create-egregore 0.14.0 → 0.14.1

package/lib/auth.js

@@ -5,9 +5,7 @@
 
 const https = require("node:https");
 
-const GITHUB_APP_CLIENT_ID = "Iv23li2obNsAjakoK2RE";   // GitHub App — for founder flow
-const OAUTH_APP_CLIENT_ID = "Ov23liYZjJbbbNgnJ9vH";    // OAuth App — for join flow
-const OAUTH_JOIN_SCOPE = "repo";                         // Minimal scope for cross-account access
+const CLIENT_ID = "Iv23li2obNsAjakoK2RE";  // GitHub App — clean consent, permissions via installation
 
 function post(url, body) {
   return new Promise((resolve, reject) => {
@@ -74,19 +72,12 @@ function copyToClipboard(text) {
 /**
  * Run GitHub Device Flow.
  * Returns the access token string, or throws on failure.
- * @param {object} ui - UI module for output
- * @param {object} [opts] - Options
- * @param {string} [opts.mode] - "join" uses OAuth App with repo scope; default uses GitHub App
  */
-async function deviceFlow(ui, opts = {}) {
-  const isJoin = opts.mode === "join";
-  const clientId = isJoin ? OAUTH_APP_CLIENT_ID : GITHUB_APP_CLIENT_ID;
-  const scope = isJoin ? OAUTH_JOIN_SCOPE : "";
-
+async function deviceFlow(ui) {
   // 1. Request device code
   const codeResp = await post("https://github.com/login/device/code", {
-    client_id: clientId,
-    scope,
+    client_id: CLIENT_ID,
+    scope: "",
   });
 
   if (!codeResp.device_code) {
@@ -120,7 +111,7 @@ async function deviceFlow(ui, opts = {}) {
     await sleep(interval);
 
     const tokenResp = await post("https://github.com/login/oauth/access_token", {
-      client_id: clientId,
+      client_id: CLIENT_ID,
       device_code,
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
     });

package/lib/local.js

@@ -568,11 +568,18 @@ async function localJoinFlow(orgArg, ui) {
     explicitRepo = null;
   }
 
-  // 1. GitHub auth — OAuth App with repo scope for cross-account access
+  // 1. Install GitHub App — needed for the token to access repository resources
   ui.info(`Joining ${ui.bold(orgLogin)}. First, sign in with GitHub.\n`);
+  ui.info("Install the Egregore app on your GitHub account.");
+  ui.info("This lets Egregore access the repos you've been invited to.\n");
+  openBrowser(APP_INSTALL_URL);
+  await ui.prompt("Press Enter when done...");
+
+  // 2. GitHub auth (auto-approved after App install)
+  ui.info("");
   let githubToken;
   try {
-    githubToken = await deviceFlow(ui, { mode: "join" });
+    githubToken = await deviceFlow(ui);
     ui.success("Authenticated with GitHub");
   } catch (err) {
     ui.error(`GitHub auth failed: ${err.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Set up Egregore for your team in one command",
   "license": "MIT",
   "bin": {