@retasc/cli 1.38.1 → 1.38.2

package/CHANGELOG.md

@@ -6,6 +6,22 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.38.2 (2026-08-30)
+
+- **RTSC-789** — `bind` keeps this folder's key instead of minting a new one on every run.
+  The guard meant to prevent that (RTSC-262) read the `--org-id`/`--project-id` flags, so it
+  only ever fired for a provisioning script. The canonical `npx @retasc/cli@latest bind`
+  leaves both undefined and could never reach it: pick the same org and the same project
+  from the menu and it minted anyway, leaving the old key live. The check now runs where
+  the target is known, after the pick, so how you got there stops mattering. A different
+  org or project still mints, as it must.
+  A kept key is resolved against the server before it is kept. `bind` clears a binding only
+  when the server answers `UNAUTHORIZED`, so a folder can reach the reuse branch holding a
+  key whose health is unknown: a 5xx, a proxy sign-in page, a refusal whose wording drifts.
+  Keeping one of those would have stranded the folder for good, since `doctor` sends that
+  exact state back to `bind`. It falls back to minting instead, which is the self-healing
+  the old mint-every-run was providing by accident.
+
 ## 1.38.1 (2026-08-28)
 
 - **RTSC-780 follow-up** — `retasc init` now sets a folder up the same way every other

package/dist/commands/bind.js

@@ -99,6 +99,55 @@ export function strandRecoveryHint(args) {
         `but has no project or key yet — re-run to finish:\n` +
         `    retasc bind --org-id ${orgId}`);
 }
+/**
+ * The key this folder should KEEP rather than replace (RTSC-789).
+ *
+ * `bind` used to mint on every run. The guard that was supposed to stop that
+ * (RTSC-262) sat in `preflight` and read `args.orgId && args.projectId`, so it
+ * only fired for `retasc bind --org-id X --project-id Y` — the provisioning-script
+ * path it was written for. The canonical command is a bare `bind`, which leaves
+ * both undefined, so the branch was unreachable for almost every real run: pick
+ * the same org and the same project from the menu and it minted anyway. Fourteen
+ * keys in one org, three of them the same agent on the same project, and the old
+ * ones stay live — two were carrying 89 and 283 sessions.
+ *
+ * So the check moves to where the target is actually KNOWN, after the interactive
+ * pick, and asks the only question that matters: does this folder already hold a
+ * key for this exact (org, project)? Flags are irrelevant to that.
+ *
+ * A DIFFERENT org or project still mints.
+ *
+ * This names a CANDIDATE, not a decision. It reads the keystore and nothing else,
+ * so it cannot know whether the key still works — and "`preflight` already cleared
+ * anything the server refused" is not true enough to lean on: that clearing fires
+ * only on a literal UNAUTHORIZED, and every other failure walks straight past it.
+ * The caller resolves the candidate before keeping it.
+ */
+export function reusableKey(existing, target, read = getBinding) {
+    if (!existing?.workspaceId)
+        return null;
+    const cur = read(existing.workspaceId);
+    if (!cur?.key)
+        return null;
+    return cur.orgId === target.orgId && cur.projectId === target.projectId ? cur.key : null;
+}
+/**
+ * The binding as the AGENT will see it, or null when the server won't confirm it.
+ *
+ * One place, because two callers need the same answer for different reasons: the
+ * receipt prints it, and the reuse decision above depends on it. Every failure is
+ * the same answer here — "the server did not confirm this key" — so the caller
+ * decides what that means rather than parsing an error a second time.
+ */
+async function describeBinding(url, key) {
+    try {
+        const b = await resolveBinding(url, key);
+        return { org: clean(b.org.name), prefix: clean(b.project.prefix), name: b.project.name };
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * "This folder is already bound — replace it?" (RTSC-262/RTSC-91)
  *
@@ -423,14 +472,37 @@ export async function completeWorkspaceSetup(args) {
     const note = launcherNote(launcher);
     if (note)
         console.log(note);
-    // --- mint a key for THIS (org, project) and wire the watchdog into THIS folder
-    const minted = (await api.mintKey({
-        orgId,
-        projectId: projectId,
-        agentName: opts.agent,
-        runtime: opts.runtime ?? "claude-code",
-        keyName: prefix ? `${prefix} key` : undefined,
-    }));
+    // --- keep this folder's key if it already names this (org, project), else mint
+    //
+    // A key is only kept once the SERVER agrees it works. `preflight` clears a binding
+    // only on a literal UNAUTHORIZED, so a folder reaches here holding a key of unknown
+    // health whenever that check failed some other way — a 5xx, a proxy page, a refusal
+    // whose wording drifts off the regex. Keeping such a key silently would strand the
+    // folder permanently: `doctor` tells people in exactly that state to re-run `bind`,
+    // and `bind` is this path, so it would answer "✓ bound" forever and never heal. The
+    // mint-on-every-run this issue removes was doing that healing by accident; it stays,
+    // on purpose, as the fallback.
+    //
+    // The check is not extra work — it IS the receipt's confirmation call, hoisted, and
+    // `bound` carries the answer down to the card. The mint path resolves once below,
+    // exactly as before.
+    const candidate = reusableKey(existing, { orgId, projectId: projectId });
+    let bound = candidate ? await describeBinding(cfg.mcpUrl, candidate) : null;
+    // A key that answers for a DIFFERENT project is not this folder's key, whatever the
+    // keystore says its ids were. Compared only when the target's prefix is known (a
+    // bare --project-id never listed one), because a guess would reject good keys.
+    if (bound && prefix && bound.prefix !== clean(prefix))
+        bound = null;
+    const reused = bound !== null;
+    const minted = reused
+        ? { key: candidate }
+        : (await api.mintKey({
+            orgId,
+            projectId: projectId,
+            agentName: opts.agent,
+            runtime: opts.runtime ?? "claude-code",
+            keyName: prefix ? `${prefix} key` : undefined,
+        }));
     // The key is named in the receipt card below, not here — one mention, in the place
     // that says where it went (RTSC-673).
     // RTSC-92: the secret stays OUT of the repo. Store it in the home keystore
@@ -460,21 +532,24 @@ export async function completeWorkspaceSetup(args) {
     // (RTSC-673). Resolved rather than echoed from what we just sent: this is the last
     // chance to notice a folder bound to something other than what was asked for, and a
     // card built from our own inputs could never show that.
-    let bound = null;
-    try {
-        const b = await resolveBinding(cfg.mcpUrl, minted.key);
-        bound = { org: clean(b.org.name), prefix: clean(b.project.prefix), name: b.project.name };
-    }
-    catch {
-        /* binding written; whoami confirmation is best-effort — fall back to what we sent */
-    }
+    //
+    // A reused key was already resolved above, and that answer is the one that decided to
+    // keep it — so only a freshly minted key is left to confirm. Still best-effort here:
+    // the binding is written and a key we just minted is live by construction, so a
+    // network fault at this point is about the confirmation, not about the key.
+    if (!bound)
+        bound = await describeBinding(cfg.mcpUrl, minted.key);
     const orgLabel = bound?.org ?? clean(args.orgLabel ?? "");
     const pfx = bound?.prefix ?? clean(prefix ?? "");
     console.log("\n" +
         card(`✓ This folder is bound to ${orgLabel} / ${pfx}`, [
             { label: "Org", value: orgLabel },
             { label: "Project", value: bound?.name ? `${pfx} ${DOT} ${bound.name}` : pfx },
-            { label: "Agent key", value: `${minted.key.slice(0, 14)}…`, note: "never leaves ~/.retasc" },
+            {
+                label: "Agent key",
+                value: `${minted.key.slice(0, 14)}…`,
+                note: reused ? "kept, not replaced" : "never leaves ~/.retasc",
+            },
             { label: "MCP wired", value: marker.where, note: "secret-free, safe to commit" },
             ...(wired.wired.length
                 ? [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.38.1",
+  "version": "1.38.2",
   "description": "Retasc CLI — the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {