@retasc/cli 1.21.0 → 1.21.1

package/CHANGELOG.md

@@ -6,6 +6,17 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.21.1 (2026-08-10)
+
+- **RTSC-643** — `retasc gate install` keys the gate to **this folder's** project, not the
+  machine-wide default. It used to read `defaultProjectPrefix` (stamped by whichever project
+  you last ran `retasc init` for), so in a bound folder it could install a commit gate keyed
+  to a different project — rejecting every valid commit — while reporting success. It now asks
+  the folder's own binding first (`whoami` over the workspace key, or the keystore's cached
+  prefix offline; a subdirectory run checks the git toplevel too), prints where the prefix
+  came from, warns when the global default disagrees, and only uses the global default when
+  the folder is genuinely unbound. Bound-but-unresolvable fails loudly instead of guessing.
+
 ## 1.21.0 (2026-08-07)
 
 - **RTSC-527** — the re-import warning dates the last import in **your** timezone. The day

package/dist/commands/gate.js

@@ -1,6 +1,81 @@
 import { spawnSync } from "node:child_process";
 import { mkdirSync, writeFileSync, existsSync, chmodSync } from "node:fs";
 import { join, dirname } from "node:path";
+import { resolveMcpConn, readMcpJson, workspacePrefix } from "../lib/claim.js";
+import { claudeLocalRetascEntry } from "../lib/binding.js";
+import { getBinding } from "../lib/keystore.js";
+/** The keystore's stored prefix for the workspace marker at `dir`, if any —
+ *  the offline fallback when the server can't be asked. Entry selection matches
+ *  resolveConn: env workspace id first, then claude-local, then the folder
+ *  marker. The cache answers ONLY for the key the live path would have asked
+ *  (`b.key === conn.key`) — an env-selected key from a different org must not
+ *  inherit this folder's cached prefix. */
+function storedPrefix(dir, conn, env = process.env) {
+    const entry = claudeLocalRetascEntry(dir) ?? readMcpJson(dir)?.mcpServers?.retasc;
+    const wsId = env.RETASC_WORKSPACE || entry?.env?.RETASC_WORKSPACE;
+    const b = wsId ? getBinding(String(wsId)) : undefined;
+    if (!b || b.key !== conn.key)
+        return undefined;
+    return typeof b.prefix === "string" && b.prefix ? b.prefix : undefined;
+}
+/** Server/keystore-derived text is validated BEFORE it's printed or trusted
+ *  (same rule as whoami's control-char strip) — a malformed value is treated
+ *  as unresolved, never echoed to the terminal. */
+function validPrefix(p) {
+    if (typeof p !== "string")
+        return undefined;
+    const up = p.toUpperCase();
+    return PREFIX_RE.test(up) ? up : undefined;
+}
+/** whoami must never hang gate install — same 10s bound as resolveBinding
+ *  (binding.ts), which bare global fetch does not carry. */
+const fetchWithTimeout = (input, init) => fetch(input, { ...init, signal: AbortSignal.timeout(10_000) });
+/**
+ * Resolve the prefix the gate is keyed to, folder-first (RTSC-643). The global
+ * `defaultProjectPrefix` is written only by `retasc init` — it's "whatever
+ * project you last init-ed", which in a bound folder can be a DIFFERENT
+ * workspace's prefix. So the folder's own binding is authoritative (whoami over
+ * the workspace's key, or the keystore's cached prefix offline), and the global
+ * default is consulted only when the folder is unbound. A bound folder whose
+ * prefix can't be resolved fails loudly rather than guessing: a gate keyed to
+ * the wrong project rejects every valid commit and ships to CI.
+ */
+export async function resolveGatePrefix(opts) {
+    // `!== undefined` so `--prefix ""` (an unset shell var) still reaches
+    // installGate's validator and fails loudly instead of silently resolving.
+    if (opts.flag !== undefined)
+        return { prefix: opts.flag.toUpperCase(), source: "--prefix" };
+    const cfgDefault = opts.defaultPrefix?.toUpperCase();
+    // The gate is written at the git toplevel, so when the cwd (a subdirectory)
+    // carries no binding, look at the toplevel too — otherwise a subdir run would
+    // silently fall back to the global default behind a false "isn't bound".
+    const dirs = opts.dir
+        ? [opts.dir]
+        : Array.from(new Set([process.cwd(), repoRoot()].filter((d) => !!d)));
+    let conn;
+    let boundDir = dirs[0];
+    for (const d of dirs) {
+        const c = resolveMcpConn({ env: opts.env, mcpJson: readMcpJson(d), dir: d });
+        if (c.key) {
+            conn = c;
+            boundDir = d;
+            break;
+        }
+    }
+    if (conn) {
+        const live = validPrefix(await workspacePrefix(conn, opts.fetchImpl ?? fetchWithTimeout));
+        const prefix = live ?? validPrefix(storedPrefix(boundDir, conn, opts.env));
+        if (prefix) {
+            const source = live ? "workspace binding" : "workspace binding (cached)";
+            const shadowed = cfgDefault && cfgDefault !== prefix ? cfgDefault : undefined;
+            return shadowed ? { prefix, source, shadowedDefault: shadowed } : { prefix, source };
+        }
+        throw new Error("this folder is bound, but its project prefix couldn't be resolved (server didn't answer, no cached prefix) — pass --prefix <PREFIX>.");
+    }
+    if (cfgDefault)
+        return { prefix: cfgDefault, source: "global config" };
+    throw new Error("no project prefix — pass --prefix <PREFIX>, or bind this folder (`retasc bind`) / run `retasc init` so it's resolved from your project.");
+}
 // Mirror the server's project-prefix rule (convex/manage.ts PREFIX_RE): 2–10
 // chars, A–Z/0–9, letter-first. The prefix is interpolated into a generated
 // bash hook and a YAML grep, so validating here keeps a stray value from

package/dist/index.js

@@ -3,7 +3,7 @@ import { Command } from "commander";
 import { VERSION } from "./version.js";
 import { loadConfig, patchConfig, saveConfig, configPath, isLoggedIn } from "./config.js";
 import { installMcp, normalizeScope } from "./commands/mcp.js";
-import { installGate } from "./commands/gate.js";
+import { installGate, resolveGatePrefix } from "./commands/gate.js";
 import { claimAction } from "./commands/claim.js";
 import { bindAction, setupFromToken } from "./commands/bind.js";
 import { joinAction } from "./commands/join.js";
@@ -491,16 +491,27 @@ const gate = program.command("gate").description("Wire the commit↔issue tracea
 gate
     .command("install")
     .description("Install a prefix-correct commit-msg hook + check-commit-message Action into this repo.")
-    .option("--prefix <PREFIX>", "Project prefix to enforce (default: your configured project)")
+    .option("--prefix <PREFIX>", "Project prefix to enforce (default: this folder's bound project)")
     .option("--no-hook", "Skip the local commit-msg hook (CI Action only)")
     .option("--no-action", "Skip the GitHub Action (local hook only)")
-    .action((opts) => {
+    .action(async (opts) => {
     try {
-        const prefix = (opts.prefix ?? loadConfig().defaultProjectPrefix)?.toUpperCase();
-        if (!prefix) {
-            return fail("no project prefix — pass --prefix <PREFIX>, or run `retasc init`/`login` so it's resolved from your project.");
+        // RTSC-643: folder-first — the binding is the authoritative identity; the
+        // global default (stamped by the last `retasc init`) applies only when the
+        // folder is unbound.
+        const r = await resolveGatePrefix({
+            flag: opts.prefix,
+            defaultPrefix: loadConfig().defaultProjectPrefix,
+        });
+        if (r.source !== "--prefix")
+            console.log(`Prefix ${r.prefix} — from ${r.source}.`);
+        if (r.source === "global config") {
+            console.log("  (This folder isn't bound — `retasc bind` makes the prefix folder-scoped.)");
+        }
+        if (r.shadowedDefault) {
+            console.log(`  ⚠ Ignoring global default prefix ${r.shadowedDefault} — this folder's binding wins.`);
         }
-        installGate({ prefix, layers: { hook: opts.hook, action: opts.action } });
+        installGate({ prefix: r.prefix, layers: { hook: opts.hook, action: opts.action } });
     }
     catch (e) {
         fail(e);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@retasc/cli",
-  "version": "1.21.0",
-  "description": "Retasc CLI \u2014 the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
+  "version": "1.21.1",
+  "description": "Retasc CLI — the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {
     "retasc": "dist/index.js"