@retasc/cli 1.49.0 → 1.49.1

package/CHANGELOG.md

@@ -6,6 +6,19 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.49.1 (2026-09-09)
+
+- **RTSC-879** — the proxy sends NO `Authorization` header when it has no key, instead of
+  `Bearer ` with nothing after it. An empty bearer is not a weaker credential, it is a
+  malformed one, and where a keyless proxy now runs that difference decides whether the
+  thing works at all: in a Claude Code cloud container the documented way to supply a
+  credential is an environment API credential, which Anthropic's egress proxy injects as
+  an `Authorization` header after the request leaves the VM — and which also lets the
+  request through a network allowlist that would otherwise refuse the host. Injection
+  wants the header absent, and whether it overwrites one already present is undocumented,
+  so sending an empty bearer staked the whole path on undocumented behaviour. With a key
+  present nothing changes.
+
 ## 1.49.0 (2026-09-09)
 
 - **RTSC-879** — a committed `.mcp.json` now names `npx -y @retasc/cli@<version> mcp-proxy`

package/dist/proxy.js

@@ -172,11 +172,34 @@ function runReap(issueId) {
         child.unref?.(); // a pending reap must not keep the proxy alive
     });
 }
+/**
+ * The auth header, or NOTHING when this proxy has no key (RTSC-879).
+ *
+ * `Bearer ` with an empty value is not a weaker credential, it is a malformed one: the
+ * request is worse off for carrying it than for leaving it out. What made that matter is
+ * where a keyless proxy now runs. In a Claude Code cloud container there is no keystore
+ * and no `RETASC_MCP_KEY`, and the documented way to give that container a credential is
+ * an environment API credential, which Anthropic's egress proxy INJECTS as an
+ * `Authorization` header after the request leaves the VM — and which also lets the
+ * request through a network allowlist that would otherwise refuse the host outright.
+ *
+ * Injection wants an absent header. Whether that proxy overwrites one already present is
+ * not documented, so sending an empty Bearer bets the whole path on undocumented
+ * behaviour. Omitting it needs no such bet.
+ *
+ * Nothing else changes: with a key this returns exactly what these call sites sent
+ * before, and a keyless request still fails at Retasc the way it always did — it just
+ * fails honestly, as unauthenticated, rather than as a credential that is present and
+ * blank.
+ */
+function authHeader() {
+    return activeKey ? { Authorization: `Bearer ${activeKey}` } : {};
+}
 async function postRemote(body) {
     const res = await fetch(MCP_URL, {
         method: "POST",
         headers: {
-            Authorization: `Bearer ${activeKey}`,
+            ...authHeader(),
             "Content-Type": "application/json",
             Accept: "application/json",
         },
@@ -465,7 +488,7 @@ async function handleLocalAttach(msg) {
             // No Content-Type on purpose: the server infers it from `filename`, and that inference
             // is better than anything guessed here — declaring octet-stream would REPLACE it and
             // cost the attachment its inline preview.
-            headers: { Authorization: `Bearer ${activeKey}` },
+            headers: authHeader(),
             body: bytes,
         });
         const body = await res.text();
@@ -585,7 +608,7 @@ async function handleLocalFetch(msg) {
         return replyToolResult(msg.id, describe(existing.size, true), false);
     }
     try {
-        const res = await fetch(url, { headers: { Authorization: `Bearer ${activeKey}` } });
+        const res = await fetch(url, { headers: authHeader() });
         if (!res.ok) {
             const body = await res.text();
             log(`download of ${attachment} failed: HTTP ${res.status}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.49.0",
+  "version": "1.49.1",
   "description": "Retasc CLI — the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {