@retasc/cli 1.1.0 → 1.1.2

package/dist/commands/mcp.js

@@ -58,52 +58,75 @@ export function mcpMarkerEntry(workspaceId) {
 export function mcpMarkerConfigBlock(workspaceId) {
     return JSON.stringify({ mcpServers: { [SERVER_NAME]: mcpMarkerEntry(workspaceId) } }, null, 2);
 }
-/** Try `claude mcp add`. Returns true on success, false if claude is absent or errored. */
-function tryClaudeCli(url, key, scope) {
-    const args = [
+// --- `claude mcp add` argv builders (pure, exported for tests) -------------
+// RTSC-99: the stdio builders put SERVER_NAME *before* the variadic `--env`
+// flags. `--env` consumes every following non-`--` token, so a server name after
+// it was eaten as a bogus env var ("Invalid environment variable format: retasc").
+// Name-first + a closing `--` keeps env values bounded and the command intact.
+/** Build `claude mcp add` argv for the HTTP transport. (`url` is a positional
+ *  BEFORE the variadic `--header`, so the header flag can't swallow it.) */
+export function buildHttpAddArgs(url, key, scope) {
+    return [
         "mcp", "add",
         "--transport", "http",
         "--scope", scope,
         SERVER_NAME, url,
         "--header", `Authorization: Bearer ${key}`,
     ];
-    return runClaudeAdd(args);
 }
-/** Try `claude mcp add` for the stdio watchdog proxy (RTSC-44). */
-function tryClaudeCliWatchdog(url, key, scope) {
-    const args = [
+/** Build argv for the stdio watchdog proxy (RTSC-44). */
+export function buildWatchdogAddArgs(url, key, scope) {
+    return [
         "mcp", "add",
+        SERVER_NAME,
         "--transport", "stdio",
         "--scope", scope,
         "--env", `RETASC_MCP_URL=${url}`,
         "--env", `RETASC_MCP_KEY=${key}`,
-        SERVER_NAME, "--", "retasc", "mcp-proxy",
+        "--", "retasc", "mcp-proxy",
     ];
-    return runClaudeAdd(args);
 }
-/** Try `claude mcp add` for the secret-free stdio marker (RTSC-92). */
-function tryClaudeCliMarker(workspaceId, scope) {
-    const args = [
+/** Build argv for the secret-free stdio marker (RTSC-92). */
+export function buildMarkerAddArgs(workspaceId, scope) {
+    return [
         "mcp", "add",
+        SERVER_NAME,
         "--transport", "stdio",
         "--scope", scope,
         "--env", `RETASC_WORKSPACE=${workspaceId}`,
-        SERVER_NAME, "--", "retasc", "mcp-proxy",
+        "--", "retasc", "mcp-proxy",
     ];
-    return runClaudeAdd(args);
+}
+function tryClaudeCli(url, key, scope) {
+    return runClaudeAdd(buildHttpAddArgs(url, key, scope));
+}
+function tryClaudeCliWatchdog(url, key, scope) {
+    return runClaudeAdd(buildWatchdogAddArgs(url, key, scope));
+}
+function tryClaudeCliMarker(workspaceId, scope) {
+    return runClaudeAdd(buildMarkerAddArgs(workspaceId, scope));
 }
 function runClaudeAdd(args) {
     const r = spawnSync("claude", args, { encoding: "utf8" });
-    if (r.error)
-        return false; // ENOENT — claude not installed
+    if (r.error) {
+        // ENOENT = `claude` not on PATH (genuinely absent). Any other spawn error is
+        // a real failure of a present CLI — report it as such, not as "not detected".
+        const absent = r.error.code === "ENOENT";
+        return { ok: false, absent, msg: absent ? undefined : r.error.message };
+    }
     if (r.status !== 0) {
-        // Surface why it failed but don't throw — we fall back to the file.
-        const msg = (r.stderr || r.stdout || "").trim();
-        if (msg)
-            console.error(`  (claude mcp add: ${msg.split("\n")[0]})`);
-        return false;
+        // CLI ran but rejected the command — present, not absent. Surface the real reason.
+        const msg = (r.stderr || r.stdout || "").trim().split("\n")[0] || `exited ${r.status}`;
+        return { ok: false, absent: false, msg };
     }
-    return true;
+    return { ok: true };
+}
+/** The fallback note printed after writing .mcp.json — names the REAL reason the
+ *  CLI path didn't take, never falsely claiming the CLI is missing (RTSC-99). */
+export function fallbackNote(res) {
+    return res.absent
+        ? "(Claude Code CLI not detected — wrote .mcp.json instead.)"
+        : `(claude mcp add failed${res.msg ? `: ${res.msg}` : ""} — wrote .mcp.json instead.)`;
 }
 /** Merge a given server entry into ./.mcp.json (project scope on disk). */
 function writeProjectMcpJson(entry) {
@@ -131,28 +154,28 @@ export function installMcp(opts) {
     const scope = opts.scope ?? "local";
     // Watchdog mode (RTSC-44): wire the stdio proxy so claims stay alive automatically.
     if (opts.watchdog) {
-        const viaClaude = tryClaudeCliWatchdog(opts.url, opts.key, scope);
-        if (viaClaude) {
+        const res = tryClaudeCliWatchdog(opts.url, opts.key, scope);
+        if (res.ok) {
             console.log(`✓ Registered Retasc with the liveness watchdog (stdio proxy, scope: ${scope}).`);
         }
         else {
             const path = writeProjectMcpJson(mcpProxyEntry(opts.url, opts.key));
             console.log(`✓ Wrote watchdog MCP config to ${path}`);
-            console.log("  (Claude Code CLI not detected or unavailable — used .mcp.json instead.)");
+            console.log(`  ${fallbackNote(res)}`);
         }
         console.log("\nWatchdog MCP config (Codex / OpenCode / any stdio MCP client):\n");
         console.log(mcpProxyConfigBlock(opts.url, opts.key));
         console.log("\nThe watchdog keeps your claims alive automatically — no per-claim heartbeats. If it ever isn't running you just fall back to the normal lease timeout (safe).");
         return;
     }
-    const viaClaude = tryClaudeCli(opts.url, opts.key, scope);
-    if (viaClaude) {
+    const res = tryClaudeCli(opts.url, opts.key, scope);
+    if (res.ok) {
         console.log(`✓ Registered MCP server "${SERVER_NAME}" with Claude Code (scope: ${scope}).`);
     }
     else {
         const path = writeProjectMcpJson(mcpServerEntry(opts.url, opts.key));
         console.log(`✓ Wrote MCP config to ${path}`);
-        console.log("  (Claude Code CLI not detected or unavailable — used .mcp.json instead.)");
+        console.log(`  ${fallbackNote(res)}`);
     }
     console.log("\nMCP config block (for any other agent/client):\n");
     console.log(mcpConfigBlock(opts.url, opts.key));
@@ -165,14 +188,14 @@ export function installMcp(opts) {
  */
 export function installMarker(opts) {
     const scope = opts.scope ?? "local";
-    const viaClaude = tryClaudeCliMarker(opts.workspaceId, scope);
-    if (viaClaude) {
+    const res = tryClaudeCliMarker(opts.workspaceId, scope);
+    if (res.ok) {
         console.log(`✓ Registered Retasc watchdog (secret-free marker, scope: ${scope}).`);
     }
     else {
         const path = writeProjectMcpJson(mcpMarkerEntry(opts.workspaceId));
         console.log(`✓ Wrote secret-free watchdog marker to ${path}`);
-        console.log("  (Claude Code CLI not detected — used .mcp.json instead.)");
+        console.log(`  ${fallbackNote(res)}`);
     }
     console.log("\nMarker block (any stdio MCP client) — no secret, safe to commit:\n");
     console.log(mcpMarkerConfigBlock(opts.workspaceId));

package/dist/index.js

@@ -15,7 +15,7 @@ const program = new Command();
 program
     .name("retasc")
     .description("Retasc — sign in, create projects, mint agent API keys, and wire your agent to the MCP server.")
-    .version("1.1.0");
+    .version("1.1.1");
 function requireLogin() {
     if (!isLoggedIn()) {
         console.error("Not signed in. Run `retasc login` first.");

package/dist/lib/claim.js

@@ -4,35 +4,23 @@
 // ../commands/claim.ts.
 import { readFileSync, existsSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { resolveConn } from "./keystore.js";
 const DEFAULT_MCP_URL = "https://mcp.retasc.com/mcp";
 /**
  * Resolve the agent API key + MCP URL the same way the workspace's MCP wiring does,
- * so `retasc claim` speaks as the *same agent* the harness already uses. Order:
- * explicit env (RETASC_MCP_KEY / RETASC_MCP_URL — what the watchdog proxy reads)
- * wins, then the workspace `.mcp.json` in both shapes installMcp writes:
- *   - stdio watchdog: { command, args, env: { RETASC_MCP_URL, RETASC_MCP_KEY } }
- *   - http direct:    { type:"http", url, headers:{ Authorization:"Bearer <key>" } }
- * `key` comes back empty if nothing is found, so the caller can error clearly.
+ * so `retasc claim` speaks as the *same agent* the harness already uses. Delegates
+ * to the shared `resolveConn` (RTSC-98) so it stays in lockstep with the proxy —
+ * covering explicit env, both legacy `.mcp.json` shapes, AND the canonical
+ * secret-free marker (`RETASC_WORKSPACE` → home keystore). `key` comes back empty
+ * if nothing is found, so the caller can error clearly.
  */
 export function resolveMcpConn(opts = {}) {
-    const env = opts.env ?? process.env;
-    let url = env.RETASC_MCP_URL || "";
-    let key = env.RETASC_MCP_KEY || "";
-    const entry = opts.mcpJson?.mcpServers?.retasc;
-    if (entry) {
-        if (!key && typeof entry.env?.RETASC_MCP_KEY === "string")
-            key = entry.env.RETASC_MCP_KEY;
-        if (!url && typeof entry.env?.RETASC_MCP_URL === "string")
-            url = entry.env.RETASC_MCP_URL;
-        if (!url && typeof entry.url === "string")
-            url = entry.url;
-        if (!key && typeof entry.headers?.Authorization === "string") {
-            const m = entry.headers.Authorization.match(/^Bearer\s+(.+)$/i);
-            if (m)
-                key = m[1].trim();
-        }
-    }
-    return { url: url || opts.defaultUrl || DEFAULT_MCP_URL, key };
+    const { key, url } = resolveConn({
+        env: opts.env,
+        mcpEntry: opts.mcpJson?.mcpServers?.retasc,
+        defaultUrl: opts.defaultUrl || DEFAULT_MCP_URL,
+    });
+    return { url: url || DEFAULT_MCP_URL, key };
 }
 /** Read & parse the workspace `.mcp.json` (or null if absent/corrupt). */
 export function readMcpJson(dir = process.cwd()) {

package/dist/lib/keystore.js

@@ -50,3 +50,44 @@ export function removeBinding(workspaceId) {
 export function newWorkspaceId() {
     return `ws_${randomUUID()}`;
 }
+/**
+ * RTSC-98: the ONE place that resolves a workspace's key + MCP url. Shared by the
+ * proxy (env-based) and the direct commands `claim`/`tidy`/`done` (.mcp.json-based)
+ * so the two paths can never drift again. Precedence: explicit `RETASC_MCP_KEY`
+ * env → legacy inline key in the marker (env or Authorization header) → canonical
+ * secret-free marker (`RETASC_WORKSPACE` → home keystore). `mcpEntry` is a
+ * workspace `.mcp.json`'s `mcpServers.retasc` entry, or undefined when only the
+ * environment carries the binding (the spawned proxy).
+ */
+export function resolveConn(opts) {
+    const env = opts.env ?? process.env;
+    const entry = opts.mcpEntry;
+    let key = env.RETASC_MCP_KEY || "";
+    let url = env.RETASC_MCP_URL || "";
+    if (entry) {
+        if (!key && typeof entry.env?.RETASC_MCP_KEY === "string")
+            key = entry.env.RETASC_MCP_KEY;
+        if (!url && typeof entry.env?.RETASC_MCP_URL === "string")
+            url = entry.env.RETASC_MCP_URL;
+        if (!url && typeof entry.url === "string")
+            url = entry.url;
+        if (!key && typeof entry.headers?.Authorization === "string") {
+            const m = String(entry.headers.Authorization).match(/^Bearer\s+(.+)$/i);
+            if (m)
+                key = m[1].trim();
+        }
+    }
+    // Canonical (RTSC-92): secret-free marker → workspace id → home keystore.
+    if (!key) {
+        const wsId = env.RETASC_WORKSPACE || entry?.env?.RETASC_WORKSPACE;
+        if (wsId) {
+            const b = getBinding(String(wsId));
+            if (b) {
+                key = b.key;
+                if (!url)
+                    url = b.url;
+            }
+        }
+    }
+    return { key, url: url || opts.defaultUrl || "" };
+}

package/dist/proxy.js

@@ -8,24 +8,11 @@
 import { createInterface } from "node:readline";
 import { hostname } from "node:os";
 import { applyObservation, heartbeatRequest, isClaimLost, } from "./lib/watchdog.js";
-import { getBinding } from "./lib/keystore.js";
-// RTSC-92: resolve the workspace key. Canonical path — a secret-free marker sets
-// RETASC_WORKSPACE; we look the key up in the home keystore (never in the repo).
-// Legacy path — RETASC_MCP_KEY inlined in an old ./.mcp.json still works.
-function resolveKeyUrl() {
-    const envUrl = process.env.RETASC_MCP_URL || "https://mcp.retasc.com/mcp";
-    if (process.env.RETASC_MCP_KEY) {
-        return { key: process.env.RETASC_MCP_KEY, url: envUrl };
-    }
-    const wsId = process.env.RETASC_WORKSPACE;
-    if (wsId) {
-        const entry = getBinding(wsId);
-        if (entry)
-            return { key: entry.key, url: entry.url || envUrl };
-    }
-    return { key: "", url: envUrl };
-}
-const resolved = resolveKeyUrl();
+import { resolveConn } from "./lib/keystore.js";
+// RTSC-92/98: resolve the workspace key via the SHARED resolver, so the proxy and
+// the direct commands (claim/tidy/done) can never diverge. The proxy carries its
+// binding in its own env (RETASC_MCP_KEY legacy, or RETASC_WORKSPACE → keystore).
+const resolved = resolveConn({ env: process.env, defaultUrl: "https://mcp.retasc.com/mcp" });
 let MCP_URL = resolved.url;
 const KEY = resolved.key;
 const HEARTBEAT_MS = Number(process.env.RETASC_HEARTBEAT_MS) || 10 * 60 * 1000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "Retasc CLI — sign in with GitHub, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {