@retasc/cli 1.38.0 → 1.38.1

package/CHANGELOG.md

@@ -6,6 +6,21 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.38.1 (2026-08-28)
+
+- **RTSC-780 follow-up** — `retasc init` now sets a folder up the same way every other
+  door does. 1.38.0 taught `bind`, `join` and `bind --setup` to wire every harness on the
+  machine, but `init` kept its own copy of that work: it minted a key and wrote a
+  key-bearing entry for Claude Code and nothing else. So the one command named onboarding
+  was the one that still left Codex with no Retasc tools, which is the exact failure
+  1.38.0 exists to end.
+  Fixed by deleting the duplicate rather than teaching it the same trick. Everything after
+  the org is now `bind`'s job, which also means `init` writes the keystore binding an
+  `auto` marker resolves against, guards a folder that is already bound instead of
+  overwriting it, and prints the same receipt.
+  `--scope` and `--no-watchdog` are gone from `init`: both described the shape of an entry
+  it no longer writes. `-y/--yes` and `--no-install` are there instead, matching `bind`.
+
 ## 1.38.0 (2026-08-28)
 
 - **RTSC-780** — `retasc setup` wires Retasc into every MCP harness on the machine, once,

package/dist/index.js

@@ -7,7 +7,7 @@ import { installMcp, noteRuntimeIsALabel, normalizeScope } from "./commands/mcp.
 import { runSetup } from "./commands/setup.js";
 import { installGate, resolveGatePrefix } from "./commands/gate.js";
 import { claimAction, releaseAction } from "./commands/claim.js";
-import { bindAction, setupFromToken } from "./commands/bind.js";
+import { bindAction, completeWorkspaceSetup, rebindGuard, setupFromToken } from "./commands/bind.js";
 import { unbindAction } from "./commands/unbind.js";
 import { joinAction } from "./commands/join.js";
 import { chooseInviteOrg, chooseInviteProjects } from "./commands/invite.js";
@@ -146,8 +146,8 @@ program
     .requiredOption("--prefix <PREFIX>", "Project prefix, e.g. XEN")
     .option("--agent <name>", "Agent member name (default: auto, \"{you}'s {runtime}\")")
     .option("--runtime <runtime>", "Label for this agent in the Dash (claude-code | codex | grok | …). Does NOT choose where MCP config is written — `retasc setup` wires every harness on the machine.", "claude-code")
-    .option("--scope <scope>", "MCP install scope: local | project (per-folder only)", "local")
-    .option("--no-watchdog", "Wire a plain direct connection instead of the liveness watchdog")
+    .option("-y, --yes", "Don't prompt to confirm replacing an existing binding")
+    .option("--no-install", "Don't install `retasc` on this machine; wire the pinned npx launcher instead")
     .action(async (opts) => {
     requireLogin();
     try {
@@ -159,22 +159,43 @@ program
             orgId = org.orgId;
             console.log(`✓ Created org (${org.slug}).`);
         }
-        const project = (await api.createProject({ orgId: orgId, name: opts.project, prefix: opts.prefix }));
-        console.log(`✓ Created project ${project.prefix}.`);
-        const minted = (await api.mintKey({
+        // RTSC-780 follow-up: everything after the org is `bind`'s job now.
+        //
+        // This command used to mint a key and call `installMcp` itself, which wrote a
+        // key-bearing entry for Claude Code and nothing else. When RTSC-780 taught the
+        // other three doors (`bind`, `join`, `bind --setup`) to wire every harness on the
+        // machine, this one was left behind — so the one command named "onboarding" was
+        // the one that still left Codex with no Retasc tools, the exact failure RTSC-780
+        // exists to end.
+        //
+        // Fixed by DELETING the duplicate rather than teaching it the same trick.
+        // `completeWorkspaceSetup` already creates the project, mints, writes the keystore
+        // binding (which is what an `auto` marker resolves against — without it a marker
+        // has nothing to find), installs the folder marker, runs setup and prints the
+        // receipt. Two implementations of "set this folder up" is how they drift apart,
+        // and this is the second time they did.
+        //
+        // `--scope` and `--no-watchdog` are gone with it: both described the shape of an
+        // entry that is no longer written here. The marker is per-folder and secret-free,
+        // and the watchdog is not optional in it.
+        const cfg = patchConfig({ defaultProjectPrefix: opts.prefix });
+        const guard = await rebindGuard({ cwd: process.cwd(), mcpUrl: cfg.mcpUrl, yes: opts.yes });
+        if (!guard.proceed)
+            return;
+        await completeWorkspaceSetup({
             orgId: orgId,
-            projectId: project.projectId,
-            agentName: opts.agent, // undefined → backend auto-names "{you}'s {runtime}"
-            runtime: opts.runtime,
-            keyName: `${project.prefix} key`,
-        }));
-        console.log(`✓ Minted API key (${minted.key.slice(0, 14)}…).`);
-        // RTSC-91 (§13, override #2): never persist a global default org — binding
-        // is a per-folder act. (The prefix is kept only as a gate convenience.)
-        const cfg = patchConfig({ defaultProjectPrefix: project.prefix });
-        console.log("");
-        noteRuntimeIsALabel(opts.runtime);
-        installMcp({ url: cfg.mcpUrl, key: minted.key, scope: normalizeScope(opts.scope), watchdog: opts.watchdog });
+            orgLabel: opts.org,
+            opts: {
+                project: opts.project,
+                prefix: opts.prefix,
+                agent: opts.agent,
+                runtime: opts.runtime,
+                install: opts.install,
+                yes: opts.yes,
+            },
+            existing: guard.existing,
+            canCreateProject: true,
+        });
     }
     catch (e) {
         fail(e);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.38.0",
+  "version": "1.38.1",
   "description": "Retasc CLI — the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {