@inerrata-corporation/errata 2.0.0-dev.32 → 2.0.0-dev.34

package/errata.mjs

@@ -20434,6 +20434,37 @@ async function postToken(fetchFn, tokenEndpoint, params, timeoutMs = 15e3) {
     clearTimeout(tid);
   }
 }
+async function registerOAuthClient(fetchFn, registrationEndpoint, p, timeoutMs = 15e3) {
+  const ac = new AbortController();
+  const tid = setTimeout(() => ac.abort(), timeoutMs);
+  try {
+    const res = await fetchFn(registrationEndpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        accept: "application/json"
+      },
+      body: JSON.stringify({
+        redirect_uris: [p.redirectUri],
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        client_name: p.clientName ?? "errata daemon",
+        scope: p.scope
+      }),
+      signal: ac.signal
+    });
+    if (!res.ok) {
+      const text = await res.text();
+      throw new Error(`client registration failed: HTTP ${res.status} ${text.slice(0, 200)}`);
+    }
+    const j = await res.json();
+    if (!j.client_id) throw new Error("client registration returned no client_id");
+    return { clientId: j.client_id };
+  } finally {
+    clearTimeout(tid);
+  }
+}
 function exchangeAuthorizationCode(fetchFn, tokenEndpoint, p) {
   return postToken(fetchFn, tokenEndpoint, {
     grant_type: "authorization_code",
@@ -20921,6 +20952,7 @@ function defaultConfig() {
     accessToken: null,
     refreshToken: null,
     tokenEndpoint: null,
+    oauthClientId: null,
     userId: null,
     email: null,
     consent: { sync: false, telemetry: false, contributePackages: false },
@@ -21189,7 +21221,7 @@ function authedCloudClient(cfg, opts = {}) {
       ...tokenEndpoint && cfg.refreshToken ? {
         refreshFn: (rt) => refreshAccessToken(opts.fetchFn ?? fetch, tokenEndpoint, {
           refreshToken: rt,
-          clientId: oauthClientId()
+          clientId: cfg.oauthClientId ?? oauthClientId()
         }),
         // Persist the rotated tokens so the next process starts fresh.
         onTokens: (t) => {
@@ -41846,7 +41878,7 @@ function startLoopLagMonitor(thresholdMs = 1e3) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.0-dev.32" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.0-dev.34" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -43037,6 +43069,7 @@ async function startDaemon(opts) {
     merged.accessToken = null;
     merged.refreshToken = null;
     merged.tokenEndpoint = null;
+    merged.oauthClientId = null;
   }
   const cloud = authedCloudClient(merged);
   let webUiUrl = "";
@@ -43801,6 +43834,7 @@ async function startMultiDaemon(opts = {}) {
     initialCfg.accessToken = null;
     initialCfg.refreshToken = null;
     initialCfg.tokenEndpoint = null;
+    initialCfg.oauthClientId = null;
   }
   const cloud = authedCloudClient(initialCfg, { timeoutMs: CLOUD_TIMEOUT_MS });
   const cloudNow = () => {
@@ -43812,6 +43846,7 @@ async function startMultiDaemon(opts = {}) {
       current.accessToken = null;
       current.refreshToken = null;
       current.tokenEndpoint = null;
+      current.oauthClientId = null;
     }
     return authedCloudClient(current, { timeoutMs: CLOUD_TIMEOUT_MS });
   };
@@ -44424,6 +44459,7 @@ init_cloud_endpoint_policy();
 init_src6();
 init_cloud_auth();
 import { createServer } from "node:http";
+var DEFAULT_OAUTH_SCOPE = "openid profile graph:read graph:write mcp:tools";
 var strip = (u) => u.replace(/\/+$/, "");
 async function discoverEndpoints(cloudUrl, fetchFn = fetch) {
   let consoleUrl = cloudUrl;
@@ -44440,7 +44476,11 @@ async function discoverEndpoints(cloudUrl, fetchFn = fetch) {
     if (asm.ok) {
       const j = await asm.json();
       if (j.authorization_endpoint && j.token_endpoint) {
-        return { authorizationEndpoint: j.authorization_endpoint, tokenEndpoint: j.token_endpoint };
+        return {
+          authorizationEndpoint: j.authorization_endpoint,
+          tokenEndpoint: j.token_endpoint,
+          ...j.registration_endpoint ? { registrationEndpoint: j.registration_endpoint } : {}
+        };
       }
     }
   } catch {
@@ -44467,8 +44507,8 @@ async function loginOAuthLoopback(opts) {
   const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
   const pkce = generatePkce();
   const state = randomState();
-  const clientId = oauthClientId();
-  const { code, redirectUri } = await new Promise(
+  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
+  const { code, redirectUri, clientId } = await new Promise(
     (resolve5, reject) => {
       const server = createServer((req, res) => {
         const u = new URL(req.url ?? "/", "http://127.0.0.1");
@@ -44492,24 +44532,40 @@ async function loginOAuthLoopback(opts) {
         res.writeHead(200, { "content-type": "text/html" });
         res.end("<html><body>inErrata: you're logged in. You can close this tab.</body></html>");
         server.close();
-        resolve5({ code: code2, redirectUri: `http://127.0.0.1:${port}/callback` });
+        resolve5({ code: code2, redirectUri: `http://127.0.0.1:${port}/callback`, clientId: activeClientId });
       });
+      let activeClientId = oauthClientId();
       server.on("error", reject);
       server.listen(0, "127.0.0.1", () => {
-        const addr2 = server.address();
-        const port = typeof addr2 === "object" && addr2 ? addr2.port : 0;
-        const redirectUri2 = `http://127.0.0.1:${port}/callback`;
-        const url2 = buildAuthorizeUrl(endpoints.authorizationEndpoint, {
-          clientId,
-          redirectUri: redirectUri2,
-          scope: opts.scope ?? "openid profile",
-          state,
-          challenge: pkce.challenge,
-          method: pkce.method
-        });
-        if (opts.open) opts.open(url2);
-        else console.log(`approve this login in your browser:
+        void (async () => {
+          try {
+            const addr2 = server.address();
+            const port = typeof addr2 === "object" && addr2 ? addr2.port : 0;
+            const redirectUri2 = `http://127.0.0.1:${port}/callback`;
+            if (endpoints.registrationEndpoint) {
+              const registered = await registerOAuthClient(fetchFn, endpoints.registrationEndpoint, {
+                redirectUri: redirectUri2,
+                scope,
+                clientName: "errata daemon"
+              });
+              activeClientId = registered.clientId;
+            }
+            const url2 = buildAuthorizeUrl(endpoints.authorizationEndpoint, {
+              clientId: activeClientId,
+              redirectUri: redirectUri2,
+              scope,
+              state,
+              challenge: pkce.challenge,
+              method: pkce.method
+            });
+            if (opts.open) opts.open(url2);
+            else console.log(`approve this login in your browser:
   ${url2}`);
+          } catch (err2) {
+            server.close();
+            reject(err2);
+          }
+        })();
       });
       if (opts.timeoutMs) {
         setTimeout(() => {
@@ -44525,7 +44581,7 @@ async function loginOAuthLoopback(opts) {
     redirectUri,
     clientId
   });
-  return { tokens, tokenEndpoint: endpoints.tokenEndpoint };
+  return { tokens, tokenEndpoint: endpoints.tokenEndpoint, clientId };
 }
 
 // src/update.ts
@@ -44617,6 +44673,15 @@ function parseBurstArgs(args2) {
   };
 }
 
+// src/login-mode.ts
+var OAUTH_DEFAULT_ENV = "ERRATA_DAEMON_OAUTH_DEFAULT";
+function isDaemonOAuthDefaultEnabled(env2 = process.env) {
+  return env2[OAUTH_DEFAULT_ENV] === "1";
+}
+function shouldUseOAuthLogin(flags2, env2 = process.env) {
+  return Boolean(flags2.oauth || !flags2.device && isDaemonOAuthDefaultEnabled(env2));
+}
+
 // src/consolidation-trigger.ts
 var DEFAULT_CONSOLIDATION_POLICY = {
   baseFloorMs: 6e4,
@@ -44793,7 +44858,7 @@ Commands:
                       Flags: --port N (default 7891)
   mcp                 Run the MCP stdio server \u2014 the agent's full errata tool
                       surface (navigation, problems, claims, burst, health)
-  login               Sign in with the cloud (OAuth by default; --device for legacy)
+  login               Sign in with the cloud (device-code by default; --oauth for OAuth)
   logout              Clear local cloud credentials
   sync now            Flush outbox to the cloud once
   privacy             Show what is collected/scrubbed + your consent state
@@ -44808,6 +44873,7 @@ Commands:
 Environment:
   ERRATA_CLOUD_URL                Cloud base URL (default ${DEFAULT_CLOUD_URL})
   ERRATA_ALLOW_DIRECT_V1_CLOUD=1  Allow non-local legacy v1 cloud testing
+  ${OAUTH_DEFAULT_ENV}=1       Internal dogfood: plain \`errata login\` uses OAuth
 `);
 }
 function resolveHookPort(explicit) {
@@ -45117,6 +45183,7 @@ async function applyToken(cfg, token) {
     cfg.accessToken = null;
     cfg.refreshToken = null;
     cfg.tokenEndpoint = null;
+    cfg.oauthClientId = null;
     cfg.userId = me.agentId;
     cfg.email = me.handle;
     saveConfig(cfg);
@@ -45158,19 +45225,24 @@ async function cmdLoginOAuth(cfg) {
     process.exitCode = 1;
     return;
   }
-  cfg.accessToken = result.tokens.accessToken;
-  cfg.refreshToken = result.tokens.refreshToken ?? null;
-  cfg.tokenEndpoint = result.tokenEndpoint;
-  cfg.apiKey = null;
-  saveConfig(cfg);
+  const nextCfg = {
+    ...cfg,
+    accessToken: result.tokens.accessToken,
+    refreshToken: result.tokens.refreshToken ?? null,
+    tokenEndpoint: result.tokenEndpoint,
+    oauthClientId: result.clientId,
+    apiKey: null
+  };
   try {
-    const me = await authedCloudClient(cfg).me();
-    cfg.userId = me.agentId;
-    cfg.email = me.handle;
-    saveConfig(cfg);
+    const me = await authedCloudClient(nextCfg).me();
+    nextCfg.userId = me.agentId;
+    nextCfg.email = me.handle;
+    saveConfig(nextCfg);
     console.log(`logged in as ${me.handle} (${me.tier}) \u2014 tokens stored at ${globalConfigPath()}`);
   } catch (err2) {
-    console.warn(`signed in, but identity check failed: ${err2 instanceof Error ? err2.message : err2}`);
+    console.error(`signed in, but identity check failed: ${err2 instanceof Error ? err2.message : err2}`);
+    console.error(`  credentials were not stored; try again or paste a key:  errata login --token <key>`);
+    process.exitCode = 1;
   }
 }
 async function cmdLogin() {
@@ -45181,7 +45253,7 @@ async function cmdLogin() {
     await applyToken(cfg, flags2.token);
     return;
   }
-  if (flags2.oauth || !flags2.device) {
+  if (shouldUseOAuthLogin(flags2)) {
     await cmdLoginOAuth(cfg);
     return;
   }
@@ -45232,6 +45304,7 @@ async function cmdLogin() {
       cfg.accessToken = null;
       cfg.refreshToken = null;
       cfg.tokenEndpoint = null;
+      cfg.oauthClientId = null;
       cfg.userId = poll.agentId ?? null;
       cfg.email = poll.handle ?? handle2;
       saveConfig(cfg);
@@ -45259,6 +45332,7 @@ async function cmdLogout() {
   cfg.accessToken = null;
   cfg.refreshToken = null;
   cfg.tokenEndpoint = null;
+  cfg.oauthClientId = null;
   cfg.userId = null;
   cfg.email = null;
   saveConfig(cfg);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.0-dev.32",
+  "version": "2.0.0-dev.34",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {