create-egregore 0.14.0 → 0.14.2

package/lib/auth.js

@@ -5,9 +5,7 @@
 
 const https = require("node:https");
 
-const GITHUB_APP_CLIENT_ID = "Iv23li2obNsAjakoK2RE";   // GitHub App — for founder flow
-const OAUTH_APP_CLIENT_ID = "Ov23liYZjJbbbNgnJ9vH";    // OAuth App — for join flow
-const OAUTH_JOIN_SCOPE = "repo";                         // Minimal scope for cross-account access
+const CLIENT_ID = "Iv23li2obNsAjakoK2RE";  // GitHub App — clean consent, permissions via installation
 
 function post(url, body) {
   return new Promise((resolve, reject) => {
@@ -74,19 +72,12 @@ function copyToClipboard(text) {
 /**
  * Run GitHub Device Flow.
  * Returns the access token string, or throws on failure.
- * @param {object} ui - UI module for output
- * @param {object} [opts] - Options
- * @param {string} [opts.mode] - "join" uses OAuth App with repo scope; default uses GitHub App
  */
-async function deviceFlow(ui, opts = {}) {
-  const isJoin = opts.mode === "join";
-  const clientId = isJoin ? OAUTH_APP_CLIENT_ID : GITHUB_APP_CLIENT_ID;
-  const scope = isJoin ? OAUTH_JOIN_SCOPE : "";
-
+async function deviceFlow(ui) {
   // 1. Request device code
   const codeResp = await post("https://github.com/login/device/code", {
-    client_id: clientId,
-    scope,
+    client_id: CLIENT_ID,
+    scope: "",
   });
 
   if (!codeResp.device_code) {
@@ -120,7 +111,7 @@ async function deviceFlow(ui, opts = {}) {
     await sleep(interval);
 
     const tokenResp = await post("https://github.com/login/oauth/access_token", {
-      client_id: clientId,
+      client_id: CLIENT_ID,
       device_code,
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
     });

package/lib/local.js

@@ -568,11 +568,18 @@ async function localJoinFlow(orgArg, ui) {
     explicitRepo = null;
   }
 
-  // 1. GitHub auth — OAuth App with repo scope for cross-account access
+  // 1. Install GitHub App — needed for the token to access repository resources
   ui.info(`Joining ${ui.bold(orgLogin)}. First, sign in with GitHub.\n`);
+  ui.info("Install the Egregore app on your GitHub account.");
+  ui.info("This lets Egregore access the repos you've been invited to.\n");
+  openBrowser(APP_INSTALL_URL);
+  await ui.prompt("Press Enter when done...");
+
+  // 2. GitHub auth (auto-approved after App install)
+  ui.info("");
   let githubToken;
   try {
-    githubToken = await deviceFlow(ui, { mode: "join" });
+    githubToken = await deviceFlow(ui);
     ui.success("Authenticated with GitHub");
   } catch (err) {
     ui.error(`GitHub auth failed: ${err.message}`);
@@ -637,17 +644,29 @@ async function localJoinFlow(orgArg, ui) {
     : `${orgLogin}-memory`;
   const managedRepos = config.repos || [];
 
-  // 5b. Check access to memory repo (required) — may need invitation acceptance
-  if (!(await repoExists(githubToken, orgLogin, memoryRepoName))) {
+  // 5b. Check access to ALL repos — open browser for any that need invitation acceptance
+  const allRepos = [repoName, memoryRepoName, ...managedRepos];
+  const inaccessible = [];
+  for (const repo of allRepos) {
+    if (!(await repoExists(githubToken, orgLogin, repo))) {
+      inaccessible.push(repo);
+    }
+  }
+  if (inaccessible.length > 0) {
     console.log("");
-    ui.info("Accept the memory repo invitation in your browser.");
-    openBrowser(`https://github.com/${orgLogin}/${memoryRepoName}`);
+    ui.info(`Accept ${inaccessible.length === 1 ? "the invitation" : `${inaccessible.length} invitations`} in your browser.`);
+    for (const repo of inaccessible) {
+      openBrowser(`https://github.com/${orgLogin}/${repo}`);
+    }
     await ui.prompt("Press Enter after accepting...");
 
-    if (!(await repoExists(githubToken, orgLogin, memoryRepoName))) {
-      ui.error(`Still can't access ${orgLogin}/${memoryRepoName}`);
-      ui.error("Make sure the org admin has invited you to the memory repo.");
-      process.exit(1);
+    // Retry — only block on main + memory, managed repos are best-effort
+    for (const repo of [repoName, memoryRepoName]) {
+      if (inaccessible.includes(repo) && !(await repoExists(githubToken, orgLogin, repo))) {
+        ui.error(`Still can't access ${orgLogin}/${repo}`);
+        ui.error("Make sure the org admin has set up Egregore and invited you.");
+        process.exit(1);
+      }
     }
     ui.success("Access confirmed");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "Set up Egregore for your team in one command",
   "license": "MIT",
   "bin": {