11.0",
   "description": "Retasc CLI — sign in with GitHub, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {