@retasc/cli 1.17.0 → 1.19.0

package/CHANGELOG.md

@@ -6,6 +6,66 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.19.0 (2026-08-03)
+
+- **RTSC-495** — `retasc bind --setup <code>` sets a folder up with no sign-in and nothing
+  to answer, so an agent can do it on behalf of someone who does not use a terminal.
+
+  The Dash's connect step now hands over a block you paste to your agent, with this command
+  inside it. Everything the interactive `bind` would ask was already answered in the
+  browser, and the code carries those answers across. An agent's shell is not a TTY, so the
+  ordinary path refuses it outright at the first prompt.
+
+  ```
+  npx @retasc/cli bind --setup rtscsetup_…
+  ```
+
+  The code is single-use and lives ten minutes. The alternative — pasting a real API key
+  into the prompt — needed no backend at all, but would have left a long-lived credential in
+  an agent's conversation history forever.
+
+  A folder that is already connected is refused rather than silently replaced, and the
+  refusal happens BEFORE the code is spent, so a mix-up costs nothing.
+
+- **RTSC-532** — the agent says which folder it is in, and the key remembers.
+
+  Binding the wrong folder used to look exactly like success: the agent still called in, so
+  the Dash went green, while the folder you actually work in had no Retasc in it. The prompt
+  now asks the agent to report its full path and wait before it runs anything, and the
+  confirmation names the real path instead of "This folder".
+
+  The key it creates is named after that folder, so the Keys page shows which folder each
+  key belongs to (`client-a`) instead of naming them all after the project (`ENG key`).
+
+## 1.18.0 (2026-08-02)
+
+- **RTSC-530** — setting up from scratch now asks where your work comes from, and imports it
+  in the same command.
+
+  `retasc bind` used to offer one thing at the project step: name a new project. So someone
+  arriving from Jira had to invent a project they didn't want, run `retasc import`
+  afterwards to get the one they did, and leave the empty one behind — and projects can't be
+  deleted individually.
+
+  ```
+  Where does your work come from?
+    1) Linear
+    2) Jira
+    3) Asana
+    4) ClickUp
+    5) Shortcut
+    6) Start from scratch   (name a project; your agents file into it)
+  ```
+
+  Pick a tracker and the import runs right there, then the folder binds to the project it
+  created. Pick "start from scratch" and it behaves exactly as before. This is the same fork
+  the Dash has always offered; importing isn't a separate errand, it's one of the ways a
+  first project comes into existence.
+
+  Only when the org has no projects — binding a second folder in an existing org is still
+  just picking from the list. Declining at the import confirmation falls back to naming a
+  project rather than abandoning setup: you still asked to bind the folder.
+
 ## 1.17.0 (2026-08-02)
 
 - **RTSC-529** — the column mapping is a numbered picker, like every other prompt.

package/dist/api.js

@@ -43,6 +43,10 @@ const fns = {
     claimableGhosts: makeFunctionReference("ghosts:claimableGhosts"),
     claimGhost: makeFunctionReference("ghosts:claimGhost"),
     dismissGhostPrompt: makeFunctionReference("ghosts:dismissGhostPrompt"),
+    // RTSC-495 — the ONLY unauthenticated call the CLI makes. Redeemed by `bind --setup`
+    // on a machine that has never signed in, because the human answered everything in the
+    // Dash and it is her agent, not her, running this.
+    redeemSetupToken: makeFunctionReference("setupToken:redeemSetupToken"),
 };
 function client() {
     const cfg = loadConfig();
@@ -51,6 +55,18 @@ function client() {
         c.setAuth(cfg.token);
     return c;
 }
+/**
+ * A client that NEVER attaches a session (RTSC-495).
+ *
+ * `client()` attaches `cfg.token` whenever one exists, and a setup-token redeem must not
+ * depend on it either way: the machine usually has no session at all, and where it has a
+ * STALE one, sending it risks failing an auth check on a call that never needed identity.
+ * Separate function rather than a flag, so "this call is unauthenticated" is visible at
+ * the call site instead of buried in an argument.
+ */
+function anonClient() {
+    return new ConvexHttpClient(loadConfig().deploymentUrl);
+}
 /**
  * Read a caught backend error into the parts a command wants to show (RTSC-261).
  *
@@ -178,6 +194,9 @@ export const api = {
     runImport: (args) => withAuth(() => client().action(fns.runImport, args)),
     latestImport: (args) => withAuth(() => client().query(fns.latestImport, args)),
     importHistory: (args) => withAuth(() => client().query(fns.importHistory, args)),
+    // NOT wrapped in `withAuth`: there is no session to refresh, and its retry path would
+    // start a device flow — the exact interactive prompt this whole flow exists to avoid.
+    redeemSetupToken: (args) => anonClient().action(fns.redeemSetupToken, args),
     claimableGhosts: (args) => withAuth(() => client().query(fns.claimableGhosts, args)),
     claimGhost: (args) => withAuth(() => client().mutation(fns.claimGhost, args)),
     dismissGhostPrompt: (args) => withAuth(() => client().mutation(fns.dismissGhostPrompt, args)),

package/dist/commands/bind.js

@@ -1,3 +1,4 @@
+import { basename } from "node:path";
 import { api, cliError } from "../api.js";
 import { deviceLogin } from "../auth.js";
 import { loadConfig, patchConfig } from "../config.js";
@@ -208,6 +209,59 @@ function remember(globalInstall) {
     patchConfig({ globalInstall });
     return globalInstall;
 }
+/** Name and create a project by hand — the "start from scratch" ending. */
+async function nameAProject(orgId) {
+    const name = await ask("New project name: ");
+    const pfx = (await ask("Project prefix (e.g. ACME): ")).toUpperCase();
+    if (!name || !pfx)
+        throw new Error("project name and prefix required");
+    const p = (await api.createProject({ orgId, name, prefix: pfx }));
+    console.log(`✓ Created project ${p.prefix}.`);
+    return { projectId: p.projectId, prefix: p.prefix };
+}
+/**
+ * "Where does your work come from?" — the first project, for an org that has none.
+ *
+ * RTSC-530. Mirrors the Dash's `ProjectSetup`: the trackers first, then "start from
+ * scratch" as the last row rather than a footer escape hatch. The Dash records why it is a
+ * ROW — as a button it read as a way out of the five real options, which is the wrong
+ * framing when most people arriving have work to bring.
+ *
+ * The import flow is CALLED, not re-implemented (`runImportFlow`). A second copy of the
+ * auth prompt, target picker and column mapping is how the two drift, and the mapping is
+ * the part that decides where a whole backlog lands.
+ *
+ * Imported dynamically: `commands/import.ts` imports `pickExisting` from here, so a static
+ * import would close a cycle. Same pattern `join` uses for `identityLoop`.
+ */
+async function firstProject(orgId, orgLabel) {
+    let sources = [];
+    try {
+        sources = (await api.listImportSources());
+    }
+    catch {
+        // Never block setting up a workspace on the importer list being reachable. A person
+        // who just wants an empty project should not be stopped by a source catalogue.
+        sources = [];
+    }
+    if (!sources.length)
+        return nameAProject(orgId);
+    const SCRATCH = { source: "", label: "Start from scratch   (name a project; your agents file into it)" };
+    const picked = await pickExisting("Where does your work come from?", [...sources, SCRATCH], (x) => clean(x.label));
+    // Compared by REFERENCE, so a source that ever arrives with an empty id cannot be
+    // mistaken for the scratch row.
+    if (picked === SCRATCH)
+        return nameAProject(orgId);
+    const { runImportFlow } = await import("./import.js");
+    const done = await runImportFlow({ orgId, orgLabel, source: picked.source });
+    // Declining at the import confirmation is not an error, and must not abandon setup —
+    // they still asked to bind this folder. Fall back to the other branch of the same fork.
+    if (!done) {
+        console.log("\nNo import. Let's make an empty project instead.");
+        return nameAProject(orgId);
+    }
+    return done;
+}
 /**
  * Everything from "which project" to a working folder: pick the project, make `retasc`
  * durable, mint a key for that (org, project), write the binding, and wire the marker.
@@ -264,6 +318,19 @@ export async function completeWorkspaceSetup(args) {
                 cliError("AMBIGUOUS", `Org ${org} has ${list.length} projects, so one has to be named.`, `Pass --project-id <id> (or run interactively): ${list.map((p) => `${p.prefix}=${p.id}`).join(", ")}`);
             }
         }
+        else if (isInteractive() && list.length === 0) {
+            // RTSC-530 — the FROM-SCRATCH case, and the Dash's question rather than ours.
+            //
+            // `Onboarding.tsx` asks "Where does your work come from?" and offers the five
+            // trackers AND "start from scratch" as one fork, because importing is not a separate
+            // act: it is one of the ways a first project comes into existence. The CLI used to
+            // ask only "New project name:", so someone arriving from Jira had to invent a project
+            // they did not want, run `retasc import` afterwards, and leave an empty one behind
+            // that cannot be deleted (org-granularity delete only).
+            const made = await firstProject(orgId, org);
+            projectId = made.projectId;
+            prefix = made.prefix;
+        }
         else if (isInteractive()) {
             const chosen = await pick("Select a project", list, (p) => `${clean(p.prefix)} — ${clean(p.name)}`);
             if (chosen) {
@@ -271,14 +338,9 @@ export async function completeWorkspaceSetup(args) {
                 prefix = chosen.prefix;
             }
             else {
-                const name = await ask("New project name: ");
-                const pfx = (await ask("Project prefix (e.g. ACME): ")).toUpperCase();
-                if (!name || !pfx)
-                    throw new Error("project name and prefix required");
-                const p = (await api.createProject({ orgId, name, prefix: pfx }));
-                projectId = p.projectId;
-                prefix = p.prefix;
-                console.log(`✓ Created project ${p.prefix}.`);
+                const made = await nameAProject(orgId);
+                projectId = made.projectId;
+                prefix = made.prefix;
             }
         }
         else if (list.length === 1) {
@@ -355,6 +417,53 @@ export async function completeWorkspaceSetup(args) {
     if (isInteractive())
         console.log(`\n${NEXT_STEP}`);
 }
+export async function setupFromToken(token, opts, deps = {}) {
+    const cfg = loadConfig();
+    const cwd = process.cwd();
+    const guard = deps.guard ?? rebindGuard;
+    const redeem = deps.redeem ??
+        ((t, label) => api.redeemSetupToken({ token: t, label }));
+    // BEFORE the redeem. `rebindGuard` prints its own explanation and, with no TTY,
+    // refuses with exit 1 unless `--yes` — which is exactly the required behaviour, so it
+    // is reused rather than restated. No org/project passed: its idempotent-converge
+    // shortcut needs ids we do not have yet, and cannot apply to a single-use token anyway.
+    const { proceed, existing } = await guard({ cwd, mcpUrl: cfg.mcpUrl, yes: opts.yes });
+    if (!proceed)
+        return;
+    // Resolve (and if needed install) `retasc` BEFORE the token is spent, so a machine that
+    // cannot get a working launcher fails while the code is still redeemable.
+    const install = await chooseInstall(opts.install);
+    const launcher = resolveLauncher({ version: VERSION, install });
+    const note = launcherNote(launcher);
+    if (note)
+        console.log(note);
+    // RTSC-532 — the LEAF name, never the full path. It names the key in the Dash, so it
+    // has to be recognisable ("client-a → ENG") without publishing where on her disk it
+    // sits. `basename` of the cwd is exactly that.
+    const redeemed = await redeem(token.trim(), basename(cwd));
+    const workspaceId = existing?.workspaceId ?? newWorkspaceId();
+    (deps.bind ?? setBinding)(workspaceId, {
+        orgId: redeemed.orgId,
+        projectId: redeemed.projectId,
+        key: redeemed.key,
+        url: cfg.mcpUrl,
+        prefix: redeemed.prefix,
+        orgName: redeemed.orgName,
+        boundPath: cwd,
+        createdAt: Date.now(),
+    });
+    (deps.marker ?? installMarker)({ workspaceId, scope: "local", launcher });
+    // RTSC-532 — name the PATH, not "this folder". A binding is folder → project, and
+    // until this line said which folder, a wrong one was undetectable: the agent still
+    // calls in, so the Dash shows success while the folder she actually works in has no
+    // Retasc tools. Her agent relays this sentence to her, so it is also the last chance
+    // to notice.
+    console.log(`✓ ${clean(cwd)} is connected to ${clean(redeemed.orgName)} / ${clean(redeemed.prefix)}.`);
+    // NOT gated on isInteractive(), unlike the interactive path's copy of this line. There
+    // is never a TTY here, and this is the one instruction the agent has to pass on — the
+    // Dash waits on a tool call that cannot happen until the restart does (RTSC-496).
+    console.log(`\n${NEXT_STEP}`);
+}
 /**
  * What to do with a workspace that is now set up.
  *

package/dist/commands/import.js

@@ -312,25 +312,21 @@ function followProgress(orgId) {
         stdout.write("\r\x1b[2K");
     };
 }
-export async function importAction(opts) {
-    if (!isInteractive() && !opts.yes) {
-        cliError("NEEDS_TERMINAL", "Importing asks what each of your columns means, so it needs a terminal.", "Run it interactively, or use the Dash.");
-    }
-    // --- which org ------------------------------------------------------------
-    const me = (await api.me());
-    const orgs = me.orgs ?? [];
-    let orgId = opts.orgId;
-    if (!orgId) {
-        if (orgs.length === 0)
-            cliError("NO_ORG", "You're not a member of any org yet.");
-        else if (orgs.length === 1)
-            orgId = orgs[0].id;
-        else {
-            const chosen = await pickExisting("Import into which org", orgs, (o) => `${clean(o.name)}${o.slug ? ` (${clean(o.slug)})` : ""}`);
-            orgId = chosen.id;
-        }
-    }
-    const orgLabel = clean(orgs.find((o) => o.id === orgId)?.name ?? "this org");
+/**
+ * The whole import, from source to finished run, returning the project it landed in.
+ *
+ * RTSC-530 — split out of `importAction` so `retasc bind` can offer "bring your tracker
+ * across" as one of the ways a FIRST project comes into existence, the way the Dash's
+ * project step does. It calls this; it does not resemble it. Two copies of the auth prompt,
+ * target picker and column mapping is how the two drift, and the mapping is the part that
+ * decides where a whole backlog lands.
+ *
+ * Returns null when the human declines at the confirmation, so the caller can fall back
+ * rather than treat a deliberate "no" as a failure.
+ */
+export async function runImportFlow(opts) {
+    const { orgId, orgLabel } = opts;
+    // --- which tracker --------------------------------------------------------
     // --- which tracker --------------------------------------------------------
     const sources = (await api.listImportSources());
     if (!sources.length)
@@ -343,7 +339,7 @@ export async function importAction(opts) {
     console.log(`\nConnect to ${clean(src.label)}:`);
     const auth = await collectAuth(src);
     // --- which team/project/workspace -----------------------------------------
-    const { targets } = (await api.listImportTargets({ orgId: orgId, source: src.source, auth }));
+    const { targets } = (await api.listImportTargets({ orgId, source: src.source, auth }));
     if (!targets.length) {
         cliError("NO_TARGETS", `That ${clean(src.label)} account has no ${clean(src.targetNoun)} we can import.`, "Check the credentials belong to the right account.");
     }
@@ -355,13 +351,13 @@ export async function importAction(opts) {
     let reviewerByStatus;
     if (src.supportsStatusMapping) {
         const { statuses } = (await api.listImportStatuses({
-            orgId: orgId,
+            orgId,
             source: src.source,
             auth,
             targetRef: target.id,
         }));
         if (statuses.length) {
-            const reviewers = (await api.listReviewCandidates({ orgId: orgId }));
+            const reviewers = (await api.listReviewCandidates({ orgId }));
             const mapped = await mapStatuses(statuses, reviewers, ask);
             statusMap = mapped.statusMap;
             reviewerByStatus = Object.keys(mapped.reviewerByStatus).length
@@ -379,13 +375,13 @@ export async function importAction(opts) {
     // gets re-run casually. Read from `importHistory` (permanent) rather than `latestImport`
     // (live progress, swept after 24h), so this still fires for someone who imported last
     // week and has been working in Retasc since — the person with the most to lose.
-    const history = (await api.importHistory({ orgId: orgId }));
+    const history = (await api.importHistory({ orgId }));
     const warning = reimportWarning(history, src.source, src.label);
     if (warning)
         console.log(warning);
     if (!opts.yes && !(await confirm("This can't be undone. Go ahead?"))) {
         console.log("Nothing imported.");
-        return;
+        return null;
     }
     // --- run -------------------------------------------------------------------
     console.log("\nImporting…\n");
@@ -396,7 +392,7 @@ export async function importAction(opts) {
     let res;
     try {
         res = (await api.runImport({
-            orgId: orgId,
+            orgId,
             source: src.source,
             auth,
             target: { id: target.id, key: target.key, name: target.name },
@@ -429,4 +425,26 @@ export async function importAction(opts) {
     console.log("");
     const { identityLoop } = await import("./join.js");
     await identityLoop(orgId, {}, orgLabel);
+    return { projectId: res.projectId, prefix: target.key };
+}
+/** `retasc import` — the standalone command. Resolves the org, then runs the flow above. */
+export async function importAction(opts) {
+    if (!isInteractive() && !opts.yes) {
+        cliError("NEEDS_TERMINAL", "Importing asks what each of your columns means, so it needs a terminal.", "Run it interactively, or use the Dash.");
+    }
+    const me = (await api.me());
+    const orgs = me.orgs ?? [];
+    let orgId = opts.orgId;
+    if (!orgId) {
+        if (orgs.length === 0)
+            cliError("NO_ORG", "You're not a member of any org yet.");
+        else if (orgs.length === 1)
+            orgId = orgs[0].id;
+        else {
+            const chosen = await pickExisting("Import into which org", orgs, (o) => `${clean(o.name)}${o.slug ? ` (${clean(o.slug)})` : ""}`);
+            orgId = chosen.id;
+        }
+    }
+    const orgLabel = clean(orgs.find((o) => o.id === orgId)?.name ?? "this org");
+    await runImportFlow({ orgId: orgId, orgLabel, source: opts.source, yes: opts.yes });
 }

package/dist/index.js

@@ -5,7 +5,7 @@ import { loadConfig, patchConfig, saveConfig, configPath, isLoggedIn } from "./c
 import { installMcp, normalizeScope } from "./commands/mcp.js";
 import { installGate } from "./commands/gate.js";
 import { claimAction } from "./commands/claim.js";
-import { bindAction } from "./commands/bind.js";
+import { bindAction, setupFromToken } from "./commands/bind.js";
 import { joinAction } from "./commands/join.js";
 import { identityAction } from "./commands/identity.js";
 import { importAction } from "./commands/import.js";
@@ -183,7 +183,22 @@ program
     // is present; this is how a scripted run, or a developer whose own agent runs setup,
     // says no up front instead of being installed onto.
     .option("--no-install", "Don't install `retasc` on this machine; wire the pinned npx launcher instead")
+    // RTSC-495 — the agent's door. Everything this command normally asks was already
+    // answered in the Dash, so the token stands in for all of it and nothing is prompted.
+    .option("--setup <token>", "Complete setup from a Dash setup code — no sign-in, no prompts")
     .action(async (opts) => {
+    // BEFORE requireLogin: the whole point is a machine that has never signed in. The
+    // token is the authorization, and asking for a session here would refuse every
+    // caller this flag exists for.
+    //
+    // `!== undefined`, not truthiness: `--setup ""` is a stated intent to use a setup
+    // code, and it must fail as a bad code. Falling through to the interactive path
+    // would answer it with "Not signed in", which is the one diagnosis that sends the
+    // reader looking in exactly the wrong place.
+    if (opts.setup !== undefined) {
+        await setupFromToken(opts.setup, opts).catch(fail);
+        return;
+    }
     requireLogin();
     await bindAction(opts).catch(fail);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.17.0",
+  "version": "1.19.0",
   "description": "Retasc CLI \u2014 the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {