@retasc/cli 1.31.0 → 1.31.1

package/CHANGELOG.md

@@ -6,6 +6,16 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.31.1 (2026-08-23)
+
+- **RTSC-715** — setup no longer finishes by wiring a `retasc` command that is not there.
+  Run as `npx @retasc/cli@latest bind`, the CLI asked whether `retasc` was on your PATH
+  and got yes, because npx puts its own cache directory on the PATH of whatever it runs.
+  So the answer was true while `bind` ran and false the moment it exited, and your agent
+  started with `ENOENT: Executable not found in $PATH: "retasc"` after a setup that had
+  reported success. It now checks that the command it found will still resolve afterwards,
+  and falls back to a global install or a pinned `npx` launcher when it will not.
+
 ## 1.31.0 (2026-08-23)
 
 - **RTSC-713** — your agent can set Retasc up for you. It runs `bind` itself now, so

package/dist/commands/bind.js

@@ -5,7 +5,7 @@ import { loadConfig, patchConfig } from "../config.js";
 import { installMarker, printMarkerBlock } from "./mcp.js";
 import { readLocalBinding, resolveBinding } from "../lib/binding.js";
 import { getBinding, setBinding, newWorkspaceId } from "../lib/keystore.js";
-import { resolveLauncher, launcherNote, runsOk, selfCommand, versionStamp } from "../lib/launcher.js";
+import { resolveLauncher, launcherNote, onDurablePath, selfCommand, versionStamp } from "../lib/launcher.js";
 import { ask, confirm, isInteractive } from "../lib/prompt.js";
 import { clean } from "../lib/text.js";
 import { card, DOT } from "../lib/card.js";
@@ -177,7 +177,10 @@ export async function chooseInstall(
 flag, deps = {}) {
     if (flag === false)
         return false;
-    const onPath = deps.onPath ?? (() => runsOk("retasc") !== null);
+    // RTSC-715 — the same durable-PATH question `resolveLauncher` asks. Under npx a bare
+    // `retasc` resolves into the npx cache, so this shortcut used to conclude "nothing to
+    // install" on a machine that had nothing installed.
+    const onPath = deps.onPath ?? (() => onDurablePath("retasc"));
     // Nothing to install, so nothing to ask.
     if (onPath())
         return true;

package/dist/lib/launcher.js

@@ -37,6 +37,59 @@ export function runsOk(command, args = []) {
     // different program, and pointing a marker at it would be worse than not writing one.
     return /^\d+\.\d+\.\d+/.test(out) ? out : null;
 }
+/**
+ * Is `retasc` on PATH in a way that OUTLIVES this process (RTSC-715)?
+ *
+ * `runsOk("retasc")` answers a subtly different question, and the difference cost a
+ * fresh-machine setup its tools. When `bind` runs under `npx @retasc/cli@latest`, npx puts
+ * its own cache directory on the child's PATH, so `retasc` resolves and runs:
+ *
+ *     outside npx:  which retasc => /Users/me/.npm-global/bin/retasc
+ *     inside  npx:  which retasc => /Users/me/.npm/_npx/ccd2a9…/node_modules/.bin/retasc
+ *
+ * `resolveLauncher` read that as "already usable, leave it alone" and wrote a bare
+ * `retasc` into the marker, marked verified, having genuinely run it. Then npx exited,
+ * that directory left PATH, and the MCP client spawning the proxy got
+ * `ENOENT: Executable not found in $PATH: "retasc"`. Setup reported success, the Dash
+ * showed a healthy workspace, and no tools loaded.
+ *
+ * The probe was not sloppy. It measured the right thing on the wrong PATH: the one `bind`
+ * inherited, rather than the one the agent spawns with later. So resolve the command to a
+ * real path and reject the npx cache, which is transient by construction — the whole point
+ * of `_npx` is that it is not a durable install.
+ *
+ * Resolved with `which`/`where` rather than by walking PATH ourselves: that is the lookup
+ * the shell will actually do, PATHEXT and all, and reimplementing it is how this class of
+ * bug gets a second edition.
+ *
+ * Anything unresolvable answers FALSE, deliberately. Every caller fallback (global install,
+ * absolute path, pinned npx) still produces something that runs, whereas a wrong "yes"
+ * produces a marker that cannot start. The two errors are not symmetric.
+ */
+export function onDurablePath(command = "retasc") {
+    let r;
+    try {
+        r = spawnSync(WIN ? "where" : "which", [command], {
+            encoding: "utf8",
+            shell: WIN,
+            timeout: 60_000,
+        });
+    }
+    catch {
+        return false;
+    }
+    if (r.error || r.status !== 0)
+        return false;
+    // `where` can print several matches; the first is the one that would run.
+    const resolved = (r.stdout || "").trim().split(/\r?\n/)[0]?.trim();
+    if (!resolved)
+        return false;
+    // The npx cache. Separators on both sides, so a project that happens to live in a
+    // directory called `_npx` is not caught by it.
+    if (/[\\/]_npx[\\/]/.test(resolved))
+        return false;
+    return runsOk(resolved) !== null;
+}
 /** npm's global prefix, or null when npm itself can't be run. */
 export function npmGlobalPrefix() {
     let r;
@@ -156,8 +209,12 @@ function installGlobal(version) {
  * anyone asking. It is pinned here for exactly that reason.
  */
 export function resolveLauncher(opts) {
-    // 1. Already usable? Leave it alone.
-    if (runsOk("retasc")) {
+    // 1. Already usable, and still usable after we exit? Leave it alone.
+    //
+    // RTSC-715 — `onDurablePath`, not `runsOk`. Under npx the bare name resolves into the
+    // npx cache, which disappears when the command ends, so this branch used to write a
+    // marker that could not start.
+    if (onDurablePath("retasc")) {
         return { launcher: { command: "retasc", args: [] }, how: "on-path", verified: true };
     }
     const npxLauncher = { command: "npx", args: ["-y", `${PKG}@${opts.version}`] };
@@ -176,7 +233,12 @@ export function resolveLauncher(opts) {
     // 3. Prove it, by running it. An exit code of 0 is not evidence the command resolves:
     //    npm can install happily into a prefix whose bin directory PATH never searches.
     if (!failure) {
-        if (runsOk("retasc")) {
+        // RTSC-715 — `onDurablePath` here too, and this one is the subtler half. Under npx the
+        // bare name still resolves to the npx cache AHEAD of the global bin we just installed
+        // into, so a successful install would have been confirmed by running the wrong binary
+        // and written the same unusable marker. The absolute-path loop below then covers the
+        // real case this branch exists for: installed, but PATH cannot see it.
+        if (onDurablePath("retasc")) {
             return { launcher: { command: "retasc", args: [] }, how: "installed", verified: true };
         }
         // Installed, but PATH can't see it. Name the file directly — this is the case a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.31.0",
+  "version": "1.31.1",
   "description": "Retasc CLI \u2014 the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {