@retasc/cli 1.39.0 → 1.39.1

package/CHANGELOG.md

@@ -6,6 +6,25 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.39.1 (2026-09-02)
+
+- **RTSC-800** — (security) a keystore-resolved key now travels only to the keystore's own
+  url, whether the competing url arrives in the `.mcp.json` entry or in the environment.
+  1.6.0 made this promise for the entry, which covered `claim`/`tidy`/`done` but not the
+  proxy: the proxy is the one caller that ever reads a committed marker, and it passes no
+  entry at all. The harness copies the marker's `env` block into the spawned process, so a
+  `RETASC_MCP_URL` planted next to `RETASC_WORKSPACE` in a repo's committed `.mcp.json`
+  arrived as an environment url, outranked the keystore, and every teammate's proxy sent its
+  real workspace key to that host on the next start, during session-key minting, with no
+  prompt. An environment url is now honored only alongside an explicit `RETASC_MCP_KEY`,
+  where the key and the url share a trust domain.
+  Nothing legitimate loses a path: `bind` already stores the deployment's url into the
+  binding, so a self-hosted url is in the keystore before the proxy asks for it.
+  This closes the url, and only the url. A committed marker also chooses the `command` that
+  runs and can set any other variable, so a marker you do not trust is code execution by the
+  MCP config format's own design, and the harness's project-trust prompt is the boundary for
+  that. What this removes is the one variant that reads as ordinary configuration in review.
+
 ## 1.39.0 (2026-08-30)
 
 - **RTSC-793** — `retasc setup` now wires Cursor, OpenCode and Gemini CLI too, bringing it

package/dist/lib/keystore.js

@@ -136,18 +136,41 @@ export function findBindingByPath(dir) {
  * workspace `.mcp.json`'s `mcpServers.retasc` entry, or undefined when only the
  * environment carries the binding (the spawned proxy).
  *
- * URL trust pairs with key source (RTSC-262 review): a keystore-resolved key
- * travels ONLY to the keystore's url (or explicit env url) — never to a url
- * from the entry. The marker is secret-free and committed by design, so a
- * hostile edit adding RETASC_MCP_URL next to RETASC_WORKSPACE must not be able
- * to redirect a teammate's real key. Legacy inline entries keep their own url:
- * there the key and url are co-located, same trust domain.
+ * URL trust pairs with key source (RTSC-262 review, tightened by RTSC-800): a url
+ * is honored only when it arrived WITH the key actually used. A keystore-resolved
+ * key therefore travels only to the keystore's url — never to one from the entry,
+ * and never to one from the environment. Co-located pairs keep their own url,
+ * because there the key and url share a trust domain: a legacy inline entry, and
+ * an explicit `RETASC_MCP_KEY` + `RETASC_MCP_URL` in the environment.
+ *
+ * RTSC-800 is why the env url is PAIRED rather than absolute. RTSC-262 made this
+ * promise but implemented it on the `mcpEntry` branch only, and the proxy — the
+ * one caller that ever reads a committed marker — passes no entry. It hands us
+ * `process.env`, which the harness populates from the marker's own `env` block
+ * (`mcpMarkerEntry` / `autoMarkerEntry`). So a `RETASC_MCP_URL` planted next to
+ * `RETASC_WORKSPACE` in a committed `.mcp.json` arrived as an env url, won, and
+ * every teammate's proxy posted its real keystore key to that host on the next
+ * harness start. Nothing legitimate loses a path: `bind` stores the deployment's
+ * url INTO the binding, so a self-hosted url is already in the keystore by the
+ * time the proxy asks for it.
+ *
+ * This closes the url, and only the url. A hostile committed marker can set any
+ * variable for the spawned proxy (`RETASC_DIR` relocates the keystore outright —
+ * see `keystoreDir` above — and `NODE_OPTIONS` is arbitrary code) and it chooses
+ * the `command` that runs, so a marker you do not trust is
+ * code execution by the MCP config format's own design — the harness's project-
+ * trust prompt is the boundary for that, not this function. What this removes is
+ * the one variant that survives review, because a url string in a config file
+ * looks like configuration.
  */
 export function resolveConn(opts) {
     const env = opts.env ?? process.env;
     const entry = opts.mcpEntry;
     let key = env.RETASC_MCP_KEY || "";
-    let url = env.RETASC_MCP_URL || "";
+    // Paired with the env KEY, not read unconditionally (RTSC-800): without a key
+    // beside it, an env url is just a string the committed marker chose, and the key
+    // it would redirect belongs to the keystore.
+    let url = key ? env.RETASC_MCP_URL || "" : "";
     // Entry-supplied key/url are read together — the url is honored only when
     // the key it's paired with is the one actually used.
     let entryKey = "";
@@ -171,7 +194,8 @@ export function resolveConn(opts) {
             url = entryUrl;
     }
     // Canonical (RTSC-92): secret-free marker → workspace id → home keystore.
-    // The entry's url is deliberately NOT consulted on this branch.
+    // Neither the entry's url nor the environment's is consulted on this branch —
+    // the key came from the keystore, so the url does too (RTSC-800).
     //
     // RTSC-780 adds one more step in front of the id: `auto` names no workspace, so
     // the folder we were spawned in picks it. Same trust rule either way — the key
@@ -187,8 +211,12 @@ export function resolveConn(opts) {
                 : undefined;
         if (b) {
             key = b.key;
-            if (!url)
-                url = b.url;
+            // Unconditional, where this used to be `if (!url)`. Equivalent today — reaching
+            // here means `key` was empty, and both writes to `url` above are key-gated, so it
+            // is empty too — and that is the point: the rule "a keystore key rides the keystore
+            // url" is stated here outright rather than left resting on that invariant, so
+            // restoring an unpaired url above cannot quietly resurrect the RTSC-800 redirect.
+            url = b.url;
         }
     }
     return { key, url: url || opts.defaultUrl || "" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.39.0",
+  "version": "1.39.1",
   "description": "Retasc CLI — the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {