@retasc/cli 1.36.1 → 1.38.0

package/CHANGELOG.md

@@ -6,6 +6,53 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.38.0 (2026-08-28)
+
+- **RTSC-780** — `retasc setup` wires Retasc into every MCP harness on the machine, once,
+  and `retasc bind` now runs it for you. Until this release the CLI could wire exactly one
+  harness: it spawned `claude mcp add`, and if that worked it stopped. Codex, Grok and
+  anything else got nothing, which is why an agent bound to the same project as two
+  working Claude Code sessions could sit there unable to claim a single issue.
+  The entry we write names no project and carries no key. The watchdog proxy works out
+  which project it is in from the directory it was spawned in, so one line in a global
+  config is correct in every folder, and the folder still decides the org exactly as
+  before. Adding a harness is one entry in the registry; Claude Code, Codex and Grok ship
+  today, each verified against a real installation rather than a config format from
+  memory.
+  A folder you have not bound yet is now an ordinary state rather than a broken install,
+  so it gets a real answer: the tool call comes back naming the folder and telling you to
+  run `retasc bind` in it. Previously a keyless call surfaced as an authentication or
+  network failure while the CLI's own login was global and still fine, which reads as
+  "the Retasc server is down" and sends you to check a server that is serving everyone
+  else. The server cannot name your folder; the proxy runs in it, so it can.
+  Which folder counts is bounded by the repository: a subdirectory resolves to its repo,
+  and a repo checked out inside a bound directory resolves to nothing. Binding a
+  directory must not quietly bind every unrelated project underneath it.
+  Existing markers are untouched: one naming a workspace id keeps resolving through that
+  id, and keeps priority over the folder.
+
+- **RTSC-781** — `--runtime` now says what it does. It sets the agent's label in the
+  Dash, and it never chose where config was written, but it is offered on the commands
+  that install MCP config and documented with a list of harness names, so
+  `key mint --runtime codex --install` named Codex, wired Claude Code, and said nothing.
+  The help text says label, and the commands that mint a key and write a key-bearing
+  entry now say plainly that they write for this folder only, that a key never belongs
+  in a machine-wide config, and that `retasc setup` is what wires the harness you named.
+
+## 1.37.0 (2026-08-26)
+
+- **RTSC-749** — `retasc triage` reads and approves work filed from outside your org. Work
+  that arrives through a GitHub or GitLab connector is written by whoever can file on that
+  repo, and since RTSC-746 no agent can pick it up until a person has read it and approved
+  it. This is that decision from the terminal: `retasc triage` lists what is waiting,
+  `retasc triage RTSC-42` prints the full body and then asks.
+  It is deliberately hard to automate, because the CLI runs where coding agents run: there
+  is no `--approve` flag, the command refuses to run without an interactive terminal, and
+  confirming means retyping the issue id rather than pressing y. Saying no is as cheap as
+  saying yes (type `reject`) — the safe answer must never be the expensive one. The Dash
+  stays the recommended surface: an agent that can drive a real PTY on your machine could
+  drive this command too, and only logging the CLI out takes that away.
+
 ## 1.36.1 (2026-08-25)
 
 - **RTSC-645** — `retasc gate install` no longer throws away your edits. It rewrites the

package/dist/api.js

@@ -44,6 +44,14 @@ const fns = {
     // imported from X before?" once the progress row is gone.
     latestImport: makeFunctionReference("import:latestImport"),
     importHistory: makeFunctionReference("import:importHistory"),
+    // RTSC-749 — the triage door. These are the ONLY CLI calls that must never be
+    // reachable with an agent key: they are `convex/triage.ts`, which authenticates through
+    // Convex Auth and rejects API keys outright (RTSC-746). The CLI reaches them over the
+    // human's device-flow SESSION, like billing and invites — never over the workspace MCP
+    // key the issue commands use.
+    listQuarantined: makeFunctionReference("triage:listQuarantined"),
+    approveExternal: makeFunctionReference("triage:approveExternal"),
+    rejectExternal: makeFunctionReference("triage:rejectExternal"),
     claimableGhosts: makeFunctionReference("ghosts:claimableGhosts"),
     claimGhost: makeFunctionReference("ghosts:claimGhost"),
     dismissGhostPrompt: makeFunctionReference("ghosts:dismissGhostPrompt"),
@@ -217,6 +225,10 @@ export const api = {
     listImportTargets: (args) => withAuth(() => client().action(fns.listImportTargets, args)),
     listImportStatuses: (args) => withAuth(() => client().action(fns.listImportStatuses, args)),
     listReviewCandidates: (args) => withAuth(() => client().query(fns.listReviewCandidates, args)),
+    // RTSC-749 — see `fns` above for why these ride the user session, not the MCP key.
+    listQuarantined: (args) => withAuth(() => client().query(fns.listQuarantined, args)),
+    approveExternal: (args) => withAuth(() => client().mutation(fns.approveExternal, args)),
+    rejectExternal: (args) => withAuth(() => client().mutation(fns.rejectExternal, args)),
     runImport: (args) => withAuth(() => client().action(fns.runImport, args)),
     latestImport: (args) => withAuth(() => client().query(fns.latestImport, args)),
     importHistory: (args) => withAuth(() => client().query(fns.importHistory, args)),

package/dist/commands/bind.js

@@ -3,6 +3,7 @@ import { api, cliError } from "../api.js";
 import { deviceLogin } from "../auth.js";
 import { loadConfig, patchConfig } from "../config.js";
 import { installMarker, printMarkerBlock } from "./mcp.js";
+import { runSetup } from "./setup.js";
 import { readLocalBinding, resolveBinding, bindingRefused } from "../lib/binding.js";
 import { getBinding, setBinding, removeBinding, newWorkspaceId } from "../lib/keystore.js";
 import { resolveLauncher, launcherNote, onDurablePath, selfCommand, versionStamp } from "../lib/launcher.js";
@@ -450,6 +451,11 @@ export async function completeWorkspaceSetup(args) {
     // Per-folder only (local scope), always watchdog. The marker carries only the
     // workspace id — no secret — so ./.mcp.json is safe to commit.
     const marker = installMarker({ workspaceId, scope: "local", launcher, quiet: true });
+    // RTSC-780: and the once-per-machine half. Idempotent by construction (each adapter
+    // replaces its own entry), so running it on every bind is how a harness installed
+    // AFTER the first bind gets picked up without anyone having to know that `retasc
+    // setup` exists. Quiet: the receipt below names what it wired, in one row.
+    const wired = runSetup({ launcher, quiet: true });
     // Confirm the binding the same way the agent will see it, and print it as the receipt
     // (RTSC-673). Resolved rather than echoed from what we just sent: this is the last
     // chance to notice a folder bound to something other than what was asked for, and a
@@ -470,6 +476,15 @@ export async function completeWorkspaceSetup(args) {
             { label: "Project", value: bound?.name ? `${pfx} ${DOT} ${bound.name}` : pfx },
             { label: "Agent key", value: `${minted.key.slice(0, 14)}…`, note: "never leaves ~/.retasc" },
             { label: "MCP wired", value: marker.where, note: "secret-free, safe to commit" },
+            ...(wired.wired.length
+                ? [
+                    {
+                        label: "Harnesses",
+                        value: wired.wired.map((w) => w.label).join(", "),
+                        note: "every folder",
+                    },
+                ]
+                : []),
         ], `Agents launched here can only ever read or write ${pfx}.`));
     // Only when we could write it nowhere. See printMarkerBlock.
     if (!marker.wroteFile && marker.where === "")
@@ -568,6 +583,12 @@ export async function setupFromToken(token, opts, deps = {}) {
         createdAt: Date.now(),
     });
     (deps.marker ?? installMarker)({ workspaceId, scope: "local", launcher });
+    // RTSC-780 — same once-per-machine wiring on the agent door. This path has no TTY and
+    // no receipt card, so it prints its own line rather than staying silent.
+    const wired = (deps.setup ?? runSetup)({ launcher, quiet: true });
+    if (wired.wired.length) {
+        console.log(`✓ Retasc wired into ${wired.wired.map((w) => w.label).join(", ")}.`);
+    }
     // RTSC-532 — name the PATH, not "this folder". A binding is folder → project, and
     // until this line said which folder, a wrong one was undetectable: the agent still
     // calls in, so the Dash shows success while the folder she actually works in has no

package/dist/commands/mcp.js

@@ -161,6 +161,34 @@ export function writeProjectMcpJson(entry) {
     }
     return path;
 }
+/**
+ * Say plainly that `--runtime` labels an agent and does not choose a harness (RTSC-781).
+ *
+ * The flag reads as a promise. It is offered on the same commands that install MCP
+ * config, it is documented with a list of harness names, and before RTSC-780 the only
+ * thing any of those commands could write was Claude Code. So
+ * `key mint --runtime codex --install` named Codex, wired Claude Code, and said nothing
+ * — and the resulting failure surfaced as "signed in, but the server is unreachable",
+ * which sends you to check a server that is fine and serving other clients.
+ *
+ * The commands that call this mint a key and write a KEY-BEARING entry, which is
+ * deliberately per-folder and Claude-Code-only: a key must never be written into a
+ * machine-global config (RTSC-91). So the honest answer is not to wire the named harness
+ * here, it is to say that this command cannot and name the one that can.
+ *
+ * A note rather than a refusal. By the time this prints, the key is minted and the
+ * Claude Code wiring is real work someone asked for; exiting would throw that away to
+ * make a point. Silence was the bug, not the wiring.
+ */
+export function noteRuntimeIsALabel(runtime) {
+    const r = (runtime ?? "").trim();
+    if (!r || r === "claude-code")
+        return;
+    console.log(`Note: --runtime ${r} sets this agent's LABEL in the Dash. It does not choose where\n` +
+        `config is written. This command writes a key-bearing entry for THIS folder, and a\n` +
+        `key only ever belongs in Claude Code's own config, never in a machine-wide one.\n` +
+        `To wire ${r}, run \`retasc setup\` — secret-free, every harness, every folder.\n`);
+}
 /**
  * Wire the Retasc MCP server into the user's agent. Prefers the `claude` CLI;
  * falls back to writing ./.mcp.json. Always prints the manual block so the user

package/dist/commands/setup.js

@@ -0,0 +1,86 @@
+// RTSC-780: `retasc setup` — wire every MCP harness on this machine, once.
+//
+// The shape this exists to deliver:
+//   once per machine   `retasc setup`, and every harness that is installed gets an entry
+//   once per project   `retasc bind`, and every one of them sees it
+//
+// Nothing harness-specific after that, ever again. The entry written here names no
+// workspace (keystore.AUTO_WORKSPACE), so it is correct in every folder: the proxy
+// resolves the directory it was spawned in against the home keystore at startup. The
+// folder still decides the org, which is the whole routing model (RTSC-91) and the thing
+// a machine-global entry would otherwise break.
+//
+// NOT an npm postinstall hook. Most people reach this CLI through `npx`, which installs
+// nothing (the reason `resolveLauncher` exists, RTSC-493), so a postinstall would never
+// run for them; and writing into somebody's global agent configs from a package install
+// is a thing to do in front of a human, not behind one.
+import { AUTO_WORKSPACE } from "../lib/keystore.js";
+import { HARNESSES, detectHarnesses, tildePath } from "../lib/harness.js";
+import { resolveLauncher, launcherNote } from "../lib/launcher.js";
+import { VERSION } from "../version.js";
+import { card } from "../lib/card.js";
+/** The one entry every harness gets: the watchdog proxy, resolving its own folder. */
+export function autoMarkerEntry(launcher) {
+    return {
+        command: launcher.command,
+        args: [...launcher.args, "mcp-proxy"],
+        env: { RETASC_WORKSPACE: AUTO_WORKSPACE },
+    };
+}
+/**
+ * Wire the auto marker into every detected harness.
+ *
+ * `quiet` is for the call at the end of `bind`, where the bind receipt does the talking.
+ */
+export function runSetup(opts) {
+    const all = opts.harnesses;
+    const resolved = opts.launcher ?? resolveLauncher({ version: VERSION, install: opts.install });
+    if (!opts.launcher) {
+        const note = launcherNote(resolved);
+        if (note)
+            console.log(note);
+    }
+    const entry = autoMarkerEntry(resolved.launcher);
+    const known = all ?? HARNESSES;
+    const present = detectHarnesses(known);
+    const presentIds = new Set(present.map((h) => h.id));
+    const result = {
+        wired: [],
+        failed: [],
+        absent: known.filter((h) => !presentIds.has(h.id)).map((h) => h.label),
+    };
+    for (const h of present) {
+        const outcome = h.install(entry);
+        if (outcome.ok) {
+            result.wired.push({ label: h.label, where: tildePath(outcome.path), replaced: outcome.replaced });
+        }
+        else {
+            result.failed.push({ label: h.label, reason: outcome.reason });
+        }
+    }
+    if (!opts.quiet)
+        printSetup(result);
+    return result;
+}
+/** The receipt. One row per harness, so "what did this just touch" needs no guessing. */
+export function printSetup(r) {
+    if (!r.wired.length && !r.failed.length) {
+        console.log("No MCP harness found on this machine.");
+        console.log("Install Claude Code, Codex or Grok and run `retasc setup` again, or bind a folder\n" +
+            "with `retasc bind` and paste the config block it prints into your own client.");
+        return;
+    }
+    console.log("\n" +
+        card(`✓ Retasc wired into ${r.wired.length} ${r.wired.length === 1 ? "harness" : "harnesses"}`, r.wired.map((w) => ({
+            label: w.label,
+            value: w.where,
+            note: w.replaced ? "updated" : "new",
+        }))));
+    for (const f of r.failed)
+        console.log(`  ! ${f.label}: ${f.reason}`);
+    if (r.absent.length)
+        console.log(`  Not on this machine: ${r.absent.join(", ")}.`);
+    console.log("\nThese entries carry no key and name no project, so they are correct in every folder.\n" +
+        "Run `retasc bind` in a project to say which org it belongs to, then start your agent\n" +
+        "there (or restart it if it's already open).");
+}

package/dist/commands/triage.js

@@ -0,0 +1,171 @@
+import { createInterface } from "node:readline/promises";
+import { api } from "../api.js";
+// ---------------------------------------------------------------------------
+// RTSC-749 — `retasc triage`. Epic RTSC-751.
+//
+// The second human signing surface for the quarantine gate (RTSC-746): external intake is
+// undispatchable until a member reads it and signs it, and plenty of people live in a
+// terminal rather than in the Dash.
+//
+// THE HARD PART, and why this file is careful. The Dash is a browser a human is sitting
+// in. The CLI is a binary on a machine where a CODING AGENT CAN SHELL OUT. If approval
+// were scriptable, an agent that just read a hostile body could approve the next one, and
+// the gate it is standing in front of would protect nothing.
+//
+// The server-side invariant does most of the work: `convex/triage.ts` authenticates
+// through Convex Auth and rejects agent API keys outright, so an agent holding only a
+// workspace MCP key cannot sign, full stop. What remains is an agent shelling out on a
+// machine where a human is already logged into the CLI. These are the client-side
+// defences against that, and they RAISE THE BAR rather than close the hole:
+//
+//   • Refuse a non-interactive stdin/stdout. A harnessed `exec` has no PTY.
+//   • No approve flag. There is no `--approve`, no `--yes`, no `--force` — so there is no
+//     one-liner to smuggle into a command, and no "just add --yes" for anyone to suggest.
+//   • Render the body, then require the identifier RETYPED. Not a y/N: a typed value an
+//     agent would have to have read the screen to produce.
+//   • Echo the content hash of the body just printed, so the server refuses if the text
+//     moved under the reader.
+//
+// RESIDUAL RISK, stated rather than hidden: an agent puppeting a real PTY on a machine
+// with a logged-in CLI defeats the TTY check, and the server cannot tell that apart from
+// a human. The mitigation is revocation (`retasc logout`), and the Dash remains the
+// recommended surface. This is said in the command's own help text too — a defence
+// somebody believes is stronger than it is has already done its damage.
+// ---------------------------------------------------------------------------
+/**
+ * Is a real person at this terminal?
+ *
+ * BOTH streams, deliberately. `stdin` alone is the usual check and it is not enough here:
+ * a harness that pipes output while leaving stdin attached would still be driving a
+ * command whose entire safety story is "a human is reading the screen".
+ */
+function interactive() {
+    return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+/** The SHA-256 the server binds a signature to. Must match `externalContentHash` in
+ *  convex/lib/quarantine.ts EXACTLY, including the length prefixes — a drift here means
+ *  every terminal approval fails with CONTENT_CHANGED on text nobody edited. */
+async function contentHash(title, body) {
+    const canonical = `${title.length}:${title}${body.length}:${body}`;
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonical));
+    return Array.from(new Uint8Array(digest))
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+}
+/** Resolve the org the same way `retasc billing` does: explicit, or the only one. */
+async function resolveOrg(orgId) {
+    const me = await api.me();
+    if (!orgId) {
+        if (me.orgs.length === 0)
+            throw new Error("You're not a member of any org yet.");
+        if (me.orgs.length > 1) {
+            const list = me.orgs.map((o) => `  ${o.id}  ${o.name}${o.slug ? ` (${o.slug})` : ""}`);
+            throw new Error(`Several orgs — pass --org-id <id>:\n${list.join("\n")}`);
+        }
+        orgId = me.orgs[0].id;
+    }
+    const org = me.orgs.find((o) => o.id === orgId);
+    return { orgId: orgId, label: org ? `${org.name}${org.slug ? ` (${org.slug})` : ""}` : String(orgId) };
+}
+/** `retasc triage` — what is waiting. A LIST ONLY: nothing here approves. */
+export async function triageListAction(opts) {
+    const { orgId, label } = await resolveOrg(opts.orgId);
+    const res = await api.listQuarantined({ orgId });
+    const items = res.items ?? [];
+    if (opts.json) {
+        console.log(JSON.stringify({ orgId, items, hasMore: res.hasMore }, null, 2));
+        return;
+    }
+    if (items.length === 0) {
+        console.log(`Nothing waiting in ${label}.`);
+        return;
+    }
+    console.log(`${items.length} ${items.length === 1 ? "issue" : "issues"} filed from outside ${label}, ` +
+        `waiting for you to read and approve ${items.length === 1 ? "it" : "them"}:\n`);
+    for (const i of items) {
+        const who = i.externalAuthor ?? "an unidentified account";
+        console.log(`  ${i.identifier}  ${i.title}`);
+        console.log(`    by ${who}${i.sourceUrl ? ` · ${i.sourceUrl}` : ""}`);
+    }
+    if (res.hasMore)
+        console.log(`\n  …and more. Clear some and run this again.`);
+    // The list deliberately does NOT print bodies. Reading happens one at a time, next to
+    // the decision — a wall of concatenated external text is exactly the thing people skim.
+    console.log(`\nRead one in full, then approve or reject:  retasc triage <ISSUE-ID>`);
+}
+/**
+ * `retasc triage RTSC-42` — render the full body, then ask.
+ *
+ * The whole command is the reading. Everything before the prompt exists to make sure the
+ * person answering it has actually seen the text they are vouching for.
+ */
+export async function triageOneAction(identifier, opts) {
+    // FIRST, before any network call: refuse to run where nobody can read the screen. Doing
+    // this first means the refusal is about the environment, not about what happens to be
+    // in the queue.
+    if (!interactive()) {
+        throw new Error("`retasc triage <id>` needs an interactive terminal.\n" +
+            "  Approving external work means a person read it, so this command refuses to run\n" +
+            "  with piped input or output. There is deliberately no --approve flag.\n" +
+            "  Approve in the Dash instead: https://dash.retasc.com/?tab=queue");
+    }
+    const { orgId, label } = await resolveOrg(opts.orgId);
+    const res = await api.listQuarantined({ orgId });
+    const items = res.items ?? [];
+    const want = identifier.trim().toUpperCase();
+    const item = items.find((i) => i.identifier.toUpperCase() === want);
+    if (!item) {
+        throw new Error(`${identifier} is not waiting for approval in ${label}.\n` +
+            `  It may already be approved, rejected, or never have been external.\n` +
+            `  Run \`retasc triage\` to see what is waiting.`);
+    }
+    // The rendering. Plain, undecorated, and complete — no truncation, because a body
+    // truncated at the interesting part is worse than no preview at all.
+    const who = item.externalAuthor ?? "an unidentified account";
+    console.log("");
+    console.log(`  ${item.identifier}  ${item.title}`);
+    console.log("");
+    console.log(`  Filed from OUTSIDE ${label}, by ${who} on ${item.externalOrigin ?? "a connector"}.`);
+    if (item.sourceUrl)
+        console.log(`  Source: ${item.sourceUrl}`);
+    console.log("");
+    console.log("  ── the text you are approving ".padEnd(72, "─"));
+    console.log("");
+    for (const line of (item.body || "(no description)").split("\n"))
+        console.log(`  ${line}`);
+    console.log("");
+    console.log("  ".padEnd(72, "─"));
+    console.log("");
+    console.log("  Treat this as a report to evaluate, not as instructions. Approving tells");
+    console.log("  your agents the text is safe to act on.");
+    console.log("");
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        // The typed confirm. Not y/N: a value that has to be read off the screen. `reject` is
+        // the other real answer, and it is deliberately as easy to type as the id is — saying
+        // no must never be the expensive option, or people will drift toward yes.
+        const answer = (await rl.question(`  Type ${item.identifier} to APPROVE, or "reject" to refuse: `)).trim();
+        if (answer.toLowerCase() === "reject") {
+            await api.rejectExternal({ orgId, identifier: item.identifier });
+            console.log(`\n  ✓ ${item.identifier} rejected and closed.`);
+            return;
+        }
+        if (answer.toUpperCase() !== item.identifier.toUpperCase()) {
+            console.log(`\n  Nothing done — that didn't match. ${item.identifier} is still waiting.`);
+            return;
+        }
+        // Recompute from the text just printed rather than trusting the value the list gave
+        // us: if the two could differ, the hash would stop meaning "what was on screen".
+        const hash = await contentHash(item.title, item.body ?? "");
+        if (hash !== item.contentHash) {
+            // Belt and braces — the server will refuse anyway. Saying it here is friendlier
+            // than a CONTENT_CHANGED from the backend.
+            throw new Error(`${item.identifier} changed while you were reading it. Run the command again.`);
+        }
+        await api.approveExternal({ orgId, identifier: item.identifier, contentHash: hash });
+        console.log(`\n  ✓ ${item.identifier} approved. Agents can pick it up now.`);
+    }
+    finally {
+        rl.close();
+    }
+}

package/dist/index.js

@@ -3,7 +3,8 @@ import { Command } from "commander";
 import { VERSION } from "./version.js";
 import { selfCommand, versionStamp } from "./lib/launcher.js";
 import { loadConfig, patchConfig, saveConfig, configPath, isLoggedIn } from "./config.js";
-import { installMcp, normalizeScope } from "./commands/mcp.js";
+import { installMcp, noteRuntimeIsALabel, normalizeScope } from "./commands/mcp.js";
+import { runSetup } from "./commands/setup.js";
 import { installGate, resolveGatePrefix } from "./commands/gate.js";
 import { claimAction, releaseAction } from "./commands/claim.js";
 import { bindAction, setupFromToken } from "./commands/bind.js";
@@ -14,6 +15,7 @@ import { identityAction } from "./commands/identity.js";
 import { importAction } from "./commands/import.js";
 import { doctorAction } from "./commands/doctor.js";
 import { billingAction } from "./commands/billing.js";
+import { triageListAction, triageOneAction } from "./commands/triage.js";
 import { isNetworkError, readLocalBinding, resolveBinding } from "./lib/binding.js";
 import { whoamiView, orgCreatedView, projectCreatedView, keyListView, inviteListView, } from "./lib/format.js";
 import { tidyAction, doneAction } from "./commands/tidy.js";
@@ -143,7 +145,7 @@ program
     .requiredOption("--project <name>", "Project name")
     .requiredOption("--prefix <PREFIX>", "Project prefix, e.g. XEN")
     .option("--agent <name>", "Agent member name (default: auto, \"{you}'s {runtime}\")")
-    .option("--runtime <runtime>", "Agent runtime: claude-code | codex | opencode | …", "claude-code")
+    .option("--runtime <runtime>", "Label for this agent in the Dash (claude-code | codex | grok | …). Does NOT choose where MCP config is written — `retasc setup` wires every harness on the machine.", "claude-code")
     .option("--scope <scope>", "MCP install scope: local | project (per-folder only)", "local")
     .option("--no-watchdog", "Wire a plain direct connection instead of the liveness watchdog")
     .action(async (opts) => {
@@ -171,6 +173,7 @@ program
         // is a per-folder act. (The prefix is kept only as a gate convenience.)
         const cfg = patchConfig({ defaultProjectPrefix: project.prefix });
         console.log("");
+        noteRuntimeIsALabel(opts.runtime);
         installMcp({ url: cfg.mcpUrl, key: minted.key, scope: normalizeScope(opts.scope), watchdog: opts.watchdog });
     }
     catch (e) {
@@ -189,7 +192,7 @@ program
     .option("--project <name>", "Create a new project with this name (with --prefix)")
     .option("--prefix <PREFIX>", "Prefix for a new project, e.g. ACME")
     .option("--agent <name>", "Agent member name (default: auto)")
-    .option("--runtime <runtime>", "Agent runtime", "claude-code")
+    .option("--runtime <runtime>", "Label for this agent in the Dash (claude-code | codex | grok | …). Does NOT choose where MCP config is written — `retasc setup` wires every harness on the machine.", "claude-code")
     .option("-y, --yes", "Don't prompt to confirm replacing an existing binding")
     // RTSC-523 — decline the global install without a TTY. `bind`/`join` ask when a human
     // is present; this is how a scripted run, or a developer whose own agent runs setup,
@@ -253,6 +256,27 @@ program
     requireLogin();
     await billingAction({ orgId: opts.orgId, json: opts.json }).catch(fail);
 });
+// RTSC-749 — the terminal half of the quarantine gate (RTSC-746). Sits beside `billing`
+// rather than under `issue`: the `issue` commands go over the workspace MCP key, and this
+// one must go over the HUMAN's session — an agent key cannot sign, by design.
+program
+    .command("triage")
+    .argument("[issue]", "The issue to read and decide on. Omit to list what is waiting.")
+    .description("Read and approve work filed from OUTSIDE your org. Agents can't pick these up until " +
+    "a person approves them, and a person means you: this needs an interactive terminal " +
+    "and there is deliberately no --approve flag. The Dash is the recommended surface " +
+    "(an agent that can drive a real PTY on this machine could drive this command too).")
+    .option("--org-id <id>", "Which org (defaults to your only one).")
+    .option("--json", "List as raw JSON. Listing only — deciding is never scriptable.")
+    .action(async (issue, opts) => {
+    requireLogin();
+    if (issue === undefined) {
+        await triageListAction({ orgId: opts.orgId, json: opts.json }).catch(fail);
+    }
+    else {
+        await triageOneAction(issue, { orgId: opts.orgId }).catch(fail);
+    }
+});
 // --- org / project ---------------------------------------------------------
 const org = program.command("org").description("Manage orgs.");
 org
@@ -316,7 +340,7 @@ key
     .requiredOption("--org-id <id>")
     .requiredOption("--project-id <id>")
     .option("--agent <name>", "Agent member name (default: auto, \"{you}'s {runtime}\")")
-    .option("--runtime <runtime>", "Agent runtime: claude-code | codex | opencode | …", "claude-code")
+    .option("--runtime <runtime>", "Label for this agent in the Dash (claude-code | codex | grok | …). Does NOT choose where MCP config is written — `retasc setup` wires every harness on the machine.", "claude-code")
     .option("--name <label>", "Key label")
     .option("--install", "Also wire the key into your agent via MCP")
     .option("--scope <scope>", "MCP install scope if --install: local | project", "local")
@@ -335,6 +359,7 @@ key
         if (opts.install) {
             const cfg = loadConfig();
             console.log("");
+            noteRuntimeIsALabel(opts.runtime);
             installMcp({ url: cfg.mcpUrl, key: res.key, scope: normalizeScope(opts.scope), watchdog: true });
         }
     }
@@ -471,7 +496,7 @@ program
     .option("--no-bind", "Redeem only — don't set this folder up")
     .option("--project-id <id>", "Which project to bind to (skips the picker)")
     .option("--agent <name>", "Agent member name (default: auto)")
-    .option("--runtime <runtime>", "Agent runtime", "claude-code")
+    .option("--runtime <runtime>", "Label for this agent in the Dash (claude-code | codex | grok | …). Does NOT choose where MCP config is written — `retasc setup` wires every harness on the machine.", "claude-code")
     // RTSC-477 — name the way back. `--yes` skips the identity question and must never answer
     // it, so the flag that causes the gap is the right place to say how to close it.
     .option("-y, --yes", "Don't prompt to replace an existing binding, and skip the identity question (ask it later with `retasc identity`)")
@@ -519,6 +544,17 @@ program
     await importAction({ orgId: opts.orgId, source: opts.source, yes: opts.yes }).catch(fail);
 });
 // --- mcp wiring ------------------------------------------------------------
+// RTSC-780 — the once-per-machine half of setup. `bind` runs this itself the first
+// time, so most people never type it; it exists on its own for the second harness
+// installed after a bind, and for re-running after an upgrade moved the launcher.
+program
+    .command("setup")
+    .description("Detect the MCP harnesses on this machine and wire Retasc into each, once.")
+    .option("--no-install", "Don't install `retasc` on this machine; wire the pinned npx launcher instead")
+    .allowExcessArguments(false)
+    .action((opts) => {
+    runSetup({ install: opts.install });
+});
 const mcp = program.command("mcp").description("Wire the Retasc MCP server into your agent.");
 mcp
     .command("install")

package/dist/lib/harness.js

@@ -0,0 +1,236 @@
+// RTSC-780: the harness registry. One entry per MCP client we know how to wire.
+//
+// Before this file the CLI could wire exactly one harness: `installMcp`/`installMarker`
+// spawned `claude mcp add` and, if that failed, wrote ./.mcp.json. Everything else got
+// nothing, which is why Codex had never worked in any project on any machine. The only
+// non-Claude binding that ever existed here was hand-written into ~/.grok/config.toml by
+// an agent, machine-global with an inline API key — the exact cross-org leak `normalizeScope`
+// refuses to allow for Claude Code.
+//
+// The entry we write is the `auto` marker (keystore.AUTO_WORKSPACE): no key, no workspace
+// id, nothing folder-specific. That is what makes ONE write per harness enough for every
+// project, and it is only safe because the harnesses verified below spawn stdio servers
+// with cwd set to the project directory, so the proxy can resolve the folder itself.
+//
+// Adding a harness is one entry in HARNESSES. Deliberately NOT populated from theory:
+// each entry here was checked against a real installation. Cursor, Windsurf, Gemini CLI,
+// OpenCode and VS Code all have a known config shape and belong here, but writing an
+// unverified serializer into somebody's global agent config is not a thing to ship on a
+// guess — they go in as each is confirmed.
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+/**
+ * The home directory harness configs are resolved under.
+ *
+ * `RETASC_HOME` overrides it, the same escape hatch `keystore.ts` gives with
+ * `RETASC_DIR` and for the same reason: without one, anything that exercises this
+ * module writes into the developer's REAL global agent configs. That is not
+ * hypothetical — it happened while building this, and the tell was `retasc setup`
+ * reporting "replaced" on a Codex config that had never held a retasc entry.
+ * A test that can silently reconfigure the machine it runs on is a worse bug than
+ * whatever it was testing.
+ */
+function home() {
+    return process.env.RETASC_HOME || homedir();
+}
+/** `/Users/me/.codex/config.toml` → `~/.codex/config.toml`, for receipts. The card's
+ *  value column is 20 columns wide, and an absolute path ellipses away to nothing
+ *  useful exactly where the reader is checking WHICH file we touched. */
+export function tildePath(p) {
+    const h = home();
+    return p.startsWith(h + "/") ? `~${p.slice(h.length)}` : p;
+}
+export const SERVER_NAME = "retasc";
+// --- shared helpers ---------------------------------------------------------
+/**
+ * True when `bin` resolves on PATH.
+ *
+ * This DOES run a shell (`command -v` is a shell builtin, not an executable), so the
+ * argument is concatenated into a command string and a name carrying `;` or a space
+ * would be a command injection. Every caller passes a literal from HARNESSES below,
+ * but "the only caller today is safe" is how that stops being true, so the shape of
+ * the name is checked here rather than trusted.
+ */
+export function onPath(bin) {
+    if (!/^[a-zA-Z0-9._-]+$/.test(bin))
+        return false;
+    const r = spawnSync("command", ["-v", bin], { encoding: "utf8", shell: "/bin/sh" });
+    return r.status === 0 && Boolean((r.stdout || "").trim());
+}
+function readIfExists(path) {
+    try {
+        return existsSync(path) ? readFileSync(path, "utf8") : "";
+    }
+    catch {
+        return "";
+    }
+}
+/** Write, creating the parent directory. Config files can hold nothing secret by
+ *  design (the marker is secret-free), so no 0600 dance is needed here — but we
+ *  also never widen an existing file's mode, so an existing 0600 config stays 0600. */
+function writeConfig(path, text) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, text, "utf8");
+}
+// --- TOML (Codex, Grok) -----------------------------------------------------
+/**
+ * Splice one table (and its sub-tables) into a TOML document, in place.
+ *
+ * Deliberately textual rather than parse-and-reserialize. These are the user's own
+ * global config files: they hold comments, hand-chosen ordering, and settings that
+ * have nothing to do with us. A round-trip through a TOML parser would silently
+ * rewrite all of that, and the CLI ships with two dependencies (commander, convex)
+ * precisely so it stays cheap to install — adding a TOML library to reformat
+ * somebody's config is the wrong trade twice over.
+ *
+ * Replaces every existing `[prefix]` / `[prefix.*]` table, then appends `block`.
+ * A table ends at the next line that starts a different table at column 0.
+ */
+export function spliceTomlTable(text, prefix, block) {
+    const lines = text.split("\n");
+    const out = [];
+    let skipping = false;
+    const opens = (line) => {
+        const m = line.match(/^\s*\[\[?([^\]]+)\]\]?\s*$/);
+        return m ? m[1].trim() : null;
+    };
+    for (const line of lines) {
+        const table = opens(line);
+        if (table !== null) {
+            // A new table header always ends whatever we were skipping.
+            skipping = table === prefix || table.startsWith(`${prefix}.`);
+        }
+        if (!skipping)
+            out.push(line);
+    }
+    // Collapse the blank-line run the removal may have left at the end, so repeated
+    // installs don't grow the file by one newline every time.
+    while (out.length && out[out.length - 1].trim() === "")
+        out.pop();
+    const body = out.join("\n");
+    return `${body}\n\n${block.trim()}\n`;
+}
+/** The `[mcp_servers.retasc]` block, in the shape Codex and Grok both accept. */
+export function tomlBlock(entry) {
+    const arr = entry.args.map((a) => JSON.stringify(a)).join(", ");
+    const env = Object.entries(entry.env)
+        .map(([k, v]) => `${k} = ${JSON.stringify(v)}`)
+        .join("\n");
+    return [
+        `[mcp_servers.${SERVER_NAME}]`,
+        `command = ${JSON.stringify(entry.command)}`,
+        `args = [${arr}]`,
+        `enabled = true`,
+        ``,
+        `[mcp_servers.${SERVER_NAME}.env]`,
+        env,
+    ].join("\n");
+}
+function tomlHarness(id, label, path, bin) {
+    return {
+        id,
+        label,
+        configPath: path,
+        detect: () => existsSync(path()) || onPath(bin),
+        install(entry) {
+            const p = path();
+            const before = readIfExists(p);
+            try {
+                writeConfig(p, spliceTomlTable(before, `mcp_servers.${SERVER_NAME}`, tomlBlock(entry)));
+            }
+            catch (e) {
+                return { ok: false, reason: String(e?.message ?? e) };
+            }
+            return { ok: true, path: p, replaced: /^\s*\[\[?mcp_servers\.retasc\b/m.test(before) };
+        },
+    };
+}
+// --- JSON (./.mcp.json in the folder) ---------------------------------------
+/** Merge the retasc entry into a `{ mcpServers: {…} }` document, leaving every
+ *  other server and unknown key byte-for-byte where it was. */
+export function mergeMcpServers(before, entry) {
+    let doc = {};
+    if (before.trim()) {
+        try {
+            doc = JSON.parse(before);
+        }
+        catch {
+            doc = {};
+        }
+    }
+    doc.mcpServers = doc.mcpServers ?? {};
+    doc.mcpServers[SERVER_NAME] = entry;
+    return JSON.stringify(doc, null, 2) + "\n";
+}
+// --- Claude Code ------------------------------------------------------------
+/**
+ * Claude Code is the one harness with a real CLI for this, and `claude mcp add` is
+ * the ONLY sanctioned way to edit `~/.claude.json`: a running Claude Code rewrites
+ * that file constantly, so a read-modify-write from here would race it and could
+ * drop unrelated servers.
+ *
+ * Scope `user` here, which `normalizeScope` refuses everywhere else (RTSC-91). The
+ * refusal is about a global entry that NAMES an org — an id or a key in a
+ * machine-wide file routes every folder to one project. The `auto` marker names
+ * nothing, so the objection does not apply to it, and the whole point of RTSC-780
+ * is that this entry is written once and serves every folder.
+ */
+const claudeCode = {
+    id: "claude-code",
+    label: "Claude Code",
+    configPath: () => join(home(), ".claude.json"),
+    // A test home means "do not touch this machine's real config". `claude mcp add`
+    // writes ~/.claude.json wherever HOME points, so the override has to gate DETECTION,
+    // not just the path: an undetected harness is never installed into.
+    detect: () => !process.env.RETASC_HOME && onPath("claude"),
+    install(entry) {
+        const args = [
+            "mcp", "add",
+            SERVER_NAME,
+            "--transport", "stdio",
+            "--scope", "user",
+            ...Object.entries(entry.env).flatMap(([k, v]) => ["--env", `${k}=${v}`]),
+            "--", entry.command, ...entry.args,
+        ];
+        // An existing user-scope entry makes `add` fail rather than replace, so clear it
+        // first. Best effort: a missing entry exits non-zero and that is fine.
+        //
+        // This does open a remove-then-fail window: if `add` fails after a successful
+        // remove, the user is left with no retasc entry rather than the one they had. The
+        // blast radius is bounded to OUR entry (the name is fixed, and `-s user` scopes it),
+        // the outcome is reported rather than swallowed, and `retasc setup` re-runs cleanly.
+        // Restoring the previous entry would mean reading ~/.claude.json ourselves, which is
+        // the one thing that file must never have done to it: a running Claude Code rewrites
+        // it constantly and the read-modify-write would race it.
+        const had = spawnSync("claude", ["mcp", "remove", SERVER_NAME, "-s", "user"], {
+            encoding: "utf8",
+        });
+        const r = spawnSync("claude", args, { encoding: "utf8" });
+        if (r.error)
+            return { ok: false, reason: r.error.message };
+        if (r.status !== 0) {
+            const msg = (r.stderr || r.stdout || "").trim().split("\n")[0] || `exited ${r.status}`;
+            return { ok: false, reason: msg };
+        }
+        return { ok: true, path: "Claude Code (user scope)", replaced: had.status === 0 };
+    },
+};
+// --- the registry -----------------------------------------------------------
+export const HARNESSES = [
+    claudeCode,
+    tomlHarness("codex", "Codex", () => join(home(), ".codex", "config.toml"), "codex"),
+    tomlHarness("grok", "Grok", () => join(home(), ".grok", "config.toml"), "grok"),
+];
+/** Every harness actually present on this machine. */
+export function detectHarnesses(list = HARNESSES) {
+    return list.filter((h) => {
+        try {
+            return h.detect();
+        }
+        catch {
+            return false;
+        }
+    });
+}

package/dist/lib/keystore.js

@@ -1,5 +1,5 @@
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { mkdirSync, readFileSync, writeFileSync, existsSync, chmodSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 /** The dir the keystore lives in. RETASC_DIR overrides it (tests, sandboxes). */
@@ -52,12 +52,87 @@ export function removeBinding(workspaceId) {
 export function newWorkspaceId() {
     return `ws_${randomUUID()}`;
 }
+/**
+ * RTSC-780: the sentinel that means "work out the workspace from where you were
+ * spawned", rather than naming one.
+ *
+ * A marker carrying a real `ws_…` id names ONE workspace, so an entry holding it
+ * is only ever correct in the folder it was written for. That is why there is no
+ * global scope today (RTSC-91): a machine-wide entry with an id in it would route
+ * every folder on the disk to one org. `auto` carries no identity at all, so an
+ * entry holding it IS safe to write once, machine-wide, into every harness — the
+ * proxy resolves the folder it was spawned in against the keystore at startup and
+ * the org still comes from the folder, exactly as before.
+ *
+ * Not a possible collision: ids are `ws_`-prefixed uuids.
+ */
+export const AUTO_WORKSPACE = "auto";
+/**
+ * Which binding covers this directory? (RTSC-780)
+ *
+ * Walks UP from `dir`, matching `boundPath` at each level, so an agent spawned in
+ * a subdirectory of a bound project resolves to that project instead of to
+ * nothing. The walk is what makes `auto` usable in practice: harnesses spawn a
+ * stdio server in the project root, but not every one of them, and a human running
+ * `retasc claim` from `src/` should not be told the folder is unbound.
+ *
+ * Paths are compared resolved, so `/tmp` vs `/private/tmp` and a trailing slash
+ * don't produce a false miss.
+ *
+ * Newest wins when two ids claim the same path. A re-bind normally REUSES the
+ * folder's existing id (bind.ts), but a folder bound, unbound and bound again
+ * leaves an older entry behind, and the fresher one is the live binding.
+ *
+ * The walk STOPS at the repository root, and that bound is load-bearing rather than
+ * tidiness. An unbounded walk means binding a directory binds everything beneath it:
+ * run `retasc bind` once in `~/Development` (or `~`) and every project under it
+ * silently starts acting in that org, with no marker in those folders saying so and
+ * nothing on screen to notice. That is the cross-org leak this whole design exists to
+ * avoid (RTSC-91), reintroduced through the back door. A repository is the unit a
+ * person means by "project", so it is the unit the walk is allowed to cross: `src/lib`
+ * resolves to its repo, and a sibling repo checked out inside a bound directory
+ * resolves to nothing.
+ *
+ * Detected by the presence of `.git`, which is a FILE in a worktree and a directory in
+ * a normal clone, so `existsSync` is the right test for both.
+ */
+export function findBindingByPath(dir) {
+    const bindings = loadKeystore().bindings;
+    // Index by resolved boundPath once, keeping the newest per path.
+    const byPath = new Map();
+    for (const [workspaceId, entry] of Object.entries(bindings)) {
+        if (!entry?.boundPath)
+            continue;
+        const key = resolve(entry.boundPath);
+        const prev = byPath.get(key);
+        if (!prev || (entry.createdAt ?? 0) > (prev.entry.createdAt ?? 0)) {
+            byPath.set(key, { workspaceId, entry });
+        }
+    }
+    let cur = resolve(dir);
+    // Bounded twice: by the repository root (below), and by the filesystem root, since
+    // `dirname("/")` is `"/"` and ends the loop for a directory outside any repo.
+    for (;;) {
+        const hit = byPath.get(cur);
+        if (hit)
+            return hit;
+        // Checked AFTER the lookup so the repo root itself, the folder `bind` actually
+        // writes, is always eligible.
+        if (existsSync(join(cur, ".git")))
+            return undefined;
+        const up = dirname(cur);
+        if (up === cur)
+            return undefined;
+        cur = up;
+    }
+}
 /**
  * RTSC-98: the ONE place that resolves a workspace's key + MCP url. Shared by the
  * proxy (env-based) and the direct commands `claim`/`tidy`/`done` (.mcp.json-based)
  * so the two paths can never drift again. Precedence: explicit `RETASC_MCP_KEY`
  * env → legacy inline key in the marker (env or Authorization header) → canonical
- * secret-free marker (`RETASC_WORKSPACE` → home keystore). `mcpEntry` is a
+ * secret-free marker (`RETASC_WORKSPACE` → home keystore, or `auto` → this
+ * process's cwd → home keystore). `mcpEntry` is a
  * workspace `.mcp.json`'s `mcpServers.retasc` entry, or undefined when only the
  * environment carries the binding (the spawned proxy).
  *
@@ -97,15 +172,23 @@ export function resolveConn(opts) {
     }
     // Canonical (RTSC-92): secret-free marker → workspace id → home keystore.
     // The entry's url is deliberately NOT consulted on this branch.
+    //
+    // RTSC-780 adds one more step in front of the id: `auto` names no workspace, so
+    // the folder we were spawned in picks it. Same trust rule either way — the key
+    // came from the keystore, so it travels only to the keystore's url. That is what
+    // lets `auto` be written into a GLOBAL harness config: the entry is identical on
+    // every machine and in every folder, and carries nothing worth stealing.
     if (!key) {
         const wsId = env.RETASC_WORKSPACE || entry?.env?.RETASC_WORKSPACE;
-        if (wsId) {
-            const b = getBinding(String(wsId));
-            if (b) {
-                key = b.key;
-                if (!url)
-                    url = b.url;
-            }
+        const b = wsId === AUTO_WORKSPACE
+            ? findBindingByPath(opts.cwd ?? process.cwd())?.entry
+            : wsId
+                ? getBinding(String(wsId))
+                : undefined;
+        if (b) {
+            key = b.key;
+            if (!url)
+                url = b.url;
         }
     }
     return { key, url: url || opts.defaultUrl || "" };

package/dist/proxy.js

@@ -12,7 +12,7 @@ import { spawn, spawnSync } from "node:child_process";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { applyObservation, heartbeatRequest, isClaimLost, isUnauthorized, shouldReapOnClose, untrackedLeaseWarning, } from "./lib/watchdog.js";
-import { resolveConn } from "./lib/keystore.js";
+import { AUTO_WORKSPACE, resolveConn } from "./lib/keystore.js";
 import { toolResult as parseTool } from "./lib/toolresult.js";
 import { mintSessionKey, appendFallbackNotice } from "./lib/session.js";
 import { attachRoot, isLocalAttachCall, mergeAttachTool, resolveAttachPath, uploadFailureMessage, uploadUrlWith, } from "./lib/attachFile.js";
@@ -23,6 +23,21 @@ import { MAX_FETCH_BYTES, downloadFailureMessage, existingDownload, isLocalFetch
 const resolved = resolveConn({ env: process.env, defaultUrl: "https://mcp.retasc.com/mcp" });
 let MCP_URL = resolved.url;
 const KEY = resolved.key;
+// RTSC-780: with the `auto` marker the SAME entry is wired into every harness, once, and
+// is therefore present in folders that were never bound. That is no longer a broken
+// install, it is the ordinary state of a folder you haven't run `retasc bind` in yet, so
+// it needs an answer rather than a 401.
+//
+// Getting this wrong is what RTSC-781 is about. Forwarding keyless requests produces an
+// auth failure, and the CLI's own login is global and still fine, so the agent reports
+// "signed in, but the server is unreachable" and a human goes and checks a server that
+// was serving other clients the whole time. The folder is the thing that is missing, so
+// the folder is what the error has to name.
+const UNBOUND = !KEY && (process.env.RETASC_WORKSPACE ?? "") === AUTO_WORKSPACE ? process.cwd() : null;
+const UNBOUND_MESSAGE = `This folder (${UNBOUND ?? process.cwd()}) is not bound to a Retasc project, so there is ` +
+    `nothing to pull work from. Nothing is wrong with your sign-in or with the Retasc server. ` +
+    `Run \`retasc bind\` in this folder to say which org and project it belongs to, then restart ` +
+    `this agent so it picks the binding up.`;
 const HEARTBEAT_MS = Number(process.env.RETASC_HEARTBEAT_MS) || 10 * 60 * 1000;
 const leases = new Map();
 let hbSeq = -1; // out-of-band heartbeat ids are negative — never collide with the harness's
@@ -408,6 +423,18 @@ async function handleLine(line) {
     // context), so every call to the tool is served here rather than forwarded.
     if (isLocalFetchCall(msg))
         return await handleLocalFetch(msg);
+    // RTSC-780: an unbound folder answers every tool call itself. `initialize` and
+    // `tools/list` still go remote, so the agent starts cleanly and can SEE the tools —
+    // the failure has to arrive at the moment one is used, worded as the folder problem
+    // it is, rather than as a startup crash the harness reports as "server unreachable".
+    if (UNBOUND && msg.method === "tools/call" && msg.id !== undefined) {
+        process.stdout.write(JSON.stringify({
+            jsonrpc: "2.0",
+            id: msg.id,
+            result: { content: [{ type: "text", text: UNBOUND_MESSAGE }], isError: true },
+        }) + "\n");
+        return;
+    }
     let resp;
     try {
         resp = await postRemote(msg);
@@ -505,7 +532,9 @@ async function heartbeatAll() {
 }
 /** Run the stdio proxy. Started by the harness; lives as long as the session. */
 export async function runProxy() {
-    if (!KEY)
+    if (UNBOUND)
+        log(UNBOUND_MESSAGE);
+    else if (!KEY)
         log("warning: RETASC_MCP_KEY is empty — forwarded requests will be unauthorized");
     // Adopt a per-session key BEFORE serving traffic, so even the first claim is
     // attributed to this session. stdin buffers in the OS pipe meanwhile.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.36.1",
+  "version": "1.38.0",
   "description": "Retasc CLI — the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {
@@ -40,7 +40,7 @@
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",
-    "test": "npm run build && node --test test/*.test.mjs",
+    "test": "npm run build && node --test --import ./test/_test-home.mjs test/*.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {