@retasc/cli 1.48.0 → 1.48.1

package/CHANGELOG.md

@@ -6,6 +6,28 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.48.1 (2026-09-08)
+
+- **RTSC-878** — `retasc doctor` no longer condemns the entry `retasc setup` writes. Its
+  machine-global check dated from RTSC-91, when every top-level `mcpServers.retasc` carried
+  a key or a workspace id and so routed every unbound folder to one org; presence alone was
+  a correct test for that. RTSC-780 then made one global entry mandatory, the keyless `auto`
+  marker, which carries no identity at all, and the check was never taught the difference.
+  Doctor therefore printed `✗ GLOBAL Retasc server registered` at the marker and offered
+  `claude mcp remove -s user retasc` as the fix, which strips Retasc from every folder
+  without a binding of its own. It cost a customer a day.
+- The check now reads the entry's identity: `RETASC_WORKSPACE=auto` with no key resolved is
+  reported as correct and named, so someone who just ran `setup` can see that what it wrote
+  is what belongs there. Every other shape stays illegal, including a keyless entry that
+  names a real `ws_` workspace, which still routes every unbound folder to one binding.
+- The exemption is not granted on the sentinel alone. `parseServerEntry` reads
+  `RETASC_WORKSPACE` before it looks for a key in an `Authorization` header or in
+  `RETASC_MCP_KEY`, so an entry carrying both the `auto` sentinel and a real credential
+  parses as an innocent keyless marker; judging the parse alone would have exempted a live
+  machine-global registration pointing every unbound folder at that key's org. The raw
+  entry is examined too, and anything carrying credential material or a `url` of its own
+  stays illegal whatever its `env` claims.
+
 ## 1.48.0 (2026-09-08)
 
 - **RTSC-859** — `retasc key mint --hosted`: a key now says at mint what it is for.

package/dist/commands/doctor.js

@@ -1,6 +1,6 @@
 import { loadConfig } from "../config.js";
 import { claudeConfigPath, isNetworkError, readGlobalBinding, readLocalBinding, readShadowedBinding, resolveBinding, sameIdentity, } from "../lib/binding.js";
-import { getBinding } from "../lib/keystore.js";
+import { AUTO_WORKSPACE, getBinding } from "../lib/keystore.js";
 import { gitCommonDir } from "../lib/gitRepo.js";
 import { detectHarnesses } from "../lib/harness.js";
 import { runsOk } from "../lib/launcher.js";
@@ -16,8 +16,9 @@ import { clean } from "../lib/text.js";
 // binding, which teaches people to distrust everything else it says. When both
 // exist, we report the claude-local one (what Claude Code actually runs;
 // local > project) and warn if a shadowed folder marker disagrees. The
-// illegal-global check is presence-based and never prints an all-clear it
-// can't prove (unreadable config ≠ no global server).
+// illegal-global check reads the entry's IDENTITY, not merely its presence
+// (RTSC-878), and never prints an all-clear it can't prove (unreadable config
+// ≠ no global server).
 const ok = (m) => console.log(`  ✓ ${m}`);
 const warn = (m) => console.log(`  ! ${m}`);
 const bad = (m) => console.log(`  ✗ ${m}`);
@@ -48,6 +49,65 @@ export function launcherVerdict(local, probe = runsOk) {
         shown: clean([local.command, ...probeArgs].join(" ")),
     };
 }
+/**
+ * RTSC-878: is the machine-global entry a real registration, or the marker `setup` writes?
+ *
+ * The old rule was presence alone, and it was correct when it was written (RTSC-91): every
+ * top-level `mcpServers.retasc` then carried a key or a workspace id, so any of them routed
+ * every unbound folder on the disk to one org. RTSC-780 changed that world by making ONE
+ * global entry mandatory, the keyless `auto` marker, which carries no identity at all: the
+ * proxy resolves the folder it was spawned in and the org still comes from the folder.
+ *
+ * Doctor kept the old rule and so told people to delete what `retasc setup` had just
+ * installed. Following that advice strips Retasc from every folder without a binding of its
+ * own, and it happened to a real customer before this was fixed.
+ *
+ * The test is the marker's OWN sentinel rather than a shape heuristic: `RETASC_WORKSPACE`
+ * is `auto` and no key resolved from it. Workspace ids are `ws_`-prefixed uuids
+ * (`keystore.ts`), so `auto` can never be one, and an entry naming a real workspace stays
+ * illegal exactly as before.
+ *
+ * The sentinel alone is NOT enough, and this is the trap the exemption has to survive.
+ * `parseServerEntry` reads `RETASC_WORKSPACE` BEFORE it looks for a key in an
+ * `Authorization` header or in `RETASC_MCP_KEY`, so an entry that carries BOTH the `auto`
+ * sentinel and a real credential parses as an innocent keyless marker. That shape is a
+ * live machine-global registration pointing every unbound folder at whatever org its key
+ * names, which is the exact fault this check exists to catch, and it is not theoretical:
+ * `lib/harness.ts` records an agent hand-writing a machine-global entry with an inline key.
+ * So the raw entry is examined too, and anything carrying credential material or its own
+ * endpoint is illegal no matter what its `env` claims.
+ */
+export function globalVerdict(global) {
+    if (global.status === "none")
+        return "clear";
+    if (global.status === "unreadable")
+        return "unreadable";
+    const b = global.binding;
+    if (b && b.workspaceId === AUTO_WORKSPACE && !b.key && isBareMarker(global.raw))
+        return "auto";
+    return "illegal";
+}
+/**
+ * Does the entry as written carry nothing but the `auto` sentinel?
+ *
+ * Deliberately a DENYLIST of credential-bearing and endpoint-bearing fields rather than an
+ * exact-shape match: `setup` may add a field to the marker later (it already grew `env`
+ * once), and an exemption that broke on every such addition would be reverted rather than
+ * updated. What must never be exempt is an entry that can reach a server on its own terms:
+ * a key in `env`, a key in a header, or a `url` of its own.
+ */
+function isBareMarker(raw) {
+    if (!raw || typeof raw !== "object")
+        return false;
+    const e = raw;
+    if (e.url !== undefined)
+        return false;
+    if (e.headers !== undefined)
+        return false;
+    if (e.env && typeof e.env === "object" && e.env.RETASC_MCP_KEY !== undefined)
+        return false;
+    return true;
+}
 /**
  * RTSC-498: macOS is the only platform this CLI is tested on. That was true and written
  * down nowhere, which left someone on Linux or Windows unable to tell their own mistake
@@ -192,22 +252,34 @@ export async function doctorAction() {
     }
     // 2) The safety check: any illegal machine-global Retasc server?
     const global = readGlobalBinding();
-    if (global.status === "none") {
+    // Pulled out once: the verdict below is computed from the same entry, and reading it
+    // through the union again inside a branch loses the `present` narrowing.
+    const entry = global.status === "present" ? global.binding : undefined;
+    const verdict = globalVerdict(global);
+    if (verdict === "clear") {
         ok("no illegal global Retasc server.");
     }
-    else if (global.status === "unreadable") {
+    else if (verdict === "auto") {
+        // RTSC-878: the entry `retasc setup` writes, and the one state doctor used to
+        // condemn. Named rather than passed over in silence: someone who just ran `setup`
+        // should see that the thing it wrote is the thing that is supposed to be there.
+        ok("machine-wide Retasc entry is the keyless `auto` marker `retasc setup` writes;\n" +
+            "    it names no org, so every folder still resolves its own binding.");
+    }
+    else if (verdict === "unreadable") {
         warn("could not parse Claude Code's config — cannot verify there is no global Retasc server\n" +
             "    (a local-scope binding for this folder would be invisible too).");
     }
     else {
         // Name the org it points at when we can: "leaks across orgs" is abstract,
-        // "every unbound folder gets org X" is what makes someone act. Presence
-        // alone is the finding — a keyless entry is still an illegal registration —
-        // and if the network already failed above, don't burn another timeout.
+        // "every unbound folder gets org X" is what makes someone act. A keyless entry
+        // that names a WORKSPACE is still illegal (it routes every unbound folder to that
+        // one binding); only the identity-free `auto` marker above is not. If the network
+        // already failed above, don't burn another timeout.
         let points = "";
-        if (global.binding?.key && !networkDown) {
+        if (entry?.key && !networkDown) {
             try {
-                const b = await resolveBinding(global.binding.url || cfg.mcpUrl, global.binding.key);
+                const b = await resolveBinding(entry.url || cfg.mcpUrl, entry.key);
                 points = ` It points at org "${clean(b.org.name)}".`;
             }
             catch {

package/dist/lib/binding.js

@@ -213,7 +213,7 @@ export function readGlobalBinding() {
     const raw = doc?.mcpServers?.retasc;
     if (!raw)
         return { status: "none" };
-    return { status: "present", binding: parseServerEntry(raw, "global") };
+    return { status: "present", binding: parseServerEntry(raw, "global"), raw };
 }
 /** Two per-folder bindings are the SAME binding if they agree on workspace id
  *  (canonical form) or on the literal key (legacy forms). Anything else — or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.48.0",
+  "version": "1.48.1",
   "description": "Retasc CLI — the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {