@retasc/cli 1.28.0 → 1.29.0

package/CHANGELOG.md

@@ -6,6 +6,17 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.29.0 (2026-08-19)
+
+- **RTSC-672** — every command we hand out now says `npx @retasc/cli@latest`. npx caches
+  by spec, so a bare `npx @retasc/cli` can keep serving whatever version you first ran —
+  which meant the people most likely to re-run a command, the ones who hit a bug and were
+  told it was fixed, were exactly the ones liable to be served the broken build again.
+  `@latest` is a tag, not a pin: it re-resolves every time and can never go stale, where a
+  version number written into docs absolutely can.
+- **RTSC-672** — a first-run failure names the build that produced it, so "it still
+  doesn't work" and "you're running last week's CLI" stop looking identical.
+
 ## 1.28.0 (2026-08-19)
 
 - **RTSC-676** — signing in opens your browser. It used to print a URL and an

package/dist/commands/bind.js

@@ -5,7 +5,7 @@ import { loadConfig, patchConfig } from "../config.js";
 import { installMarker, printMarkerBlock } from "./mcp.js";
 import { readLocalBinding, resolveBinding } from "../lib/binding.js";
 import { getBinding, setBinding, newWorkspaceId } from "../lib/keystore.js";
-import { resolveLauncher, launcherNote, runsOk, selfCommand } from "../lib/launcher.js";
+import { resolveLauncher, launcherNote, runsOk, selfCommand, versionStamp } from "../lib/launcher.js";
 import { ask, confirm, isInteractive } from "../lib/prompt.js";
 import { clean } from "../lib/text.js";
 import { card, DOT } from "../lib/card.js";
@@ -563,7 +563,11 @@ export async function ensureSignedIn() {
     if (loadConfig().token)
         return;
     if (!isInteractive()) {
-        throw new Error(`Not signed in. Run \`${selfCommand(VERSION)} login\` first (no TTY here for the device flow).`);
+        // RTSC-672 — the stamp rides in the HINT, not the message. `formatError` keeps only
+        // the first line of a message (deliberately, to strip stack noise), so a second line
+        // here would be silently dropped — which is how a diagnostic aimed at silent failures
+        // would itself fail silently.
+        cliError("UNAUTHENTICATED", `Not signed in. Run \`${selfCommand(VERSION)} login\` first (no TTY here for the device flow).`, versionStamp(VERSION).trim());
     }
     // RTSC-508: don't name a provider here. `deviceLogin` asks which door, and
     // announcing "GitHub" before the question would be wrong for the invited

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { Command } from "commander";
 import { VERSION } from "./version.js";
-import { selfCommand } from "./lib/launcher.js";
+import { selfCommand, versionStamp } from "./lib/launcher.js";
 import { loadConfig, patchConfig, saveConfig, configPath, isLoggedIn } from "./config.js";
 import { installMcp, normalizeScope } from "./commands/mcp.js";
 import { installGate, resolveGatePrefix } from "./commands/gate.js";
@@ -27,9 +27,13 @@ program
 function requireLogin() {
     if (!isLoggedIn()) {
         // RTSC-671 — `selfCommand` renders the form they actually used. The docs send a
-        // new owner through `npx @retasc/cli`, which never puts `retasc` on PATH, so naming
+        // new owner through `npx @retasc/cli@latest`, which never puts `retasc` on PATH, so naming
         // it here answers a failure with a second `command not found`.
         console.error(`Not signed in. Run \`${selfCommand(VERSION)} login\` first.`);
+        // RTSC-672 — say which build spoke. A stale CLI and a broken one produce the same
+        // sentence otherwise, and the people most likely to re-run this are the ones who
+        // were just told a fix shipped.
+        console.error(versionStamp(VERSION));
         process.exit(1);
     }
 }
@@ -403,7 +407,7 @@ members
         // them in, binds the folder and wires their agent, so this must not tell them to run
         // `retasc login` first — nor name a `retasc` binary they don't have yet.
         console.log(`  Share it. In the folder their agent works in, they run:`);
-        console.log(`      npx @retasc/cli join ${res.code}`);
+        console.log(`      npx @retasc/cli@latest join ${res.code}`);
     }
     catch (e) {
         fail(e);

package/dist/lib/launcher.js

@@ -96,6 +96,25 @@ export function portableLauncher(r, version) {
 export function selfCommand(version, argv1 = process.argv[1] ?? "") {
     return /[\\/]_npx[\\/]/.test(argv1) ? `npx -y ${PKG}@${version}` : "retasc";
 }
+/**
+ * A one-line stamp of which build just spoke (RTSC-672).
+ *
+ * A failure report is only diagnosable if it says what produced it. After 1.26.0 fixed
+ * sign-in, a container kept printing the 1.25.0 message and the only way to learn why was
+ * a round trip asking someone to run `--version` — because nothing in the output said.
+ * Worse, the population most likely to re-run a command is the population that hit a bug
+ * and was told it is fixed, which is exactly the population liable to be holding a stale
+ * build. "It still doesn't work" and "you are running last week's CLI" look identical
+ * without this.
+ *
+ * The EXACT version, not `@latest`: this names the code that emitted the message, which
+ * is a different question from how to fetch the current one. `npx` in the prefix when
+ * that is how they started, so the line doubles as a runnable command.
+ */
+export function versionStamp(version, argv1 = process.argv[1] ?? "") {
+    const how = /[\\/]_npx[\\/]/.test(argv1) ? `npx ${PKG}@${version}` : `${PKG} ${version}`;
+    return `  (${how})`;
+}
 /** Install (or upgrade to) an exact version globally. Returns null on success. */
 function installGlobal(version) {
     // A cold global install takes seconds with no output of its own. Silence here reads as

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.28.0",
+  "version": "1.29.0",
   "description": "Retasc CLI \u2014 the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {