@retasc/cli 1.37.0 → 1.38.1

package/CHANGELOG.md

@@ -6,6 +6,54 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.38.1 (2026-08-28)
+
+- **RTSC-780 follow-up** — `retasc init` now sets a folder up the same way every other
+  door does. 1.38.0 taught `bind`, `join` and `bind --setup` to wire every harness on the
+  machine, but `init` kept its own copy of that work: it minted a key and wrote a
+  key-bearing entry for Claude Code and nothing else. So the one command named onboarding
+  was the one that still left Codex with no Retasc tools, which is the exact failure
+  1.38.0 exists to end.
+  Fixed by deleting the duplicate rather than teaching it the same trick. Everything after
+  the org is now `bind`'s job, which also means `init` writes the keystore binding an
+  `auto` marker resolves against, guards a folder that is already bound instead of
+  overwriting it, and prints the same receipt.
+  `--scope` and `--no-watchdog` are gone from `init`: both described the shape of an entry
+  it no longer writes. `-y/--yes` and `--no-install` are there instead, matching `bind`.
+
+## 1.38.0 (2026-08-28)
+
+- **RTSC-780** — `retasc setup` wires Retasc into every MCP harness on the machine, once,
+  and `retasc bind` now runs it for you. Until this release the CLI could wire exactly one
+  harness: it spawned `claude mcp add`, and if that worked it stopped. Codex, Grok and
+  anything else got nothing, which is why an agent bound to the same project as two
+  working Claude Code sessions could sit there unable to claim a single issue.
+  The entry we write names no project and carries no key. The watchdog proxy works out
+  which project it is in from the directory it was spawned in, so one line in a global
+  config is correct in every folder, and the folder still decides the org exactly as
+  before. Adding a harness is one entry in the registry; Claude Code, Codex and Grok ship
+  today, each verified against a real installation rather than a config format from
+  memory.
+  A folder you have not bound yet is now an ordinary state rather than a broken install,
+  so it gets a real answer: the tool call comes back naming the folder and telling you to
+  run `retasc bind` in it. Previously a keyless call surfaced as an authentication or
+  network failure while the CLI's own login was global and still fine, which reads as
+  "the Retasc server is down" and sends you to check a server that is serving everyone
+  else. The server cannot name your folder; the proxy runs in it, so it can.
+  Which folder counts is bounded by the repository: a subdirectory resolves to its repo,
+  and a repo checked out inside a bound directory resolves to nothing. Binding a
+  directory must not quietly bind every unrelated project underneath it.
+  Existing markers are untouched: one naming a workspace id keeps resolving through that
+  id, and keeps priority over the folder.
+
+- **RTSC-781** — `--runtime` now says what it does. It sets the agent's label in the
+  Dash, and it never chose where config was written, but it is offered on the commands
+  that install MCP config and documented with a list of harness names, so
+  `key mint --runtime codex --install` named Codex, wired Claude Code, and said nothing.
+  The help text says label, and the commands that mint a key and write a key-bearing
+  entry now say plainly that they write for this folder only, that a key never belongs
+  in a machine-wide config, and that `retasc setup` is what wires the harness you named.
+
 ## 1.37.0 (2026-08-26)
 
 - **RTSC-749** — `retasc triage` reads and approves work filed from outside your org. Work

package/dist/commands/bind.js

@@ -3,6 +3,7 @@ import { api, cliError } from "../api.js";
 import { deviceLogin } from "../auth.js";
 import { loadConfig, patchConfig } from "../config.js";
 import { installMarker, printMarkerBlock } from "./mcp.js";
+import { runSetup } from "./setup.js";
 import { readLocalBinding, resolveBinding, bindingRefused } from "../lib/binding.js";
 import { getBinding, setBinding, removeBinding, newWorkspaceId } from "../lib/keystore.js";
 import { resolveLauncher, launcherNote, onDurablePath, selfCommand, versionStamp } from "../lib/launcher.js";
@@ -450,6 +451,11 @@ export async function completeWorkspaceSetup(args) {
     // Per-folder only (local scope), always watchdog. The marker carries only the
     // workspace id — no secret — so ./.mcp.json is safe to commit.
     const marker = installMarker({ workspaceId, scope: "local", launcher, quiet: true });
+    // RTSC-780: and the once-per-machine half. Idempotent by construction (each adapter
+    // replaces its own entry), so running it on every bind is how a harness installed
+    // AFTER the first bind gets picked up without anyone having to know that `retasc
+    // setup` exists. Quiet: the receipt below names what it wired, in one row.
+    const wired = runSetup({ launcher, quiet: true });
     // Confirm the binding the same way the agent will see it, and print it as the receipt
     // (RTSC-673). Resolved rather than echoed from what we just sent: this is the last
     // chance to notice a folder bound to something other than what was asked for, and a
@@ -470,6 +476,15 @@ export async function completeWorkspaceSetup(args) {
             { label: "Project", value: bound?.name ? `${pfx} ${DOT} ${bound.name}` : pfx },
             { label: "Agent key", value: `${minted.key.slice(0, 14)}…`, note: "never leaves ~/.retasc" },
             { label: "MCP wired", value: marker.where, note: "secret-free, safe to commit" },
+            ...(wired.wired.length
+                ? [
+                    {
+                        label: "Harnesses",
+                        value: wired.wired.map((w) => w.label).join(", "),
+                        note: "every folder",
+                    },
+                ]
+                : []),
         ], `Agents launched here can only ever read or write ${pfx}.`));
     // Only when we could write it nowhere. See printMarkerBlock.
     if (!marker.wroteFile && marker.where === "")
@@ -568,6 +583,12 @@ export async function setupFromToken(token, opts, deps = {}) {
         createdAt: Date.now(),
     });
     (deps.marker ?? installMarker)({ workspaceId, scope: "local", launcher });
+    // RTSC-780 — same once-per-machine wiring on the agent door. This path has no TTY and
+    // no receipt card, so it prints its own line rather than staying silent.
+    const wired = (deps.setup ?? runSetup)({ launcher, quiet: true });
+    if (wired.wired.length) {
+        console.log(`✓ Retasc wired into ${wired.wired.map((w) => w.label).join(", ")}.`);
+    }
     // RTSC-532 — name the PATH, not "this folder". A binding is folder → project, and
     // until this line said which folder, a wrong one was undetectable: the agent still
     // calls in, so the Dash shows success while the folder she actually works in has no

package/dist/commands/mcp.js

@@ -161,6 +161,34 @@ export function writeProjectMcpJson(entry) {
     }
     return path;
 }
+/**
+ * Say plainly that `--runtime` labels an agent and does not choose a harness (RTSC-781).
+ *
+ * The flag reads as a promise. It is offered on the same commands that install MCP
+ * config, it is documented with a list of harness names, and before RTSC-780 the only
+ * thing any of those commands could write was Claude Code. So
+ * `key mint --runtime codex --install` named Codex, wired Claude Code, and said nothing
+ * — and the resulting failure surfaced as "signed in, but the server is unreachable",
+ * which sends you to check a server that is fine and serving other clients.
+ *
+ * The commands that call this mint a key and write a KEY-BEARING entry, which is
+ * deliberately per-folder and Claude-Code-only: a key must never be written into a
+ * machine-global config (RTSC-91). So the honest answer is not to wire the named harness
+ * here, it is to say that this command cannot and name the one that can.
+ *
+ * A note rather than a refusal. By the time this prints, the key is minted and the
+ * Claude Code wiring is real work someone asked for; exiting would throw that away to
+ * make a point. Silence was the bug, not the wiring.
+ */
+export function noteRuntimeIsALabel(runtime) {
+    const r = (runtime ?? "").trim();
+    if (!r || r === "claude-code")
+        return;
+    console.log(`Note: --runtime ${r} sets this agent's LABEL in the Dash. It does not choose where\n` +
+        `config is written. This command writes a key-bearing entry for THIS folder, and a\n` +
+        `key only ever belongs in Claude Code's own config, never in a machine-wide one.\n` +
+        `To wire ${r}, run \`retasc setup\` — secret-free, every harness, every folder.\n`);
+}
 /**
  * Wire the Retasc MCP server into the user's agent. Prefers the `claude` CLI;
  * falls back to writing ./.mcp.json. Always prints the manual block so the user

package/dist/commands/setup.js

@@ -0,0 +1,86 @@
+// RTSC-780: `retasc setup` — wire every MCP harness on this machine, once.
+//
+// The shape this exists to deliver:
+//   once per machine   `retasc setup`, and every harness that is installed gets an entry
+//   once per project   `retasc bind`, and every one of them sees it
+//
+// Nothing harness-specific after that, ever again. The entry written here names no
+// workspace (keystore.AUTO_WORKSPACE), so it is correct in every folder: the proxy
+// resolves the directory it was spawned in against the home keystore at startup. The
+// folder still decides the org, which is the whole routing model (RTSC-91) and the thing
+// a machine-global entry would otherwise break.
+//
+// NOT an npm postinstall hook. Most people reach this CLI through `npx`, which installs
+// nothing (the reason `resolveLauncher` exists, RTSC-493), so a postinstall would never
+// run for them; and writing into somebody's global agent configs from a package install
+// is a thing to do in front of a human, not behind one.
+import { AUTO_WORKSPACE } from "../lib/keystore.js";
+import { HARNESSES, detectHarnesses, tildePath } from "../lib/harness.js";
+import { resolveLauncher, launcherNote } from "../lib/launcher.js";
+import { VERSION } from "../version.js";
+import { card } from "../lib/card.js";
+/** The one entry every harness gets: the watchdog proxy, resolving its own folder. */
+export function autoMarkerEntry(launcher) {
+    return {
+        command: launcher.command,
+        args: [...launcher.args, "mcp-proxy"],
+        env: { RETASC_WORKSPACE: AUTO_WORKSPACE },
+    };
+}
+/**
+ * Wire the auto marker into every detected harness.
+ *
+ * `quiet` is for the call at the end of `bind`, where the bind receipt does the talking.
+ */
+export function runSetup(opts) {
+    const all = opts.harnesses;
+    const resolved = opts.launcher ?? resolveLauncher({ version: VERSION, install: opts.install });
+    if (!opts.launcher) {
+        const note = launcherNote(resolved);
+        if (note)
+            console.log(note);
+    }
+    const entry = autoMarkerEntry(resolved.launcher);
+    const known = all ?? HARNESSES;
+    const present = detectHarnesses(known);
+    const presentIds = new Set(present.map((h) => h.id));
+    const result = {
+        wired: [],
+        failed: [],
+        absent: known.filter((h) => !presentIds.has(h.id)).map((h) => h.label),
+    };
+    for (const h of present) {
+        const outcome = h.install(entry);
+        if (outcome.ok) {
+            result.wired.push({ label: h.label, where: tildePath(outcome.path), replaced: outcome.replaced });
+        }
+        else {
+            result.failed.push({ label: h.label, reason: outcome.reason });
+        }
+    }
+    if (!opts.quiet)
+        printSetup(result);
+    return result;
+}
+/** The receipt. One row per harness, so "what did this just touch" needs no guessing. */
+export function printSetup(r) {
+    if (!r.wired.length && !r.failed.length) {
+        console.log("No MCP harness found on this machine.");
+        console.log("Install Claude Code, Codex or Grok and run `retasc setup` again, or bind a folder\n" +
+            "with `retasc bind` and paste the config block it prints into your own client.");
+        return;
+    }
+    console.log("\n" +
+        card(`✓ Retasc wired into ${r.wired.length} ${r.wired.length === 1 ? "harness" : "harnesses"}`, r.wired.map((w) => ({
+            label: w.label,
+            value: w.where,
+            note: w.replaced ? "updated" : "new",
+        }))));
+    for (const f of r.failed)
+        console.log(`  ! ${f.label}: ${f.reason}`);
+    if (r.absent.length)
+        console.log(`  Not on this machine: ${r.absent.join(", ")}.`);
+    console.log("\nThese entries carry no key and name no project, so they are correct in every folder.\n" +
+        "Run `retasc bind` in a project to say which org it belongs to, then start your agent\n" +
+        "there (or restart it if it's already open).");
+}

package/dist/index.js

@@ -3,10 +3,11 @@ import { Command } from "commander";
 import { VERSION } from "./version.js";
 import { selfCommand, versionStamp } from "./lib/launcher.js";
 import { loadConfig, patchConfig, saveConfig, configPath, isLoggedIn } from "./config.js";
-import { installMcp, normalizeScope } from "./commands/mcp.js";
+import { installMcp, noteRuntimeIsALabel, normalizeScope } from "./commands/mcp.js";
+import { runSetup } from "./commands/setup.js";
 import { installGate, resolveGatePrefix } from "./commands/gate.js";
 import { claimAction, releaseAction } from "./commands/claim.js";
-import { bindAction, setupFromToken } from "./commands/bind.js";
+import { bindAction, completeWorkspaceSetup, rebindGuard, setupFromToken } from "./commands/bind.js";
 import { unbindAction } from "./commands/unbind.js";
 import { joinAction } from "./commands/join.js";
 import { chooseInviteOrg, chooseInviteProjects } from "./commands/invite.js";
@@ -144,9 +145,9 @@ program
     .requiredOption("--project <name>", "Project name")
     .requiredOption("--prefix <PREFIX>", "Project prefix, e.g. XEN")
     .option("--agent <name>", "Agent member name (default: auto, \"{you}'s {runtime}\")")
-    .option("--runtime <runtime>", "Agent runtime: claude-code | codex | opencode | …", "claude-code")
-    .option("--scope <scope>", "MCP install scope: local | project (per-folder only)", "local")
-    .option("--no-watchdog", "Wire a plain direct connection instead of the liveness watchdog")
+    .option("--runtime <runtime>", "Label for this agent in the Dash (claude-code | codex | grok | …). Does NOT choose where MCP config is written — `retasc setup` wires every harness on the machine.", "claude-code")
+    .option("-y, --yes", "Don't prompt to confirm replacing an existing binding")
+    .option("--no-install", "Don't install `retasc` on this machine; wire the pinned npx launcher instead")
     .action(async (opts) => {
     requireLogin();
     try {
@@ -158,21 +159,43 @@ program
             orgId = org.orgId;
             console.log(`✓ Created org (${org.slug}).`);
         }
-        const project = (await api.createProject({ orgId: orgId, name: opts.project, prefix: opts.prefix }));
-        console.log(`✓ Created project ${project.prefix}.`);
-        const minted = (await api.mintKey({
+        // RTSC-780 follow-up: everything after the org is `bind`'s job now.
+        //
+        // This command used to mint a key and call `installMcp` itself, which wrote a
+        // key-bearing entry for Claude Code and nothing else. When RTSC-780 taught the
+        // other three doors (`bind`, `join`, `bind --setup`) to wire every harness on the
+        // machine, this one was left behind — so the one command named "onboarding" was
+        // the one that still left Codex with no Retasc tools, the exact failure RTSC-780
+        // exists to end.
+        //
+        // Fixed by DELETING the duplicate rather than teaching it the same trick.
+        // `completeWorkspaceSetup` already creates the project, mints, writes the keystore
+        // binding (which is what an `auto` marker resolves against — without it a marker
+        // has nothing to find), installs the folder marker, runs setup and prints the
+        // receipt. Two implementations of "set this folder up" is how they drift apart,
+        // and this is the second time they did.
+        //
+        // `--scope` and `--no-watchdog` are gone with it: both described the shape of an
+        // entry that is no longer written here. The marker is per-folder and secret-free,
+        // and the watchdog is not optional in it.
+        const cfg = patchConfig({ defaultProjectPrefix: opts.prefix });
+        const guard = await rebindGuard({ cwd: process.cwd(), mcpUrl: cfg.mcpUrl, yes: opts.yes });
+        if (!guard.proceed)
+            return;
+        await completeWorkspaceSetup({
             orgId: orgId,
-            projectId: project.projectId,
-            agentName: opts.agent, // undefined → backend auto-names "{you}'s {runtime}"
-            runtime: opts.runtime,
-            keyName: `${project.prefix} key`,
-        }));
-        console.log(`✓ Minted API key (${minted.key.slice(0, 14)}…).`);
-        // RTSC-91 (§13, override #2): never persist a global default org — binding
-        // is a per-folder act. (The prefix is kept only as a gate convenience.)
-        const cfg = patchConfig({ defaultProjectPrefix: project.prefix });
-        console.log("");
-        installMcp({ url: cfg.mcpUrl, key: minted.key, scope: normalizeScope(opts.scope), watchdog: opts.watchdog });
+            orgLabel: opts.org,
+            opts: {
+                project: opts.project,
+                prefix: opts.prefix,
+                agent: opts.agent,
+                runtime: opts.runtime,
+                install: opts.install,
+                yes: opts.yes,
+            },
+            existing: guard.existing,
+            canCreateProject: true,
+        });
     }
     catch (e) {
         fail(e);
@@ -190,7 +213,7 @@ program
     .option("--project <name>", "Create a new project with this name (with --prefix)")
     .option("--prefix <PREFIX>", "Prefix for a new project, e.g. ACME")
     .option("--agent <name>", "Agent member name (default: auto)")
-    .option("--runtime <runtime>", "Agent runtime", "claude-code")
+    .option("--runtime <runtime>", "Label for this agent in the Dash (claude-code | codex | grok | …). Does NOT choose where MCP config is written — `retasc setup` wires every harness on the machine.", "claude-code")
     .option("-y, --yes", "Don't prompt to confirm replacing an existing binding")
     // RTSC-523 — decline the global install without a TTY. `bind`/`join` ask when a human
     // is present; this is how a scripted run, or a developer whose own agent runs setup,
@@ -338,7 +361,7 @@ key
     .requiredOption("--org-id <id>")
     .requiredOption("--project-id <id>")
     .option("--agent <name>", "Agent member name (default: auto, \"{you}'s {runtime}\")")
-    .option("--runtime <runtime>", "Agent runtime: claude-code | codex | opencode | …", "claude-code")
+    .option("--runtime <runtime>", "Label for this agent in the Dash (claude-code | codex | grok | …). Does NOT choose where MCP config is written — `retasc setup` wires every harness on the machine.", "claude-code")
     .option("--name <label>", "Key label")
     .option("--install", "Also wire the key into your agent via MCP")
     .option("--scope <scope>", "MCP install scope if --install: local | project", "local")
@@ -357,6 +380,7 @@ key
         if (opts.install) {
             const cfg = loadConfig();
             console.log("");
+            noteRuntimeIsALabel(opts.runtime);
             installMcp({ url: cfg.mcpUrl, key: res.key, scope: normalizeScope(opts.scope), watchdog: true });
         }
     }
@@ -493,7 +517,7 @@ program
     .option("--no-bind", "Redeem only — don't set this folder up")
     .option("--project-id <id>", "Which project to bind to (skips the picker)")
     .option("--agent <name>", "Agent member name (default: auto)")
-    .option("--runtime <runtime>", "Agent runtime", "claude-code")
+    .option("--runtime <runtime>", "Label for this agent in the Dash (claude-code | codex | grok | …). Does NOT choose where MCP config is written — `retasc setup` wires every harness on the machine.", "claude-code")
     // RTSC-477 — name the way back. `--yes` skips the identity question and must never answer
     // it, so the flag that causes the gap is the right place to say how to close it.
     .option("-y, --yes", "Don't prompt to replace an existing binding, and skip the identity question (ask it later with `retasc identity`)")
@@ -541,6 +565,17 @@ program
     await importAction({ orgId: opts.orgId, source: opts.source, yes: opts.yes }).catch(fail);
 });
 // --- mcp wiring ------------------------------------------------------------
+// RTSC-780 — the once-per-machine half of setup. `bind` runs this itself the first
+// time, so most people never type it; it exists on its own for the second harness
+// installed after a bind, and for re-running after an upgrade moved the launcher.
+program
+    .command("setup")
+    .description("Detect the MCP harnesses on this machine and wire Retasc into each, once.")
+    .option("--no-install", "Don't install `retasc` on this machine; wire the pinned npx launcher instead")
+    .allowExcessArguments(false)
+    .action((opts) => {
+    runSetup({ install: opts.install });
+});
 const mcp = program.command("mcp").description("Wire the Retasc MCP server into your agent.");
 mcp
     .command("install")

package/dist/lib/harness.js

@@ -0,0 +1,236 @@
+// RTSC-780: the harness registry. One entry per MCP client we know how to wire.
+//
+// Before this file the CLI could wire exactly one harness: `installMcp`/`installMarker`
+// spawned `claude mcp add` and, if that failed, wrote ./.mcp.json. Everything else got
+// nothing, which is why Codex had never worked in any project on any machine. The only
+// non-Claude binding that ever existed here was hand-written into ~/.grok/config.toml by
+// an agent, machine-global with an inline API key — the exact cross-org leak `normalizeScope`
+// refuses to allow for Claude Code.
+//
+// The entry we write is the `auto` marker (keystore.AUTO_WORKSPACE): no key, no workspace
+// id, nothing folder-specific. That is what makes ONE write per harness enough for every
+// project, and it is only safe because the harnesses verified below spawn stdio servers
+// with cwd set to the project directory, so the proxy can resolve the folder itself.
+//
+// Adding a harness is one entry in HARNESSES. Deliberately NOT populated from theory:
+// each entry here was checked against a real installation. Cursor, Windsurf, Gemini CLI,
+// OpenCode and VS Code all have a known config shape and belong here, but writing an
+// unverified serializer into somebody's global agent config is not a thing to ship on a
+// guess — they go in as each is confirmed.
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+/**
+ * The home directory harness configs are resolved under.
+ *
+ * `RETASC_HOME` overrides it, the same escape hatch `keystore.ts` gives with
+ * `RETASC_DIR` and for the same reason: without one, anything that exercises this
+ * module writes into the developer's REAL global agent configs. That is not
+ * hypothetical — it happened while building this, and the tell was `retasc setup`
+ * reporting "replaced" on a Codex config that had never held a retasc entry.
+ * A test that can silently reconfigure the machine it runs on is a worse bug than
+ * whatever it was testing.
+ */
+function home() {
+    return process.env.RETASC_HOME || homedir();
+}
+/** `/Users/me/.codex/config.toml` → `~/.codex/config.toml`, for receipts. The card's
+ *  value column is 20 columns wide, and an absolute path ellipses away to nothing
+ *  useful exactly where the reader is checking WHICH file we touched. */
+export function tildePath(p) {
+    const h = home();
+    return p.startsWith(h + "/") ? `~${p.slice(h.length)}` : p;
+}
+export const SERVER_NAME = "retasc";
+// --- shared helpers ---------------------------------------------------------
+/**
+ * True when `bin` resolves on PATH.
+ *
+ * This DOES run a shell (`command -v` is a shell builtin, not an executable), so the
+ * argument is concatenated into a command string and a name carrying `;` or a space
+ * would be a command injection. Every caller passes a literal from HARNESSES below,
+ * but "the only caller today is safe" is how that stops being true, so the shape of
+ * the name is checked here rather than trusted.
+ */
+export function onPath(bin) {
+    if (!/^[a-zA-Z0-9._-]+$/.test(bin))
+        return false;
+    const r = spawnSync("command", ["-v", bin], { encoding: "utf8", shell: "/bin/sh" });
+    return r.status === 0 && Boolean((r.stdout || "").trim());
+}
+function readIfExists(path) {
+    try {
+        return existsSync(path) ? readFileSync(path, "utf8") : "";
+    }
+    catch {
+        return "";
+    }
+}
+/** Write, creating the parent directory. Config files can hold nothing secret by
+ *  design (the marker is secret-free), so no 0600 dance is needed here — but we
+ *  also never widen an existing file's mode, so an existing 0600 config stays 0600. */
+function writeConfig(path, text) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, text, "utf8");
+}
+// --- TOML (Codex, Grok) -----------------------------------------------------
+/**
+ * Splice one table (and its sub-tables) into a TOML document, in place.
+ *
+ * Deliberately textual rather than parse-and-reserialize. These are the user's own
+ * global config files: they hold comments, hand-chosen ordering, and settings that
+ * have nothing to do with us. A round-trip through a TOML parser would silently
+ * rewrite all of that, and the CLI ships with two dependencies (commander, convex)
+ * precisely so it stays cheap to install — adding a TOML library to reformat
+ * somebody's config is the wrong trade twice over.
+ *
+ * Replaces every existing `[prefix]` / `[prefix.*]` table, then appends `block`.
+ * A table ends at the next line that starts a different table at column 0.
+ */
+export function spliceTomlTable(text, prefix, block) {
+    const lines = text.split("\n");
+    const out = [];
+    let skipping = false;
+    const opens = (line) => {
+        const m = line.match(/^\s*\[\[?([^\]]+)\]\]?\s*$/);
+        return m ? m[1].trim() : null;
+    };
+    for (const line of lines) {
+        const table = opens(line);
+        if (table !== null) {
+            // A new table header always ends whatever we were skipping.
+            skipping = table === prefix || table.startsWith(`${prefix}.`);
+        }
+        if (!skipping)
+            out.push(line);
+    }
+    // Collapse the blank-line run the removal may have left at the end, so repeated
+    // installs don't grow the file by one newline every time.
+    while (out.length && out[out.length - 1].trim() === "")
+        out.pop();
+    const body = out.join("\n");
+    return `${body}\n\n${block.trim()}\n`;
+}
+/** The `[mcp_servers.retasc]` block, in the shape Codex and Grok both accept. */
+export function tomlBlock(entry) {
+    const arr = entry.args.map((a) => JSON.stringify(a)).join(", ");
+    const env = Object.entries(entry.env)
+        .map(([k, v]) => `${k} = ${JSON.stringify(v)}`)
+        .join("\n");
+    return [
+        `[mcp_servers.${SERVER_NAME}]`,
+        `command = ${JSON.stringify(entry.command)}`,
+        `args = [${arr}]`,
+        `enabled = true`,
+        ``,
+        `[mcp_servers.${SERVER_NAME}.env]`,
+        env,
+    ].join("\n");
+}
+function tomlHarness(id, label, path, bin) {
+    return {
+        id,
+        label,
+        configPath: path,
+        detect: () => existsSync(path()) || onPath(bin),
+        install(entry) {
+            const p = path();
+            const before = readIfExists(p);
+            try {
+                writeConfig(p, spliceTomlTable(before, `mcp_servers.${SERVER_NAME}`, tomlBlock(entry)));
+            }
+            catch (e) {
+                return { ok: false, reason: String(e?.message ?? e) };
+            }
+            return { ok: true, path: p, replaced: /^\s*\[\[?mcp_servers\.retasc\b/m.test(before) };
+        },
+    };
+}
+// --- JSON (./.mcp.json in the folder) ---------------------------------------
+/** Merge the retasc entry into a `{ mcpServers: {…} }` document, leaving every
+ *  other server and unknown key byte-for-byte where it was. */
+export function mergeMcpServers(before, entry) {
+    let doc = {};
+    if (before.trim()) {
+        try {
+            doc = JSON.parse(before);
+        }
+        catch {
+            doc = {};
+        }
+    }
+    doc.mcpServers = doc.mcpServers ?? {};
+    doc.mcpServers[SERVER_NAME] = entry;
+    return JSON.stringify(doc, null, 2) + "\n";
+}
+// --- Claude Code ------------------------------------------------------------
+/**
+ * Claude Code is the one harness with a real CLI for this, and `claude mcp add` is
+ * the ONLY sanctioned way to edit `~/.claude.json`: a running Claude Code rewrites
+ * that file constantly, so a read-modify-write from here would race it and could
+ * drop unrelated servers.
+ *
+ * Scope `user` here, which `normalizeScope` refuses everywhere else (RTSC-91). The
+ * refusal is about a global entry that NAMES an org — an id or a key in a
+ * machine-wide file routes every folder to one project. The `auto` marker names
+ * nothing, so the objection does not apply to it, and the whole point of RTSC-780
+ * is that this entry is written once and serves every folder.
+ */
+const claudeCode = {
+    id: "claude-code",
+    label: "Claude Code",
+    configPath: () => join(home(), ".claude.json"),
+    // A test home means "do not touch this machine's real config". `claude mcp add`
+    // writes ~/.claude.json wherever HOME points, so the override has to gate DETECTION,
+    // not just the path: an undetected harness is never installed into.
+    detect: () => !process.env.RETASC_HOME && onPath("claude"),
+    install(entry) {
+        const args = [
+            "mcp", "add",
+            SERVER_NAME,
+            "--transport", "stdio",
+            "--scope", "user",
+            ...Object.entries(entry.env).flatMap(([k, v]) => ["--env", `${k}=${v}`]),
+            "--", entry.command, ...entry.args,
+        ];
+        // An existing user-scope entry makes `add` fail rather than replace, so clear it
+        // first. Best effort: a missing entry exits non-zero and that is fine.
+        //
+        // This does open a remove-then-fail window: if `add` fails after a successful
+        // remove, the user is left with no retasc entry rather than the one they had. The
+        // blast radius is bounded to OUR entry (the name is fixed, and `-s user` scopes it),
+        // the outcome is reported rather than swallowed, and `retasc setup` re-runs cleanly.
+        // Restoring the previous entry would mean reading ~/.claude.json ourselves, which is
+        // the one thing that file must never have done to it: a running Claude Code rewrites
+        // it constantly and the read-modify-write would race it.
+        const had = spawnSync("claude", ["mcp", "remove", SERVER_NAME, "-s", "user"], {
+            encoding: "utf8",
+        });
+        const r = spawnSync("claude", args, { encoding: "utf8" });
+        if (r.error)
+            return { ok: false, reason: r.error.message };
+        if (r.status !== 0) {
+            const msg = (r.stderr || r.stdout || "").trim().split("\n")[0] || `exited ${r.status}`;
+            return { ok: false, reason: msg };
+        }
+        return { ok: true, path: "Claude Code (user scope)", replaced: had.status === 0 };
+    },
+};
+// --- the registry -----------------------------------------------------------
+export const HARNESSES = [
+    claudeCode,
+    tomlHarness("codex", "Codex", () => join(home(), ".codex", "config.toml"), "codex"),
+    tomlHarness("grok", "Grok", () => join(home(), ".grok", "config.toml"), "grok"),
+];
+/** Every harness actually present on this machine. */
+export function detectHarnesses(list = HARNESSES) {
+    return list.filter((h) => {
+        try {
+            return h.detect();
+        }
+        catch {
+            return false;
+        }
+    });
+}

package/dist/lib/keystore.js

@@ -1,5 +1,5 @@
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { mkdirSync, readFileSync, writeFileSync, existsSync, chmodSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 /** The dir the keystore lives in. RETASC_DIR overrides it (tests, sandboxes). */
@@ -52,12 +52,87 @@ export function removeBinding(workspaceId) {
 export function newWorkspaceId() {
     return `ws_${randomUUID()}`;
 }
+/**
+ * RTSC-780: the sentinel that means "work out the workspace from where you were
+ * spawned", rather than naming one.
+ *
+ * A marker carrying a real `ws_…` id names ONE workspace, so an entry holding it
+ * is only ever correct in the folder it was written for. That is why there is no
+ * global scope today (RTSC-91): a machine-wide entry with an id in it would route
+ * every folder on the disk to one org. `auto` carries no identity at all, so an
+ * entry holding it IS safe to write once, machine-wide, into every harness — the
+ * proxy resolves the folder it was spawned in against the keystore at startup and
+ * the org still comes from the folder, exactly as before.
+ *
+ * Not a possible collision: ids are `ws_`-prefixed uuids.
+ */
+export const AUTO_WORKSPACE = "auto";
+/**
+ * Which binding covers this directory? (RTSC-780)
+ *
+ * Walks UP from `dir`, matching `boundPath` at each level, so an agent spawned in
+ * a subdirectory of a bound project resolves to that project instead of to
+ * nothing. The walk is what makes `auto` usable in practice: harnesses spawn a
+ * stdio server in the project root, but not every one of them, and a human running
+ * `retasc claim` from `src/` should not be told the folder is unbound.
+ *
+ * Paths are compared resolved, so `/tmp` vs `/private/tmp` and a trailing slash
+ * don't produce a false miss.
+ *
+ * Newest wins when two ids claim the same path. A re-bind normally REUSES the
+ * folder's existing id (bind.ts), but a folder bound, unbound and bound again
+ * leaves an older entry behind, and the fresher one is the live binding.
+ *
+ * The walk STOPS at the repository root, and that bound is load-bearing rather than
+ * tidiness. An unbounded walk means binding a directory binds everything beneath it:
+ * run `retasc bind` once in `~/Development` (or `~`) and every project under it
+ * silently starts acting in that org, with no marker in those folders saying so and
+ * nothing on screen to notice. That is the cross-org leak this whole design exists to
+ * avoid (RTSC-91), reintroduced through the back door. A repository is the unit a
+ * person means by "project", so it is the unit the walk is allowed to cross: `src/lib`
+ * resolves to its repo, and a sibling repo checked out inside a bound directory
+ * resolves to nothing.
+ *
+ * Detected by the presence of `.git`, which is a FILE in a worktree and a directory in
+ * a normal clone, so `existsSync` is the right test for both.
+ */
+export function findBindingByPath(dir) {
+    const bindings = loadKeystore().bindings;
+    // Index by resolved boundPath once, keeping the newest per path.
+    const byPath = new Map();
+    for (const [workspaceId, entry] of Object.entries(bindings)) {
+        if (!entry?.boundPath)
+            continue;
+        const key = resolve(entry.boundPath);
+        const prev = byPath.get(key);
+        if (!prev || (entry.createdAt ?? 0) > (prev.entry.createdAt ?? 0)) {
+            byPath.set(key, { workspaceId, entry });
+        }
+    }
+    let cur = resolve(dir);
+    // Bounded twice: by the repository root (below), and by the filesystem root, since
+    // `dirname("/")` is `"/"` and ends the loop for a directory outside any repo.
+    for (;;) {
+        const hit = byPath.get(cur);
+        if (hit)
+            return hit;
+        // Checked AFTER the lookup so the repo root itself, the folder `bind` actually
+        // writes, is always eligible.
+        if (existsSync(join(cur, ".git")))
+            return undefined;
+        const up = dirname(cur);
+        if (up === cur)
+            return undefined;
+        cur = up;
+    }
+}
 /**
  * RTSC-98: the ONE place that resolves a workspace's key + MCP url. Shared by the
  * proxy (env-based) and the direct commands `claim`/`tidy`/`done` (.mcp.json-based)
  * so the two paths can never drift again. Precedence: explicit `RETASC_MCP_KEY`
  * env → legacy inline key in the marker (env or Authorization header) → canonical
- * secret-free marker (`RETASC_WORKSPACE` → home keystore). `mcpEntry` is a
+ * secret-free marker (`RETASC_WORKSPACE` → home keystore, or `auto` → this
+ * process's cwd → home keystore). `mcpEntry` is a
  * workspace `.mcp.json`'s `mcpServers.retasc` entry, or undefined when only the
  * environment carries the binding (the spawned proxy).
  *
@@ -97,15 +172,23 @@ export function resolveConn(opts) {
     }
     // Canonical (RTSC-92): secret-free marker → workspace id → home keystore.
     // The entry's url is deliberately NOT consulted on this branch.
+    //
+    // RTSC-780 adds one more step in front of the id: `auto` names no workspace, so
+    // the folder we were spawned in picks it. Same trust rule either way — the key
+    // came from the keystore, so it travels only to the keystore's url. That is what
+    // lets `auto` be written into a GLOBAL harness config: the entry is identical on
+    // every machine and in every folder, and carries nothing worth stealing.
     if (!key) {
         const wsId = env.RETASC_WORKSPACE || entry?.env?.RETASC_WORKSPACE;
-        if (wsId) {
-            const b = getBinding(String(wsId));
-            if (b) {
-                key = b.key;
-                if (!url)
-                    url = b.url;
-            }
+        const b = wsId === AUTO_WORKSPACE
+            ? findBindingByPath(opts.cwd ?? process.cwd())?.entry
+            : wsId
+                ? getBinding(String(wsId))
+                : undefined;
+        if (b) {
+            key = b.key;
+            if (!url)
+                url = b.url;
         }
     }
     return { key, url: url || opts.defaultUrl || "" };

package/dist/proxy.js

@@ -12,7 +12,7 @@ import { spawn, spawnSync } from "node:child_process";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { applyObservation, heartbeatRequest, isClaimLost, isUnauthorized, shouldReapOnClose, untrackedLeaseWarning, } from "./lib/watchdog.js";
-import { resolveConn } from "./lib/keystore.js";
+import { AUTO_WORKSPACE, resolveConn } from "./lib/keystore.js";
 import { toolResult as parseTool } from "./lib/toolresult.js";
 import { mintSessionKey, appendFallbackNotice } from "./lib/session.js";
 import { attachRoot, isLocalAttachCall, mergeAttachTool, resolveAttachPath, uploadFailureMessage, uploadUrlWith, } from "./lib/attachFile.js";
@@ -23,6 +23,21 @@ import { MAX_FETCH_BYTES, downloadFailureMessage, existingDownload, isLocalFetch
 const resolved = resolveConn({ env: process.env, defaultUrl: "https://mcp.retasc.com/mcp" });
 let MCP_URL = resolved.url;
 const KEY = resolved.key;
+// RTSC-780: with the `auto` marker the SAME entry is wired into every harness, once, and
+// is therefore present in folders that were never bound. That is no longer a broken
+// install, it is the ordinary state of a folder you haven't run `retasc bind` in yet, so
+// it needs an answer rather than a 401.
+//
+// Getting this wrong is what RTSC-781 is about. Forwarding keyless requests produces an
+// auth failure, and the CLI's own login is global and still fine, so the agent reports
+// "signed in, but the server is unreachable" and a human goes and checks a server that
+// was serving other clients the whole time. The folder is the thing that is missing, so
+// the folder is what the error has to name.
+const UNBOUND = !KEY && (process.env.RETASC_WORKSPACE ?? "") === AUTO_WORKSPACE ? process.cwd() : null;
+const UNBOUND_MESSAGE = `This folder (${UNBOUND ?? process.cwd()}) is not bound to a Retasc project, so there is ` +
+    `nothing to pull work from. Nothing is wrong with your sign-in or with the Retasc server. ` +
+    `Run \`retasc bind\` in this folder to say which org and project it belongs to, then restart ` +
+    `this agent so it picks the binding up.`;
 const HEARTBEAT_MS = Number(process.env.RETASC_HEARTBEAT_MS) || 10 * 60 * 1000;
 const leases = new Map();
 let hbSeq = -1; // out-of-band heartbeat ids are negative — never collide with the harness's
@@ -408,6 +423,18 @@ async function handleLine(line) {
     // context), so every call to the tool is served here rather than forwarded.
     if (isLocalFetchCall(msg))
         return await handleLocalFetch(msg);
+    // RTSC-780: an unbound folder answers every tool call itself. `initialize` and
+    // `tools/list` still go remote, so the agent starts cleanly and can SEE the tools —
+    // the failure has to arrive at the moment one is used, worded as the folder problem
+    // it is, rather than as a startup crash the harness reports as "server unreachable".
+    if (UNBOUND && msg.method === "tools/call" && msg.id !== undefined) {
+        process.stdout.write(JSON.stringify({
+            jsonrpc: "2.0",
+            id: msg.id,
+            result: { content: [{ type: "text", text: UNBOUND_MESSAGE }], isError: true },
+        }) + "\n");
+        return;
+    }
     let resp;
     try {
         resp = await postRemote(msg);
@@ -505,7 +532,9 @@ async function heartbeatAll() {
 }
 /** Run the stdio proxy. Started by the harness; lives as long as the session. */
 export async function runProxy() {
-    if (!KEY)
+    if (UNBOUND)
+        log(UNBOUND_MESSAGE);
+    else if (!KEY)
         log("warning: RETASC_MCP_KEY is empty — forwarded requests will be unauthorized");
     // Adopt a per-session key BEFORE serving traffic, so even the first claim is
     // attributed to this session. stdin buffers in the OS pipe meanwhile.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.37.0",
+  "version": "1.38.1",
   "description": "Retasc CLI — the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {
@@ -40,7 +40,7 @@
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",
-    "test": "npm run build && node --test test/*.test.mjs",
+    "test": "npm run build && node --test --import ./test/_test-home.mjs test/*.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {