@retasc/cli 1.25.0 → 1.26.0

package/CHANGELOG.md

@@ -6,6 +6,21 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.26.0 (2026-08-19)
+
+- **RTSC-670** — `retasc bind` can sign you in again. It has opened with the device flow
+  since 1.20-era, but a leftover session guard in the command wrapper exited first, so on
+  a machine that had never signed in — the only state a new owner is ever in — `bind`
+  printed "Not signed in" and stopped. Owner onboarding dead-ended at its first
+  documented command, on every release for three weeks. The guard was correct when it was
+  written and became redundant the moment `bind` grew its own sign-in; nothing noticed
+  because no test ran the CLI with no session. Four now do.
+- **RTSC-671** — errors name the command you actually ran. Told to `npx @retasc/cli bind`
+  and then answered with "Run `retasc login` first", you were pointed at a binary that
+  invocation never installs — a recoverable stumble turned into a dead end. Every "run X
+  first" message now renders `npx -y @retasc/cli@<version> …` or `retasc …` to match how
+  you started it.
+
 ## 1.25.0 (2026-08-19)
 
 - **RTSC-669** — the invite project picker takes several projects. 1.24.0 shipped it

package/dist/api.js

@@ -2,6 +2,8 @@ import { ConvexHttpClient } from "convex/browser";
 import { makeFunctionReference } from "convex/server";
 import { loadConfig } from "./config.js";
 import { refreshSession, deviceLogin } from "./auth.js";
+import { selfCommand } from "./lib/launcher.js";
+import { VERSION } from "./version.js";
 // Typed-ish references to the public management functions in convex/manage.ts.
 // The CLI is a standalone package, so we reference functions by name rather than
 // importing the parent's generated api.
@@ -163,7 +165,7 @@ async function withAuth(call) {
         if (await refreshSession())
             return await call();
         if (!process.stdout.isTTY) {
-            throw new Error("Session expired and could not refresh. Run `retasc login`.");
+            throw new Error(`Session expired and could not refresh. Run \`${selfCommand(VERSION)} login\`.`);
         }
         console.error("Session expired — re-authenticating with GitHub…");
         await deviceLogin();

package/dist/commands/bind.js

@@ -493,7 +493,7 @@ export async function ensureSignedIn() {
     if (loadConfig().token)
         return;
     if (!isInteractive()) {
-        throw new Error("Not signed in. Run `retasc login` first (no TTY here for the device flow).");
+        throw new Error(`Not signed in. Run \`${selfCommand(VERSION)} login\` first (no TTY here for the device flow).`);
     }
     // RTSC-508: don't name a provider here. `deviceLogin` asks which door, and
     // announcing "GitHub" before the question would be wrong for the invited

package/dist/commands/identity.js

@@ -1,6 +1,8 @@
 import { api } from "../api.js";
 import { clean } from "../lib/text.js";
 import { isInteractive } from "./bind.js";
+import { selfCommand } from "../lib/launcher.js";
+import { VERSION } from "../version.js";
 import { identityLoop } from "./join.js";
 /**
  * Which org's placeholders to offer.
@@ -65,7 +67,7 @@ function report(outcome, orgLabel) {
             console.log("Noted. That covers those tools only, so a later import will ask again.");
             return;
         case "left":
-            console.log("Nothing linked. Run `retasc identity` again whenever you want to look.");
+            console.log(`Nothing linked. Run \`${selfCommand(VERSION)} identity\` again whenever you want to look.`);
             return;
         case "skipped":
             // Only reachable non-interactively; the interactive guard below catches that first.

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { Command } from "commander";
 import { VERSION } from "./version.js";
+import { selfCommand } from "./lib/launcher.js";
 import { loadConfig, patchConfig, saveConfig, configPath, isLoggedIn } from "./config.js";
 import { installMcp, normalizeScope } from "./commands/mcp.js";
 import { installGate, resolveGatePrefix } from "./commands/gate.js";
@@ -25,7 +26,10 @@ program
     .version(VERSION);
 function requireLogin() {
     if (!isLoggedIn()) {
-        console.error("Not signed in. Run `retasc login` first.");
+        // RTSC-671 — `selfCommand` renders the form they actually used. The docs send a
+        // new owner through `npx @retasc/cli`, which never puts `retasc` on PATH, so naming
+        // it here answers a failure with a second `command not found`.
+        console.error(`Not signed in. Run \`${selfCommand(VERSION)} login\` first.`);
         process.exit(1);
     }
 }
@@ -87,7 +91,7 @@ program
     // confirm scope before any work. Resolved from the local key, server-enforced.
     const local = readLocalBinding(process.cwd());
     if (local?.markerOnly) {
-        console.log("This folder → has a Retasc marker but no key on this machine. Run `retasc bind`.\n");
+        console.log(`This folder → has a Retasc marker but no key on this machine. Run \`${selfCommand(VERSION)} bind\`.\n`);
     }
     else if (local) {
         try {
@@ -107,10 +111,10 @@ program
         }
     }
     else {
-        console.log("This folder → not bound. Run `retasc bind`.\n");
+        console.log(`This folder → not bound. Run \`${selfCommand(VERSION)} bind\`.\n`);
     }
     if (!isLoggedIn()) {
-        console.log("Not signed in (management). Run `retasc login` to manage orgs/projects.");
+        console.log(`Not signed in (management). Run \`${selfCommand(VERSION)} login\` to manage orgs/projects.`);
         return;
     }
     try {
@@ -200,7 +204,16 @@ program
         await setupFromToken(opts.setup, opts).catch(fail);
         return;
     }
-    requireLogin();
+    // NO requireLogin here (RTSC-670). `bindAction` opens with `ensureSignedIn`, which
+    // runs the device flow when there is no session — that IS the documented first step
+    // of owner onboarding, and it is the only state a new owner is ever in. This guard
+    // predated that (it was correct in 285ec74, when bindAction had no sign-in of its
+    // own) and `ensureSignedIn` arriving in 72182c3 left it in front of a door it
+    // permanently closed: every `bind` on a fresh machine exited 1 before reaching it.
+    //
+    // `ensureSignedIn` also refuses BETTER — it says why ("no TTY here for the device
+    // flow") where this said only that you weren't signed in, which is the diagnosis
+    // that sends someone looking in the wrong place.
     await bindAction(opts).catch(fail);
 });
 // `retasc doctor` — verify this folder's binding + flag any illegal global server.
@@ -527,7 +540,7 @@ gate
         if (r.source !== "--prefix")
             console.log(`Prefix ${r.prefix} — from ${r.source}.`);
         if (r.source === "global config") {
-            console.log("  (This folder isn't bound — `retasc bind` makes the prefix folder-scoped.)");
+            console.log(`  (This folder isn't bound — \`${selfCommand(VERSION)} bind\` makes the prefix folder-scoped.)`);
         }
         if (r.shadowedDefault) {
             console.log(`  ⚠ Ignoring global default prefix ${r.shadowedDefault} — this folder's binding wins.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.25.0",
+  "version": "1.26.0",
   "description": "Retasc CLI \u2014 the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {