create-egregore 0.19.0 → 0.19.3

package/bin/cli.js

@@ -36,6 +36,7 @@ const {
   registerInstance,
   installLauncherBinary,
   normalizeRuntime,
+  redactToken,
 } = require("../lib/setup");
 const { detectContext, isWritable, isSystemDir } = require("../lib/context");
 
@@ -888,6 +889,8 @@ async function joinFlow(api, githubToken, choice, ctx) {
 }
 
 main().catch((err) => {
-  ui.error(err.message);
+  // Last-resort net: never let a credential reach the terminal via an
+  // unhandled error message (cloneRepo already redacts at the source).
+  ui.error(redactToken(err && err.message));
   process.exit(1);
 });

package/lib/local.js

@@ -25,6 +25,7 @@ const {
   installLauncherBinary,
   launchOrInstruct,
   embedToken,
+  redactToken,
   configureGitCredentials,
   gitCloneEnv,
   initMemoryDirs,
@@ -54,6 +55,16 @@ async function listOrgs(token) {
   return data.map((o) => ({ login: o.login }));
 }
 
+// Can the token see this org at all? /user/orgs is blind to fine-grained
+// tokens and to private/SSO-gated membership, so the picker lets users type an
+// org by hand — this validates the typed login is reachable (a fine-grained
+// PAT scoped to the org returns 200 here) so a typo fails now, not at
+// repo-creation time.
+async function orgReachable(token, org) {
+  const { status } = await ghApi("GET", `/orgs/${org}`, token);
+  return status === 200;
+}
+
 async function listOrgMembers(token, org) {
   // Returns [{login}]. Only visible members (public or visible to the token).
   // Non-fatal on error — caller falls back to a text prompt.
@@ -94,6 +105,18 @@ async function createRepo(token, owner, name, isOrg, description) {
     description: description || "Egregore shared memory",
   });
   if (status === 422) return { already_exists: true };
+  // 403 here almost always means the token can't write to THIS owner — the
+  // classic fine-grained-PAT case, where the token is scoped to one org and
+  // we're pointed at the personal account (or the wrong org). Turn GitHub's
+  // opaque "Resource not accessible by personal access token" into a next step.
+  if (status === 403) {
+    const where = isOrg ? `the ${owner} organization` : `your personal account (${owner})`;
+    throw new Error(
+      `GitHub refused repo creation in ${where} (403). ` +
+      `A fine-grained token is scoped to a single owner — re-run and choose that owner ` +
+      `as the home, or re-auth with \`gh auth login\` (unset GH_TOKEN first if it's set).`,
+    );
+  }
   if (status !== 201 && status !== 200) {
     const msg = typeof data === "object" ? data.message || JSON.stringify(data) : data;
     throw new Error(`Create repo failed (HTTP ${status}): ${msg}`);
@@ -320,12 +343,20 @@ function cloneRepo(url, dir, token, ui, label) {
     ui.warn(`${path.basename(dir)}/ already exists — pulling latest`);
     run("git pull", { cwd: dir });
   } else {
-    execFileSync("git", ["clone", embedToken(url, token), dir], {
-      stdio: "pipe",
-      encoding: "utf-8",
-      timeout: 60000,
-      env: gitCloneEnv(),
-    });
+    try {
+      execFileSync("git", ["clone", embedToken(url, token), dir], {
+        stdio: "pipe",
+        encoding: "utf-8",
+        timeout: 60000,
+        env: gitCloneEnv(),
+      });
+    } catch (err) {
+      // execFileSync puts the full command — including the embedded token — in
+      // err.message. Rethrow a redacted error that keeps git's stderr (the
+      // useful "remote: ..." lines) but never the credential.
+      const detail = [err.message, err.stderr].filter(Boolean).join("\n");
+      throw new Error(redactToken(detail, token));
+    }
     try {
       run(`git remote set-url origin ${url}`, { cwd: dir });
     } catch {}
@@ -677,6 +708,26 @@ async function localFounderFlow(ui, ctx = {}) {
     reposCache: null,         // {org, repos, teamRepoCount}
   };
 
+  const ENTER_ORG_LABEL = "Enter an organization name…";
+
+  const promptForOrg = async () => {
+    // Free-text org entry for the cases /user/orgs can't see (fine-grained
+    // tokens, private/SSO-gated membership). Validate reachability here so a
+    // typo or an unauthorized org fails now, with a clear message, instead of
+    // as an opaque 403 mid-creation.
+    while (true) {
+      const raw = await ui.prompt("Organization login (exact, e.g. acme-inc — blank to go back)");
+      const org = (raw || "").trim();
+      if (!org) return null;
+      const s = ui.spinner(`Checking ${org}…`);
+      if (await orgReachable(githubToken, org)) {
+        s.stop(`Found ${org}`);
+        return org;
+      }
+      s.fail(`Can't reach an org named "${org}" with this login — check the spelling, or authorize your token for it on GitHub.`);
+    }
+  };
+
   const stepHome = async () => {
     if (!st.orgs) {
       ui.section("Pick a home", "where should this Egregore live?");
@@ -684,24 +735,27 @@ async function localFounderFlow(ui, ctx = {}) {
       st.orgs = await listOrgs(githubToken);
       s.stop("Accounts loaded");
     }
-    if (st.orgs.length === 0) {
-      if (!st.githubOrg) {
-        st.githubOrg = user.login;
-        st.isOrg = false;
-        ui.info(`Using your personal account: ${ui.bold(st.githubOrg)}`);
-      }
-      return SKIP;
-    }
-    const orgChoice = await ui.choose(
-      "Where should Egregore live?",
-      [
-        { label: user.login, description: "Personal account" },
-        ...st.orgs.map((o) => ({ label: o.login, description: "Organization" })),
-      ],
-      "Don't see your org? Authorize it for your account on GitHub, then re-run.",
-      { escAction: "back" },
-    );
+    // Always offer manual org entry. /user/orgs returns nothing for
+    // fine-grained tokens and for orgs with private/SSO-gated membership, so
+    // auto-discovery alone silently strands those users on their personal
+    // account with no way to reach the org they actually want.
+    const options = [
+      { label: user.login, description: "Personal account" },
+      ...st.orgs.map((o) => ({ label: o.login, description: "Organization" })),
+      { label: ENTER_ORG_LABEL, description: "Type an org login (needed for fine-grained tokens)" },
+    ];
+    const hint = st.orgs.length === 0
+      ? "Couldn't auto-detect your orgs (normal with fine-grained tokens) — pick your account or enter an org."
+      : "Don't see your org? Enter it below, or authorize your token for it on GitHub.";
+    const orgChoice = await ui.choose("Where should Egregore live?", options, hint, { escAction: "back" });
     if (orgChoice === BACK) return BACK; // first step — driver clamps to a re-ask
+    if (orgChoice.label === ENTER_ORG_LABEL) {
+      const org = await promptForOrg();
+      if (!org) return stepHome(); // blank entry → re-show the picker (orgs cached)
+      st.githubOrg = org;
+      st.isOrg = true;
+      return true;
+    }
     st.githubOrg = orgChoice.label;
     st.isOrg = st.githubOrg !== user.login;
     return true;

package/lib/setup.js

@@ -596,6 +596,20 @@ function embedToken(url, token) {
   }
 }
 
+// Strip credentials from any text before it reaches the terminal. execFileSync
+// bakes the full argv into its thrown error message, so an authenticated
+// `git clone https://x-access-token:<pat>@github.com/...` leaks the token
+// verbatim if that error is printed. Redacts the known token, any userinfo in
+// an https URL, and bare GitHub token shapes as a backstop.
+function redactToken(text, token) {
+  let s = text == null ? "" : String(text);
+  if (token) s = s.split(token).join("***");
+  s = s.replace(/(https:\/\/)[^@/\s]+@/g, "$1***@"); // https://user:secret@host → https://***@host
+  s = s.replace(/gh[posru]_[A-Za-z0-9_]+/g, "***");  // ghp_/gho_/ghs_/ghu_/ghr_
+  s = s.replace(/github_pat_[A-Za-z0-9_]+/g, "***");
+  return s;
+}
+
 function toSSH(url) {
   const m = url.match(/https:\/\/github\.com\/(.+?)(?:\.git)?$/);
   return m ? `git@github.com:${m[1]}.git` : null;
@@ -1255,6 +1269,7 @@ module.exports = {
   ensurePersonOnboardingWitness,
   ensureInstallerMemberRole,
   embedToken,
+  redactToken,
   configureGitCredentials,
   gitCloneEnv,
   assistantInstallCommand,

package/lib/ui.js

@@ -729,19 +729,24 @@ async function interactiveMultiSelect(question, options, opts = {}) {
         const shown = names.length > maxW ? names.slice(0, maxW - 1) + "…" : names;
         lines.push(`    ${GREEN}✓${RESET} ${DIM}selected (${picked.size}):${RESET} ${shown}`);
       } else {
-        lines.push(`    ${DIM}0 selected${RESET}`);
+        // Nothing picked is a valid state — this picker never enforces a
+        // minimum. Say so, so an empty Enter doesn't read as "stuck".
+        lines.push(`    ${DIM}0 selected — none required${RESET}`);
       }
       if (searching && total > 0) lines.push(`    ${DIM}searching…${RESET}`);
 
       const searchHint = opts.remoteSearch ? "type to search" : "type to filter";
       const escHint = opts.escAction === "back" ? ` · ${DIM}←${RESET} back` : "";
+      // Enter always confirms the current selection, empty included — label it
+      // "skip" while nothing is picked so the exit is discoverable.
+      const enterHint = picked.size === 0 ? "skip" : "confirm";
       if (!first) clearLines(lastLineCount);
       lastLineCount = renderPicker({
         question,
         filterText,
         lines,
         input: { label: opts.remoteSearch ? "search" : "filter" },
-        help: `${DIM}↑↓${RESET} nav · ${DIM}space${RESET} toggle · ${DIM}ctrl-a${RESET} all · ${DIM}enter${RESET} confirm · ${searchHint}${escHint}`,
+        help: `${DIM}↑↓${RESET} nav · ${DIM}space${RESET} toggle · ${DIM}ctrl-a${RESET} all · ${DIM}enter${RESET} ${enterHint} · ${searchHint}${escHint}`,
       });
     };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.19.0",
+  "version": "0.19.3",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code or Codex.",
   "license": "MIT",
   "bin": {