@inerrata-corporation/errata 2.0.0-dev.26 → 2.0.0-dev.27

package/errata.mjs

@@ -20628,7 +20628,7 @@ import { randomUUID as randomUUID2 } from "node:crypto";
 function defaultConfig() {
   return {
     version: 1,
-    cloudUrl: process.env["ERRATA_CLOUD_URL"] ?? "http://localhost:8787",
+    cloudUrl: process.env["ERRATA_CLOUD_URL"] ?? DEFAULT_CLOUD_URL,
     apiKey: null,
     accessToken: null,
     refreshToken: null,
@@ -20674,10 +20674,12 @@ function machineId() {
   saveConfig({ ...cfg, machineId: id });
   return id;
 }
+var DEFAULT_CLOUD_URL;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     init_paths();
+    DEFAULT_CLOUD_URL = "https://inerrata-gateway.onrender.com";
   }
 });
 
@@ -20751,7 +20753,7 @@ function assertDeviceCodeEndpointAllowed(url2, inspection) {
       allowed: false,
       label: "gateway device-code blocked",
       reason: "device-code login mints legacy v1 keys, while gateway launch uses console-issued keys/JWTs",
-      guidance: "Use `errata login --token <console errk_...>` or `errata login --oauth`."
+      guidance: "Use `errata login` for OAuth or `errata login --token <console errk_...>`."
     };
     throw new CloudEndpointPolicyError(formatCloudEndpointBlock(url2, decision), decision);
   }
@@ -20895,6 +20897,7 @@ function authedCloudClient(cfg, opts = {}) {
       accessToken: cfg.accessToken,
       ...cfg.refreshToken ? { refreshToken: cfg.refreshToken } : {},
       fetchFn,
+      ...opts.timeoutMs ? { timeoutMs: opts.timeoutMs } : {},
       ...tokenEndpoint && cfg.refreshToken ? {
         refreshFn: (rt) => refreshAccessToken(opts.fetchFn ?? fetch, tokenEndpoint, {
           refreshToken: rt,
@@ -20913,9 +20916,13 @@ function authedCloudClient(cfg, opts = {}) {
   return new CloudClient({
     baseUrl,
     ...cfg.apiKey ? { apiKey: cfg.apiKey } : {},
-    fetchFn
+    fetchFn,
+    ...opts.timeoutMs ? { timeoutMs: opts.timeoutMs } : {}
   });
 }
+function hasCloudCredential(cfg) {
+  return Boolean(cfg.accessToken || cfg.apiKey);
+}
 var init_cloud_auth = __esm({
   "src/cloud-auth.ts"() {
     "use strict";
@@ -34482,7 +34489,7 @@ function createMcpHandler(store, ctx = {}) {
 function buildToolContext() {
   try {
     const cfg = loadConfig();
-    if (cfg.consent.sync && cfg.apiKey && cfg.cloudUrl) {
+    if (cfg.consent.sync && hasCloudCredential(cfg) && cfg.cloudUrl) {
       return { cloud: authedCloudClient(cfg) };
     }
   } catch {
@@ -40858,11 +40865,11 @@ var TelemetryRecorder = class {
     return out2;
   }
   /**
-   * Flush to the cloud iff consent + apiKey are present. Returns how many were
+   * Flush to the cloud iff consent + a cloud credential are present. Returns how many were
    * accepted (0 when skipped). On network failure the batch is re-queued.
    */
   async flush(cloud, opts) {
-    if (!opts.consent || !opts.apiKey) {
+    if (!opts.consent || !opts.credentialPresent) {
       this.drain();
       return { sent: 0, skipped: true };
     }
@@ -41156,6 +41163,7 @@ function autodetectProfile(root) {
 
 // src/engine.ts
 init_config();
+init_cloud_auth();
 
 // src/notify.ts
 init_config();
@@ -41274,7 +41282,7 @@ function maybeFlushDigests() {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.0-dev.26" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.0-dev.27" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -42277,7 +42285,7 @@ function createWorkspaceEngine(opts) {
         }
         const t = await telemetry.flush(cloud, {
           consent: freshCfg.consent.telemetry,
-          apiKey: opts.apiKey ?? freshCfg.apiKey
+          credentialPresent: Boolean(opts.apiKey) || hasCloudCredential(freshCfg)
         });
         if (t.sent > 0) {
           console.log(`[errata] telemetry: ${t.sent} events sent`);
@@ -42314,6 +42322,8 @@ async function startDaemon(opts) {
   if (opts.apiKey) {
     merged.apiKey = opts.apiKey;
     merged.accessToken = null;
+    merged.refreshToken = null;
+    merged.tokenEndpoint = null;
   }
   const cloud = authedCloudClient(merged);
   let webUiUrl = "";
@@ -42463,7 +42473,6 @@ function pidAlive(pid) {
 
 // src/multi.ts
 init_dist();
-init_src6();
 init_src4();
 import { readFileSync as readFileSync17, unlinkSync as unlinkSync3, writeFileSync as writeFileSync14 } from "node:fs";
 
@@ -43064,6 +43073,7 @@ function isDaemonAlive(lockPath) {
 // src/multi.ts
 init_config();
 init_cloud_endpoint_policy();
+init_cloud_auth();
 function normPath(p) {
   return p.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
 }
@@ -43098,21 +43108,25 @@ async function startMultiDaemon(opts = {}) {
   const cfg = loadConfig();
   const CLOUD_TIMEOUT_MS = 12e4;
   const initialCloudUrl = normalizeCloudUrl(opts.cloudUrl ?? cfg.cloudUrl);
-  const cloud = new CloudClient({
-    baseUrl: initialCloudUrl,
-    timeoutMs: CLOUD_TIMEOUT_MS,
-    fetchFn: guardCloudFetch(initialCloudUrl),
-    ...opts.apiKey ?? cfg.apiKey ? { apiKey: opts.apiKey ?? cfg.apiKey ?? void 0 } : {}
-  });
+  const initialCfg = { ...cfg, cloudUrl: initialCloudUrl };
+  if (opts.apiKey) {
+    initialCfg.apiKey = opts.apiKey;
+    initialCfg.accessToken = null;
+    initialCfg.refreshToken = null;
+    initialCfg.tokenEndpoint = null;
+  }
+  const cloud = authedCloudClient(initialCfg, { timeoutMs: CLOUD_TIMEOUT_MS });
   const cloudNow = () => {
     const c = loadConfig();
     const baseUrl2 = normalizeCloudUrl(opts.cloudUrl ?? c.cloudUrl);
-    return new CloudClient({
-      baseUrl: baseUrl2,
-      timeoutMs: CLOUD_TIMEOUT_MS,
-      fetchFn: guardCloudFetch(baseUrl2),
-      ...opts.apiKey ?? c.apiKey ? { apiKey: opts.apiKey ?? c.apiKey ?? void 0 } : {}
-    });
+    const current = { ...c, cloudUrl: baseUrl2 };
+    if (opts.apiKey) {
+      current.apiKey = opts.apiKey;
+      current.accessToken = null;
+      current.refreshToken = null;
+      current.tokenEndpoint = null;
+    }
+    return authedCloudClient(current, { timeoutMs: CLOUD_TIMEOUT_MS });
   };
   const sharedDbPath = sharedStorePath();
   ensureParent(sharedDbPath);
@@ -43813,7 +43827,7 @@ async function loginOAuthLoopback(opts) {
       if (opts.timeoutMs) {
         setTimeout(() => {
           server.close();
-          reject(new Error("login timed out \u2014 run `errata login --oauth` again"));
+          reject(new Error("login timed out \u2014 run `errata login` again"));
         }, opts.timeoutMs).unref?.();
       }
     }
@@ -44087,8 +44101,8 @@ Commands:
                       Flags: --port N (default 7891)
   mcp                 Run the MCP stdio server \u2014 the agent's full errata tool
                       surface (navigation, problems, claims, burst, health)
-  login               Register or sign in with the cloud
-  logout              Clear local API key
+  login               Sign in with the cloud (OAuth by default; --device for legacy)
+  logout              Clear local cloud credentials
   sync now            Flush outbox to the cloud once
   privacy             Show what is collected/scrubbed + your consent state
   consent <channel> <on|off>
@@ -44100,7 +44114,7 @@ Commands:
                       Desktop toasts on problem open/resolve + review ready
 
 Environment:
-  ERRATA_CLOUD_URL                Cloud base URL (default http://localhost:8787)
+  ERRATA_CLOUD_URL                Cloud base URL (default ${DEFAULT_CLOUD_URL})
   ERRATA_ALLOW_DIRECT_V1_CLOUD=1  Allow non-local legacy v1 cloud testing
 `);
 }
@@ -44188,7 +44202,7 @@ async function cmdInit() {
   console.log("");
   console.log("Next:");
   console.log("  errata start                 # observe this repo");
-  if (!cfgNow.apiKey) {
+  if (!hasCloudCredential(cfgNow)) {
     console.log("  errata login                 # connect a cloud account (or: --token <key>)");
   }
   if (!cfgNow.consent.sync) {
@@ -44288,7 +44302,7 @@ async function cmdStatus() {
   );
   console.log(`  cloud:`);
   console.log(`    url:    ${cfg.cloudUrl}`);
-  console.log(`    logged in: ${cfg.apiKey || cfg.accessToken ? `yes (${cfg.email})` : "no"}`);
+  console.log(`    logged in: ${hasCloudCredential(cfg) ? `yes (${cfg.email})` : "no"}`);
   const inspection = await inspectCloudEndpoint(cfg.cloudUrl);
   const decision = evaluateCloudEndpoint(cfg.cloudUrl, inspection);
   const service = inspection.service ? ` \xB7 service ${inspection.service}` : "";
@@ -44297,7 +44311,7 @@ async function cmdStatus() {
     console.log(`    policy: blocked - ${decision.reason}`);
     if (decision.guidance) console.log(`      ${decision.guidance}`);
   }
-  if (cfg.apiKey || cfg.accessToken) {
+  if (hasCloudCredential(cfg)) {
     if (!decision.allowed) {
       console.log(
         `    reachable: ${inspection.reachable ? `yes (${inspection.probe})` : `no (${inspection.error ?? "unreachable"})`}`
@@ -44381,6 +44395,7 @@ function parseFlags(args2) {
     else if (a === "--token") out2.token = args2[++i2];
     else if (a.startsWith("--token=")) out2.token = a.slice("--token=".length);
     else if (a === "--oauth") out2.oauth = true;
+    else if (a === "--device") out2.device = true;
     else if (!a.startsWith("--")) out2._.push(a);
   }
   return out2;
@@ -44406,6 +44421,9 @@ async function applyToken(cfg, token) {
   try {
     const me = await c.me();
     cfg.apiKey = token;
+    cfg.accessToken = null;
+    cfg.refreshToken = null;
+    cfg.tokenEndpoint = null;
     cfg.userId = me.agentId;
     cfg.email = me.handle;
     saveConfig(cfg);
@@ -44442,7 +44460,7 @@ async function cmdLoginOAuth(cfg) {
     result = await loginOAuthLoopback({ cloudUrl: cfg.cloudUrl, timeoutMs: 5 * 6e4 });
   } catch (err2) {
     console.error(`oauth login failed: ${err2 instanceof Error ? err2.message : err2}`);
-    console.error(`  fall back to device code:  errata login`);
+    console.error(`  fall back to device code:  errata login --device`);
     console.error(`  or paste a key:            errata login --token <key>`);
     process.exitCode = 1;
     return;
@@ -44450,6 +44468,7 @@ async function cmdLoginOAuth(cfg) {
   cfg.accessToken = result.tokens.accessToken;
   cfg.refreshToken = result.tokens.refreshToken ?? null;
   cfg.tokenEndpoint = result.tokenEndpoint;
+  cfg.apiKey = null;
   saveConfig(cfg);
   try {
     const me = await authedCloudClient(cfg).me();
@@ -44469,7 +44488,7 @@ async function cmdLogin() {
     await applyToken(cfg, flags2.token);
     return;
   }
-  if (flags2.oauth) {
+  if (flags2.oauth || !flags2.device) {
     await cmdLoginOAuth(cfg);
     return;
   }
@@ -44517,6 +44536,9 @@ async function cmdLogin() {
     if (poll.status === "pending") continue;
     if (poll.status === "authorized" && poll.apiKey) {
       cfg.apiKey = poll.apiKey;
+      cfg.accessToken = null;
+      cfg.refreshToken = null;
+      cfg.tokenEndpoint = null;
       cfg.userId = poll.agentId ?? null;
       cfg.email = poll.handle ?? handle2;
       saveConfig(cfg);
@@ -44541,6 +44563,9 @@ async function cmdLogin() {
 async function cmdLogout() {
   const cfg = loadConfig();
   cfg.apiKey = null;
+  cfg.accessToken = null;
+  cfg.refreshToken = null;
+  cfg.tokenEndpoint = null;
   cfg.userId = null;
   cfg.email = null;
   saveConfig(cfg);
@@ -44904,7 +44929,7 @@ async function cmdBurst(args2) {
   let ctx = {};
   if (!local) {
     const cfg = loadConfig();
-    if (cfg.apiKey || cfg.accessToken) ctx = { cloud: authedCloudClient(cfg) };
+    if (hasCloudCredential(cfg)) ctx = { cloud: authedCloudClient(cfg) };
   }
   await withStore(async (store) => {
     const result = await runTool2(
@@ -45496,7 +45521,7 @@ async function cmdPrivacy() {
     sync:        ${onoff(cfg.consent.sync)}
     telemetry:   ${onoff(cfg.consent.telemetry)}
     packages:    ${onoff(cfg.consent.contributePackages)}
-    logged in:   ${cfg.apiKey ? `yes (${cfg.email})` : "no"}
+    logged in:   ${hasCloudCredential(cfg) ? `yes (${cfg.email})` : "no"}
 
   Change it:   errata consent sync on | errata consent telemetry off
   Kill switch: errata consent all off   (or  errata logout  to drop your key)
@@ -45519,8 +45544,8 @@ async function cmdConsent(args2) {
   console.log(
     `consent updated \u2192 sync=${cfg.consent.sync ? "on" : "off"} telemetry=${cfg.consent.telemetry ? "on" : "off"} packages=${cfg.consent.contributePackages ? "on" : "off"}`
   );
-  if ((channel === "sync" || channel === "all") && value && !cfg.apiKey) {
-    console.log("  note: run `errata login` to actually upload (no API key yet).");
+  if ((channel === "sync" || channel === "all") && value && !hasCloudCredential(cfg)) {
+    console.log("  note: run `errata login` to actually upload (no cloud credential yet).");
   }
 }
 async function cmdDash(args2) {
@@ -45812,7 +45837,7 @@ async function cmdNotifications(state) {
 }
 async function cmdFeedback(args2) {
   const cfg = loadConfig();
-  if (!cfg.apiKey) {
+  if (!hasCloudCredential(cfg)) {
     console.error("not logged in \u2014 run `errata login` first.");
     process.exit(2);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.0-dev.26",
+  "version": "2.0.0-dev.27",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {