@retasc/cli 1.38.0 → 1.38.2

package/CHANGELOG.md

@@ -6,6 +6,37 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.38.2 (2026-08-30)
+
+- **RTSC-789** — `bind` keeps this folder's key instead of minting a new one on every run.
+  The guard meant to prevent that (RTSC-262) read the `--org-id`/`--project-id` flags, so it
+  only ever fired for a provisioning script. The canonical `npx @retasc/cli@latest bind`
+  leaves both undefined and could never reach it: pick the same org and the same project
+  from the menu and it minted anyway, leaving the old key live. The check now runs where
+  the target is known, after the pick, so how you got there stops mattering. A different
+  org or project still mints, as it must.
+  A kept key is resolved against the server before it is kept. `bind` clears a binding only
+  when the server answers `UNAUTHORIZED`, so a folder can reach the reuse branch holding a
+  key whose health is unknown: a 5xx, a proxy sign-in page, a refusal whose wording drifts.
+  Keeping one of those would have stranded the folder for good, since `doctor` sends that
+  exact state back to `bind`. It falls back to minting instead, which is the self-healing
+  the old mint-every-run was providing by accident.
+
+## 1.38.1 (2026-08-28)
+
+- **RTSC-780 follow-up** — `retasc init` now sets a folder up the same way every other
+  door does. 1.38.0 taught `bind`, `join` and `bind --setup` to wire every harness on the
+  machine, but `init` kept its own copy of that work: it minted a key and wrote a
+  key-bearing entry for Claude Code and nothing else. So the one command named onboarding
+  was the one that still left Codex with no Retasc tools, which is the exact failure
+  1.38.0 exists to end.
+  Fixed by deleting the duplicate rather than teaching it the same trick. Everything after
+  the org is now `bind`'s job, which also means `init` writes the keystore binding an
+  `auto` marker resolves against, guards a folder that is already bound instead of
+  overwriting it, and prints the same receipt.
+  `--scope` and `--no-watchdog` are gone from `init`: both described the shape of an entry
+  it no longer writes. `-y/--yes` and `--no-install` are there instead, matching `bind`.
+
 ## 1.38.0 (2026-08-28)
 
 - **RTSC-780** — `retasc setup` wires Retasc into every MCP harness on the machine, once,

package/dist/commands/bind.js

@@ -99,6 +99,55 @@ export function strandRecoveryHint(args) {
         `but has no project or key yet — re-run to finish:\n` +
         `    retasc bind --org-id ${orgId}`);
 }
+/**
+ * The key this folder should KEEP rather than replace (RTSC-789).
+ *
+ * `bind` used to mint on every run. The guard that was supposed to stop that
+ * (RTSC-262) sat in `preflight` and read `args.orgId && args.projectId`, so it
+ * only fired for `retasc bind --org-id X --project-id Y` — the provisioning-script
+ * path it was written for. The canonical command is a bare `bind`, which leaves
+ * both undefined, so the branch was unreachable for almost every real run: pick
+ * the same org and the same project from the menu and it minted anyway. Fourteen
+ * keys in one org, three of them the same agent on the same project, and the old
+ * ones stay live — two were carrying 89 and 283 sessions.
+ *
+ * So the check moves to where the target is actually KNOWN, after the interactive
+ * pick, and asks the only question that matters: does this folder already hold a
+ * key for this exact (org, project)? Flags are irrelevant to that.
+ *
+ * A DIFFERENT org or project still mints.
+ *
+ * This names a CANDIDATE, not a decision. It reads the keystore and nothing else,
+ * so it cannot know whether the key still works — and "`preflight` already cleared
+ * anything the server refused" is not true enough to lean on: that clearing fires
+ * only on a literal UNAUTHORIZED, and every other failure walks straight past it.
+ * The caller resolves the candidate before keeping it.
+ */
+export function reusableKey(existing, target, read = getBinding) {
+    if (!existing?.workspaceId)
+        return null;
+    const cur = read(existing.workspaceId);
+    if (!cur?.key)
+        return null;
+    return cur.orgId === target.orgId && cur.projectId === target.projectId ? cur.key : null;
+}
+/**
+ * The binding as the AGENT will see it, or null when the server won't confirm it.
+ *
+ * One place, because two callers need the same answer for different reasons: the
+ * receipt prints it, and the reuse decision above depends on it. Every failure is
+ * the same answer here — "the server did not confirm this key" — so the caller
+ * decides what that means rather than parsing an error a second time.
+ */
+async function describeBinding(url, key) {
+    try {
+        const b = await resolveBinding(url, key);
+        return { org: clean(b.org.name), prefix: clean(b.project.prefix), name: b.project.name };
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * "This folder is already bound — replace it?" (RTSC-262/RTSC-91)
  *
@@ -423,14 +472,37 @@ export async function completeWorkspaceSetup(args) {
     const note = launcherNote(launcher);
     if (note)
         console.log(note);
-    // --- mint a key for THIS (org, project) and wire the watchdog into THIS folder
-    const minted = (await api.mintKey({
-        orgId,
-        projectId: projectId,
-        agentName: opts.agent,
-        runtime: opts.runtime ?? "claude-code",
-        keyName: prefix ? `${prefix} key` : undefined,
-    }));
+    // --- keep this folder's key if it already names this (org, project), else mint
+    //
+    // A key is only kept once the SERVER agrees it works. `preflight` clears a binding
+    // only on a literal UNAUTHORIZED, so a folder reaches here holding a key of unknown
+    // health whenever that check failed some other way — a 5xx, a proxy page, a refusal
+    // whose wording drifts off the regex. Keeping such a key silently would strand the
+    // folder permanently: `doctor` tells people in exactly that state to re-run `bind`,
+    // and `bind` is this path, so it would answer "✓ bound" forever and never heal. The
+    // mint-on-every-run this issue removes was doing that healing by accident; it stays,
+    // on purpose, as the fallback.
+    //
+    // The check is not extra work — it IS the receipt's confirmation call, hoisted, and
+    // `bound` carries the answer down to the card. The mint path resolves once below,
+    // exactly as before.
+    const candidate = reusableKey(existing, { orgId, projectId: projectId });
+    let bound = candidate ? await describeBinding(cfg.mcpUrl, candidate) : null;
+    // A key that answers for a DIFFERENT project is not this folder's key, whatever the
+    // keystore says its ids were. Compared only when the target's prefix is known (a
+    // bare --project-id never listed one), because a guess would reject good keys.
+    if (bound && prefix && bound.prefix !== clean(prefix))
+        bound = null;
+    const reused = bound !== null;
+    const minted = reused
+        ? { key: candidate }
+        : (await api.mintKey({
+            orgId,
+            projectId: projectId,
+            agentName: opts.agent,
+            runtime: opts.runtime ?? "claude-code",
+            keyName: prefix ? `${prefix} key` : undefined,
+        }));
     // The key is named in the receipt card below, not here — one mention, in the place
     // that says where it went (RTSC-673).
     // RTSC-92: the secret stays OUT of the repo. Store it in the home keystore
@@ -460,21 +532,24 @@ export async function completeWorkspaceSetup(args) {
     // (RTSC-673). Resolved rather than echoed from what we just sent: this is the last
     // chance to notice a folder bound to something other than what was asked for, and a
     // card built from our own inputs could never show that.
-    let bound = null;
-    try {
-        const b = await resolveBinding(cfg.mcpUrl, minted.key);
-        bound = { org: clean(b.org.name), prefix: clean(b.project.prefix), name: b.project.name };
-    }
-    catch {
-        /* binding written; whoami confirmation is best-effort — fall back to what we sent */
-    }
+    //
+    // A reused key was already resolved above, and that answer is the one that decided to
+    // keep it — so only a freshly minted key is left to confirm. Still best-effort here:
+    // the binding is written and a key we just minted is live by construction, so a
+    // network fault at this point is about the confirmation, not about the key.
+    if (!bound)
+        bound = await describeBinding(cfg.mcpUrl, minted.key);
     const orgLabel = bound?.org ?? clean(args.orgLabel ?? "");
     const pfx = bound?.prefix ?? clean(prefix ?? "");
     console.log("\n" +
         card(`✓ This folder is bound to ${orgLabel} / ${pfx}`, [
             { label: "Org", value: orgLabel },
             { label: "Project", value: bound?.name ? `${pfx} ${DOT} ${bound.name}` : pfx },
-            { label: "Agent key", value: `${minted.key.slice(0, 14)}…`, note: "never leaves ~/.retasc" },
+            {
+                label: "Agent key",
+                value: `${minted.key.slice(0, 14)}…`,
+                note: reused ? "kept, not replaced" : "never leaves ~/.retasc",
+            },
             { label: "MCP wired", value: marker.where, note: "secret-free, safe to commit" },
             ...(wired.wired.length
                 ? [

package/dist/index.js

@@ -7,7 +7,7 @@ import { installMcp, noteRuntimeIsALabel, normalizeScope } from "./commands/mcp.
 import { runSetup } from "./commands/setup.js";
 import { installGate, resolveGatePrefix } from "./commands/gate.js";
 import { claimAction, releaseAction } from "./commands/claim.js";
-import { bindAction, setupFromToken } from "./commands/bind.js";
+import { bindAction, completeWorkspaceSetup, rebindGuard, setupFromToken } from "./commands/bind.js";
 import { unbindAction } from "./commands/unbind.js";
 import { joinAction } from "./commands/join.js";
 import { chooseInviteOrg, chooseInviteProjects } from "./commands/invite.js";
@@ -146,8 +146,8 @@ program
     .requiredOption("--prefix <PREFIX>", "Project prefix, e.g. XEN")
     .option("--agent <name>", "Agent member name (default: auto, \"{you}'s {runtime}\")")
     .option("--runtime <runtime>", "Label for this agent in the Dash (claude-code | codex | grok | …). Does NOT choose where MCP config is written — `retasc setup` wires every harness on the machine.", "claude-code")
-    .option("--scope <scope>", "MCP install scope: local | project (per-folder only)", "local")
-    .option("--no-watchdog", "Wire a plain direct connection instead of the liveness watchdog")
+    .option("-y, --yes", "Don't prompt to confirm replacing an existing binding")
+    .option("--no-install", "Don't install `retasc` on this machine; wire the pinned npx launcher instead")
     .action(async (opts) => {
     requireLogin();
     try {
@@ -159,22 +159,43 @@ program
             orgId = org.orgId;
             console.log(`✓ Created org (${org.slug}).`);
         }
-        const project = (await api.createProject({ orgId: orgId, name: opts.project, prefix: opts.prefix }));
-        console.log(`✓ Created project ${project.prefix}.`);
-        const minted = (await api.mintKey({
+        // RTSC-780 follow-up: everything after the org is `bind`'s job now.
+        //
+        // This command used to mint a key and call `installMcp` itself, which wrote a
+        // key-bearing entry for Claude Code and nothing else. When RTSC-780 taught the
+        // other three doors (`bind`, `join`, `bind --setup`) to wire every harness on the
+        // machine, this one was left behind — so the one command named "onboarding" was
+        // the one that still left Codex with no Retasc tools, the exact failure RTSC-780
+        // exists to end.
+        //
+        // Fixed by DELETING the duplicate rather than teaching it the same trick.
+        // `completeWorkspaceSetup` already creates the project, mints, writes the keystore
+        // binding (which is what an `auto` marker resolves against — without it a marker
+        // has nothing to find), installs the folder marker, runs setup and prints the
+        // receipt. Two implementations of "set this folder up" is how they drift apart,
+        // and this is the second time they did.
+        //
+        // `--scope` and `--no-watchdog` are gone with it: both described the shape of an
+        // entry that is no longer written here. The marker is per-folder and secret-free,
+        // and the watchdog is not optional in it.
+        const cfg = patchConfig({ defaultProjectPrefix: opts.prefix });
+        const guard = await rebindGuard({ cwd: process.cwd(), mcpUrl: cfg.mcpUrl, yes: opts.yes });
+        if (!guard.proceed)
+            return;
+        await completeWorkspaceSetup({
             orgId: orgId,
-            projectId: project.projectId,
-            agentName: opts.agent, // undefined → backend auto-names "{you}'s {runtime}"
-            runtime: opts.runtime,
-            keyName: `${project.prefix} key`,
-        }));
-        console.log(`✓ Minted API key (${minted.key.slice(0, 14)}…).`);
-        // RTSC-91 (§13, override #2): never persist a global default org — binding
-        // is a per-folder act. (The prefix is kept only as a gate convenience.)
-        const cfg = patchConfig({ defaultProjectPrefix: project.prefix });
-        console.log("");
-        noteRuntimeIsALabel(opts.runtime);
-        installMcp({ url: cfg.mcpUrl, key: minted.key, scope: normalizeScope(opts.scope), watchdog: opts.watchdog });
+            orgLabel: opts.org,
+            opts: {
+                project: opts.project,
+                prefix: opts.prefix,
+                agent: opts.agent,
+                runtime: opts.runtime,
+                install: opts.install,
+                yes: opts.yes,
+            },
+            existing: guard.existing,
+            canCreateProject: true,
+        });
     }
     catch (e) {
         fail(e);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.38.0",
+  "version": "1.38.2",
   "description": "Retasc CLI — the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {