@retasc/cli 1.39.3 → 1.39.4

package/CHANGELOG.md

@@ -6,6 +6,30 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.39.4 (2026-09-03)
+
+- **RTSC-810** — `retasc unbind` revokes the key it says it revokes. It had two faults in
+  one lookup, and each on its own was enough to leave the credential live: it destructured
+  `{ keys }` off `listKeys`, which returns a bare array, and it derived the folder's key
+  prefix with a 12-character slice while the server stores 14. An exact compare between a
+  12-character string and a 14-character one is never true, so every run since `unbind`
+  shipped (RTSC-721) printed "not found server-side (already revoked, or the org is
+  gone)" and moved on. The length now mirrors the server's own `displayPrefixOf`, and the
+  test reads that file, so the two cannot drift apart again. A session child key can no
+  longer be the one revoked either: those are minted in memory by the proxy and never
+  reach the keystore, so a match on one would mean revoking a key this folder does not own.
+- **RTSC-810** — `retasc bind --org-id X --project-id Y` learns the project's prefix. The
+  provisioning form skipped every branch that looks a project up, so nothing knew the
+  prefix: the key went out nameless, the keystore entry was written without `prefix` or
+  `orgName`, and the receipt card printed an empty one. It now resolves the project the
+  same way the interactive pickers do.
+- **RTSC-810** — a key is named after the folder it was bound in, not after the project.
+  The Keys list is the folder map (`client-a` → `ENG`), which is what tells you which
+  machine a credential belongs to; `ENG key` on every row told nobody anything. Naming is
+  the server's job now, so no door can store a nameless key: the Dash mint form with the
+  name left blank and `retasc key mint` without `--name` both fall back to the project's
+  own name rather than leaving the Dash to print "Unnamed key".
+
 ## 1.39.3 (2026-09-02)
 
 - **RTSC-801** — (security) `save_attachment_file` no longer reads a workspace's own secrets,

package/dist/commands/bind.js

@@ -455,6 +455,20 @@ export async function completeWorkspaceSetup(args) {
             throw new Error("no project selected — pass --project-id <id>, or --project <name> --prefix <PFX>.");
         }
     }
+    // RTSC-810 — a `--project-id` skipped every branch above, so nothing here knew the
+    // project's prefix: the key went out nameless (`keyName` was built from `prefix`), the
+    // keystore entry was written without `prefix`/`orgName`, and the receipt card printed
+    // an empty one. The provisioning form is documented and supported, so it fills the
+    // gap the way the pickers do: one list call. Best-effort on the match — a scoped
+    // member may hold an id the list does not show, and that folder still has to bind.
+    if (projectId && !prefix) {
+        const { projects } = (await api.listProjects({ orgId }));
+        const hit = (projects ?? []).find((p) => p.id === projectId);
+        if (hit) {
+            prefix = hit.prefix;
+            emptyProject = projectIsEmpty(hit);
+        }
+    }
     // --- make `retasc` durable BEFORE anything is committed (RTSC-493) ---------
     // The marker names a command something else spawns on every agent start, so it has to
     // name one proved to run on this machine. Resolved (and announced) here so the install
@@ -501,7 +515,12 @@ export async function completeWorkspaceSetup(args) {
             projectId: projectId,
             agentName: opts.agent,
             runtime: opts.runtime ?? "claude-code",
-            keyName: prefix ? `${prefix} key` : undefined,
+            // RTSC-810 — named after the FOLDER, the leaf only, exactly as the setup-token
+            // door has done since RTSC-532: the Keys list is the folder map (`client-a →
+            // ENG`), and the old prefix-plus-"key" name told nobody which folder held it.
+            // The server cleans the name and falls back to the project's own when the
+            // leaf is empty.
+            keyName: basename(cwd),
         }));
     // The key is named in the receipt card below, not here — one mention, in the place
     // that says where it went (RTSC-673).

package/dist/commands/unbind.js

@@ -27,6 +27,35 @@ import { removeProjectMarker, tryClaudeCliRemove } from "./mcp.js";
  *   • **The session is left alone.** Signing out is `logout`'s job; conflating the two
  *     turns "detach this folder" into "log me out everywhere", which nobody asked.
  */
+/**
+ * The prefix the SERVER stored for a raw key — `displayPrefixOf` in `convex/lib/keys.ts`,
+ * mirrored here because the CLI cannot import backend code.
+ *
+ * RTSC-810: this length is the join `unbind` revokes on, and it was wrong. The local side
+ * sliced 12 while the server stores 14, so the exact compare was never true once, and
+ * `unbind` reported "not found server-side" on every run while leaving the key LIVE —
+ * the same outcome as the `{ keys }` destructure below, from the other half of the same
+ * lookup. A change to the server's slice has to change this one; `unbindRevoke810.test.mjs`
+ * reads `convex/lib/keys.ts` and fails if the two ever disagree again.
+ */
+export const DISPLAY_PREFIX_LEN = 14;
+export function displayPrefixOf(key) {
+    return key.slice(0, DISPLAY_PREFIX_LEN);
+}
+/**
+ * This folder's live key among the org's, by display prefix — the join `unbind` revokes
+ * on. Takes the ARRAY `listKeys` returns; anything else is "nothing to revoke", never a
+ * throw, because the caller's fallback is to name the Dash rather than to fail.
+ *
+ * WORKSPACE keys only: a session child (`parentKeyId` set) is minted in memory by the
+ * proxy and never reaches the keystore, so one matching here would mean revoking a key
+ * this folder does not own.
+ */
+export function liveKeyFor(keys, prefix) {
+    if (!Array.isArray(keys) || !prefix)
+        return undefined;
+    return keys.find((k) => k?.displayPrefix === prefix && !k.revokedAt && !k.parentKeyId && typeof k.id === "string");
+}
 export async function unbindAction(opts) {
     const cwd = process.cwd();
     const existing = readLocalBinding(cwd);
@@ -35,7 +64,7 @@ export async function unbindAction(opts) {
         return;
     }
     const entry = existing.workspaceId ? getBinding(existing.workspaceId) : undefined;
-    const keyPrefix = (entry?.key ?? existing.key ?? "").slice(0, 12);
+    const keyPrefix = displayPrefixOf(entry?.key ?? existing.key ?? "");
     console.log(`This will disconnect ${cwd} from Retasc:`);
     if (entry?.orgName || entry?.prefix) {
         console.log(`  bound to: ${entry.orgName ?? entry.orgId} / ${entry.prefix ?? entry.projectId}`);
@@ -58,14 +87,18 @@ export async function unbindAction(opts) {
         return;
     }
     // Revoke FIRST, while the keystore still holds what identifies the key. displayPrefix
-    // is how the server names keys (the raw value is never stored there), so the first 12
-    // chars of ours is the join.
+    // is how the server names keys (the raw value is never stored there), so the first
+    // DISPLAY_PREFIX_LEN chars of ours is the join — the server's own slice, not a shorter
+    // guess at it (RTSC-810).
     if (entry?.orgId && keyPrefix && isLoggedIn()) {
         try {
-            const { keys } = (await api.listKeys({ orgId: entry.orgId }));
-            const mine = (keys ?? []).find((k) => k.displayPrefix === keyPrefix && !k.revokedAt);
+            // RTSC-810 — `listKeys` returns a bare ARRAY (as `retasc key list` has always
+            // read it). This destructured `{ keys }` off it, got `undefined`, and so every
+            // unbind since RTSC-721 printed "not found server-side" and left the key LIVE —
+            // the exact half of hand-editing the command exists to stop.
+            const mine = liveKeyFor(await api.listKeys({ orgId: entry.orgId }), keyPrefix);
             if (mine) {
-                await api.revokeKey({ keyId: mine.id ?? mine._id });
+                await api.revokeKey({ keyId: mine.id });
                 console.log(`✓ Revoked key ${keyPrefix}… server-side.`);
             }
             else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.39.3",
+  "version": "1.39.4",
   "description": "Retasc CLI — the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {