@retasc/cli 1.1.0 → 1.1.1

package/dist/index.js

@@ -15,7 +15,7 @@ const program = new Command();
 program
     .name("retasc")
     .description("Retasc — sign in, create projects, mint agent API keys, and wire your agent to the MCP server.")
-    .version("1.1.0");
+    .version("1.1.1");
 function requireLogin() {
     if (!isLoggedIn()) {
         console.error("Not signed in. Run `retasc login` first.");

package/dist/lib/claim.js

@@ -4,35 +4,23 @@
 // ../commands/claim.ts.
 import { readFileSync, existsSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { resolveConn } from "./keystore.js";
 const DEFAULT_MCP_URL = "https://mcp.retasc.com/mcp";
 /**
  * Resolve the agent API key + MCP URL the same way the workspace's MCP wiring does,
- * so `retasc claim` speaks as the *same agent* the harness already uses. Order:
- * explicit env (RETASC_MCP_KEY / RETASC_MCP_URL — what the watchdog proxy reads)
- * wins, then the workspace `.mcp.json` in both shapes installMcp writes:
- *   - stdio watchdog: { command, args, env: { RETASC_MCP_URL, RETASC_MCP_KEY } }
- *   - http direct:    { type:"http", url, headers:{ Authorization:"Bearer <key>" } }
- * `key` comes back empty if nothing is found, so the caller can error clearly.
+ * so `retasc claim` speaks as the *same agent* the harness already uses. Delegates
+ * to the shared `resolveConn` (RTSC-98) so it stays in lockstep with the proxy —
+ * covering explicit env, both legacy `.mcp.json` shapes, AND the canonical
+ * secret-free marker (`RETASC_WORKSPACE` → home keystore). `key` comes back empty
+ * if nothing is found, so the caller can error clearly.
  */
 export function resolveMcpConn(opts = {}) {
-    const env = opts.env ?? process.env;
-    let url = env.RETASC_MCP_URL || "";
-    let key = env.RETASC_MCP_KEY || "";
-    const entry = opts.mcpJson?.mcpServers?.retasc;
-    if (entry) {
-        if (!key && typeof entry.env?.RETASC_MCP_KEY === "string")
-            key = entry.env.RETASC_MCP_KEY;
-        if (!url && typeof entry.env?.RETASC_MCP_URL === "string")
-            url = entry.env.RETASC_MCP_URL;
-        if (!url && typeof entry.url === "string")
-            url = entry.url;
-        if (!key && typeof entry.headers?.Authorization === "string") {
-            const m = entry.headers.Authorization.match(/^Bearer\s+(.+)$/i);
-            if (m)
-                key = m[1].trim();
-        }
-    }
-    return { url: url || opts.defaultUrl || DEFAULT_MCP_URL, key };
+    const { key, url } = resolveConn({
+        env: opts.env,
+        mcpEntry: opts.mcpJson?.mcpServers?.retasc,
+        defaultUrl: opts.defaultUrl || DEFAULT_MCP_URL,
+    });
+    return { url: url || DEFAULT_MCP_URL, key };
 }
 /** Read & parse the workspace `.mcp.json` (or null if absent/corrupt). */
 export function readMcpJson(dir = process.cwd()) {

package/dist/lib/keystore.js

@@ -50,3 +50,44 @@ export function removeBinding(workspaceId) {
 export function newWorkspaceId() {
     return `ws_${randomUUID()}`;
 }
+/**
+ * RTSC-98: the ONE place that resolves a workspace's key + MCP url. Shared by the
+ * proxy (env-based) and the direct commands `claim`/`tidy`/`done` (.mcp.json-based)
+ * so the two paths can never drift again. Precedence: explicit `RETASC_MCP_KEY`
+ * env → legacy inline key in the marker (env or Authorization header) → canonical
+ * secret-free marker (`RETASC_WORKSPACE` → home keystore). `mcpEntry` is a
+ * workspace `.mcp.json`'s `mcpServers.retasc` entry, or undefined when only the
+ * environment carries the binding (the spawned proxy).
+ */
+export function resolveConn(opts) {
+    const env = opts.env ?? process.env;
+    const entry = opts.mcpEntry;
+    let key = env.RETASC_MCP_KEY || "";
+    let url = env.RETASC_MCP_URL || "";
+    if (entry) {
+        if (!key && typeof entry.env?.RETASC_MCP_KEY === "string")
+            key = entry.env.RETASC_MCP_KEY;
+        if (!url && typeof entry.env?.RETASC_MCP_URL === "string")
+            url = entry.env.RETASC_MCP_URL;
+        if (!url && typeof entry.url === "string")
+            url = entry.url;
+        if (!key && typeof entry.headers?.Authorization === "string") {
+            const m = String(entry.headers.Authorization).match(/^Bearer\s+(.+)$/i);
+            if (m)
+                key = m[1].trim();
+        }
+    }
+    // Canonical (RTSC-92): secret-free marker → workspace id → home keystore.
+    if (!key) {
+        const wsId = env.RETASC_WORKSPACE || entry?.env?.RETASC_WORKSPACE;
+        if (wsId) {
+            const b = getBinding(String(wsId));
+            if (b) {
+                key = b.key;
+                if (!url)
+                    url = b.url;
+            }
+        }
+    }
+    return { key, url: url || opts.defaultUrl || "" };
+}

package/dist/proxy.js

@@ -8,24 +8,11 @@
 import { createInterface } from "node:readline";
 import { hostname } from "node:os";
 import { applyObservation, heartbeatRequest, isClaimLost, } from "./lib/watchdog.js";
-import { getBinding } from "./lib/keystore.js";
-// RTSC-92: resolve the workspace key. Canonical path — a secret-free marker sets
-// RETASC_WORKSPACE; we look the key up in the home keystore (never in the repo).
-// Legacy path — RETASC_MCP_KEY inlined in an old ./.mcp.json still works.
-function resolveKeyUrl() {
-    const envUrl = process.env.RETASC_MCP_URL || "https://mcp.retasc.com/mcp";
-    if (process.env.RETASC_MCP_KEY) {
-        return { key: process.env.RETASC_MCP_KEY, url: envUrl };
-    }
-    const wsId = process.env.RETASC_WORKSPACE;
-    if (wsId) {
-        const entry = getBinding(wsId);
-        if (entry)
-            return { key: entry.key, url: entry.url || envUrl };
-    }
-    return { key: "", url: envUrl };
-}
-const resolved = resolveKeyUrl();
+import { resolveConn } from "./lib/keystore.js";
+// RTSC-92/98: resolve the workspace key via the SHARED resolver, so the proxy and
+// the direct commands (claim/tidy/done) can never diverge. The proxy carries its
+// binding in its own env (RETASC_MCP_KEY legacy, or RETASC_WORKSPACE → keystore).
+const resolved = resolveConn({ env: process.env, defaultUrl: "https://mcp.retasc.com/mcp" });
 let MCP_URL = resolved.url;
 const KEY = resolved.key;
 const HEARTBEAT_MS = Number(process.env.RETASC_HEARTBEAT_MS) || 10 * 60 * 1000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Retasc CLI — sign in with GitHub, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {