create-egregore 0.19.0 → 0.19.2

package/lib/local.js

@@ -54,6 +54,16 @@ async function listOrgs(token) {
   return data.map((o) => ({ login: o.login }));
 }
 
+// Can the token see this org at all? /user/orgs is blind to fine-grained
+// tokens and to private/SSO-gated membership, so the picker lets users type an
+// org by hand — this validates the typed login is reachable (a fine-grained
+// PAT scoped to the org returns 200 here) so a typo fails now, not at
+// repo-creation time.
+async function orgReachable(token, org) {
+  const { status } = await ghApi("GET", `/orgs/${org}`, token);
+  return status === 200;
+}
+
 async function listOrgMembers(token, org) {
   // Returns [{login}]. Only visible members (public or visible to the token).
   // Non-fatal on error — caller falls back to a text prompt.
@@ -94,6 +104,18 @@ async function createRepo(token, owner, name, isOrg, description) {
     description: description || "Egregore shared memory",
   });
   if (status === 422) return { already_exists: true };
+  // 403 here almost always means the token can't write to THIS owner — the
+  // classic fine-grained-PAT case, where the token is scoped to one org and
+  // we're pointed at the personal account (or the wrong org). Turn GitHub's
+  // opaque "Resource not accessible by personal access token" into a next step.
+  if (status === 403) {
+    const where = isOrg ? `the ${owner} organization` : `your personal account (${owner})`;
+    throw new Error(
+      `GitHub refused repo creation in ${where} (403). ` +
+      `A fine-grained token is scoped to a single owner — re-run and choose that owner ` +
+      `as the home, or re-auth with \`gh auth login\` (unset GH_TOKEN first if it's set).`,
+    );
+  }
   if (status !== 201 && status !== 200) {
     const msg = typeof data === "object" ? data.message || JSON.stringify(data) : data;
     throw new Error(`Create repo failed (HTTP ${status}): ${msg}`);
@@ -677,6 +699,26 @@ async function localFounderFlow(ui, ctx = {}) {
     reposCache: null,         // {org, repos, teamRepoCount}
   };
 
+  const ENTER_ORG_LABEL = "Enter an organization name…";
+
+  const promptForOrg = async () => {
+    // Free-text org entry for the cases /user/orgs can't see (fine-grained
+    // tokens, private/SSO-gated membership). Validate reachability here so a
+    // typo or an unauthorized org fails now, with a clear message, instead of
+    // as an opaque 403 mid-creation.
+    while (true) {
+      const raw = await ui.prompt("Organization login (exact, e.g. acme-inc — blank to go back)");
+      const org = (raw || "").trim();
+      if (!org) return null;
+      const s = ui.spinner(`Checking ${org}…`);
+      if (await orgReachable(githubToken, org)) {
+        s.stop(`Found ${org}`);
+        return org;
+      }
+      s.fail(`Can't reach an org named "${org}" with this login — check the spelling, or authorize your token for it on GitHub.`);
+    }
+  };
+
   const stepHome = async () => {
     if (!st.orgs) {
       ui.section("Pick a home", "where should this Egregore live?");
@@ -684,24 +726,27 @@ async function localFounderFlow(ui, ctx = {}) {
       st.orgs = await listOrgs(githubToken);
       s.stop("Accounts loaded");
     }
-    if (st.orgs.length === 0) {
-      if (!st.githubOrg) {
-        st.githubOrg = user.login;
-        st.isOrg = false;
-        ui.info(`Using your personal account: ${ui.bold(st.githubOrg)}`);
-      }
-      return SKIP;
-    }
-    const orgChoice = await ui.choose(
-      "Where should Egregore live?",
-      [
-        { label: user.login, description: "Personal account" },
-        ...st.orgs.map((o) => ({ label: o.login, description: "Organization" })),
-      ],
-      "Don't see your org? Authorize it for your account on GitHub, then re-run.",
-      { escAction: "back" },
-    );
+    // Always offer manual org entry. /user/orgs returns nothing for
+    // fine-grained tokens and for orgs with private/SSO-gated membership, so
+    // auto-discovery alone silently strands those users on their personal
+    // account with no way to reach the org they actually want.
+    const options = [
+      { label: user.login, description: "Personal account" },
+      ...st.orgs.map((o) => ({ label: o.login, description: "Organization" })),
+      { label: ENTER_ORG_LABEL, description: "Type an org login (needed for fine-grained tokens)" },
+    ];
+    const hint = st.orgs.length === 0
+      ? "Couldn't auto-detect your orgs (normal with fine-grained tokens) — pick your account or enter an org."
+      : "Don't see your org? Enter it below, or authorize your token for it on GitHub.";
+    const orgChoice = await ui.choose("Where should Egregore live?", options, hint, { escAction: "back" });
     if (orgChoice === BACK) return BACK; // first step — driver clamps to a re-ask
+    if (orgChoice.label === ENTER_ORG_LABEL) {
+      const org = await promptForOrg();
+      if (!org) return stepHome(); // blank entry → re-show the picker (orgs cached)
+      st.githubOrg = org;
+      st.isOrg = true;
+      return true;
+    }
     st.githubOrg = orgChoice.label;
     st.isOrg = st.githubOrg !== user.login;
     return true;

package/lib/ui.js

@@ -729,19 +729,24 @@ async function interactiveMultiSelect(question, options, opts = {}) {
         const shown = names.length > maxW ? names.slice(0, maxW - 1) + "…" : names;
         lines.push(`    ${GREEN}✓${RESET} ${DIM}selected (${picked.size}):${RESET} ${shown}`);
       } else {
-        lines.push(`    ${DIM}0 selected${RESET}`);
+        // Nothing picked is a valid state — this picker never enforces a
+        // minimum. Say so, so an empty Enter doesn't read as "stuck".
+        lines.push(`    ${DIM}0 selected — none required${RESET}`);
       }
       if (searching && total > 0) lines.push(`    ${DIM}searching…${RESET}`);
 
       const searchHint = opts.remoteSearch ? "type to search" : "type to filter";
       const escHint = opts.escAction === "back" ? ` · ${DIM}←${RESET} back` : "";
+      // Enter always confirms the current selection, empty included — label it
+      // "skip" while nothing is picked so the exit is discoverable.
+      const enterHint = picked.size === 0 ? "skip" : "confirm";
       if (!first) clearLines(lastLineCount);
       lastLineCount = renderPicker({
         question,
         filterText,
         lines,
         input: { label: opts.remoteSearch ? "search" : "filter" },
-        help: `${DIM}↑↓${RESET} nav · ${DIM}space${RESET} toggle · ${DIM}ctrl-a${RESET} all · ${DIM}enter${RESET} confirm · ${searchHint}${escHint}`,
+        help: `${DIM}↑↓${RESET} nav · ${DIM}space${RESET} toggle · ${DIM}ctrl-a${RESET} all · ${DIM}enter${RESET} ${enterHint} · ${searchHint}${escHint}`,
       });
     };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.19.0",
+  "version": "0.19.2",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code or Codex.",
   "license": "MIT",
   "bin": {