@retasc/cli 1.47.0 → 1.48.0

package/CHANGELOG.md

@@ -6,6 +6,27 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.48.0 (2026-09-08)
+
+- **RTSC-859** — `retasc key mint --hosted`: a key now says at mint what it is for.
+  `workspace` (the default, and what every bind door says explicitly) expects the local
+  watchdog; `hosted` is for a cloud agent or CI that will never have one.
+
+  Why: a workspace key sent raw to the server with no proxy is two things at once and the
+  server cannot tell which, a hosted agent working as documented or a laptop whose config
+  went stale. Both got the same advice on every claim, run `bind`, which a hosted agent
+  cannot do. With `kind` on the row, a hosted key is told the one true thing (renew your
+  own leases) and shows "no folder (hosted)" on the Agents page as a fact rather than a
+  gap; a workspace key with no runner gets the firm remedy, because for that row it is
+  true. A key that said nothing, which includes every key minted before this and any bare
+  `key mint` since, keeps the old hedged text, since nothing on the row can say which it
+  is. `--hosted` and `--install` are refused together: one wires a local watchdog, the
+  other says there will never be one.
+
+  `retasc mcp install --no-watchdog` is not deprecated (it writes exactly a hosted
+  deployment's config) but now says, once, that a key used that way should be minted
+  `--hosted`.
+
 ## 1.47.0 (2026-09-08)
 
 - **RTSC-864** — `retasc key mint` now prints every remote-key config block a hosted

package/dist/commands/bind.js

@@ -515,6 +515,9 @@ export async function completeWorkspaceSetup(args) {
             projectId: projectId,
             agentName: opts.agent,
             runtime: opts.runtime ?? "claude-code",
+            // RTSC-859 — bind is the folder door, so this is a workspace key, and the row
+            // says so rather than leaving it to the server's default.
+            kind: "workspace",
             // RTSC-810 — named after the FOLDER, the leaf only, exactly as the setup-token
             // door has done since RTSC-532: the Keys list is the folder map (`client-a →
             // ENG`), and the old prefix-plus-"key" name told nobody which folder held it.

package/dist/commands/mcp.js

@@ -267,6 +267,15 @@ export function installMcp(opts) {
         console.log("Two things it does not cover, both safe (they fall back to the normal 30-minute lease timeout): if the proxy stops, renewal stops; and a claim made elsewhere — another terminal, direct HTTP MCP, or a previous proxy before a restart — is renewed by nobody. Heartbeat or checkpoint those yourself.");
         return;
     }
+    // RTSC-859 — this is the direct HTTP form, no watchdog, which is exactly a HOSTED
+    // deployment's shape. It is the correct config for one (RTSC-864 documents it), and it
+    // is NOT deprecated. But the key it wires does not know what it is for unless it was
+    // minted `--hosted`, and a workspace key used this way is told on every claim to go
+    // and wire the watchdog it is deliberately running without. Say so once, here, where
+    // the choice is being made, rather than warning on every claim afterwards.
+    console.log("\nNo watchdog: nothing on a machine will renew this key's claims. If this key runs " +
+        "from a cloud agent or CI, mint it with `retasc key mint --hosted` so Retasc knows " +
+        "and stops advising it to run `bind`; a hosted key is expected to heartbeat itself.");
     const res = tryClaudeCli(opts.url, opts.key, scope);
     if (res.ok) {
         console.log(`✓ Registered MCP server "${SERVER_NAME}" with Claude Code (scope: ${scope}).`);

package/dist/index.js

@@ -365,10 +365,22 @@ key
     .option("--agent <name>", "Agent member name (default: auto, \"{you}'s {runtime}\")")
     .option("--runtime <runtime>", "Label for this agent in the Dash (claude-code | codex | grok | …). Does NOT choose where MCP config is written — `retasc setup` wires every harness on the machine.", "claude-code")
     .option("--name <label>", "Key label")
+    // RTSC-859 — say at mint that this key will never have a local runner. Without it
+    // the server cannot tell a cloud agent working as documented from a laptop whose
+    // config went stale, and hands both the same advice: run `bind`, which a hosted
+    // agent cannot.
+    .option("--hosted", "This key runs somewhere with no local install (a cloud agent, CI): never told to run bind, never mistaken for a stale setup")
     .option("--install", "Also wire the key into your agent via MCP")
     .option("--scope <scope>", "MCP install scope if --install: local | project", "local")
     .action(async (opts) => {
     requireLogin();
+    // RTSC-859 — the two flags contradict each other. `--install` wires a local watchdog;
+    // `--hosted` declares there will never be one. Accepting both produced a row the Dash
+    // labelled "no local watchdog" for a laptop that was running one, silenced its
+    // stale-CLI nudge, and had the proxy's `name_workspace` refused on every start.
+    if (opts.hosted && opts.install) {
+        fail(new Error("--hosted and --install contradict each other: --install wires a local watchdog, --hosted says this key will never have one. Pick one."));
+    }
     try {
         const res = (await api.mintKey({
             orgId: opts.orgId,
@@ -376,6 +388,14 @@ key
             agentName: opts.agent,
             runtime: opts.runtime,
             keyName: opts.name,
+            // RTSC-859 — said only when the caller actually said something. `--hosted` is
+            // the word for a cloud agent or CI. `--install` wires the watchdog right here, so
+            // that key is a workspace key by construction. A BARE `key mint` says nothing:
+            // it is the documented hosted path (RTSC-864, llms.txt) AND the manual-wiring
+            // path, and stamping `workspace` on it sent every cloud agent minted that way a
+            // firm "re-run bind in that folder" for a folder that never existed. Absent keeps
+            // the honest hedge, which is exactly right for a key we know nothing about.
+            ...(opts.hosted ? { kind: "hosted" } : opts.install ? { kind: "workspace" } : {}),
         }));
         console.log(`✓ Minted key: ${res.key}`);
         console.log("  (Shown once — store it now.)");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.47.0",
+  "version": "1.48.0",
   "description": "Retasc CLI — the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {