@inerrata-corporation/errata 2.0.0-dev.95 → 2.0.0-dev.97

package/errata.mjs

@@ -22477,10 +22477,7 @@ function evaluateCloudEndpoint(url2, inspection) {
   if (inspection?.kind === "gateway") {
     return { allowed: true, label: "gateway-metered" };
   }
-  if (inspection && !inspection.reachable && looksLikeGatewayCloudUrl(url2)) {
-    return { allowed: true, label: "gateway-configured" };
-  }
-  if (!inspection && looksLikeGatewayCloudUrl(url2)) {
+  if (looksLikeGatewayCloudUrl(url2)) {
     return { allowed: true, label: "gateway-configured" };
   }
   if (isDirectV1OverrideEnabled()) {
@@ -22526,7 +22523,10 @@ async function inspectCloudEndpoint(baseUrl, opts = {}) {
   const local = isLocalCloudUrl(normalized);
   const fetchFn = opts.fetchFn ?? fetch;
   const timeoutMs = opts.timeoutMs ?? PROBE_TIMEOUT_MS;
-  const root = await fetchHealthJson(fetchFn, `${normalized}/health`, timeoutMs);
+  let root = await fetchHealthJson(fetchFn, `${normalized}/health`, timeoutMs);
+  if (!root.ok) {
+    root = await fetchHealthJson(fetchFn, `${normalized}/health`, timeoutMs);
+  }
   if (root.ok && root.body?.service === GATEWAY_SERVICE) {
     return {
       baseUrl: normalized,
@@ -22568,11 +22568,17 @@ async function inspectCloudEndpoint(baseUrl, opts = {}) {
 function guardCloudFetch(baseUrl, fetchFn = fetch) {
   const normalized = normalizeCloudUrl(baseUrl);
   let checked = null;
+  let blockedAt = 0;
   return (async (input, init2) => {
     if (isProtectedCloudRequest(normalized, input)) {
-      checked ??= inspectCloudEndpoint(normalized, { fetchFn }).then(
-        (inspection) => evaluateCloudEndpoint(normalized, inspection)
-      );
+      if (checked && blockedAt && Date.now() - blockedAt >= BLOCKED_RECHECK_MS) {
+        checked = null;
+      }
+      checked ??= inspectCloudEndpoint(normalized, { fetchFn }).then((inspection) => {
+        const decision2 = evaluateCloudEndpoint(normalized, inspection);
+        blockedAt = decision2.allowed ? 0 : Date.now();
+        return decision2;
+      });
       const decision = await checked;
       if (!decision.allowed) {
         throw new CloudEndpointPolicyError(formatCloudEndpointBlock(normalized, decision), decision);
@@ -22628,7 +22634,7 @@ async function fetchHealthJson(fetchFn, url2, timeoutMs) {
     clearTimeout(tid);
   }
 }
-var DIRECT_V1_OVERRIDE_ENV, GATEWAY_SERVICE, PROBE_TIMEOUT_MS, CloudEndpointPolicyError;
+var DIRECT_V1_OVERRIDE_ENV, GATEWAY_SERVICE, PROBE_TIMEOUT_MS, CloudEndpointPolicyError, BLOCKED_RECHECK_MS;
 var init_cloud_endpoint_policy = __esm({
   "src/cloud-endpoint-policy.ts"() {
     "use strict";
@@ -22643,6 +22649,7 @@ var init_cloud_endpoint_policy = __esm({
         this.decision = decision;
       }
     };
+    BLOCKED_RECHECK_MS = 6e4;
   }
 });
 
@@ -51464,7 +51471,7 @@ function startLoopLagMonitor(thresholdMs = 1e3) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.0-dev.95" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.0-dev.97" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -54745,6 +54752,193 @@ async function loginOAuthLoopback(opts) {
   return { tokens, tokenEndpoint: endpoints.tokenEndpoint, clientId };
 }
 
+// src/device-login.ts
+init_src6();
+var DEFAULT_SCOPE = "openid profile graph:read graph:write mcp:tools";
+var BRIDGE_REDIRECT_URI = "http://127.0.0.1:1/device-bridge-callback";
+var strip2 = (u) => u.replace(/\/+$/, "");
+async function discoverDeviceEndpoint(cloudUrl, fetchFn = fetch) {
+  try {
+    const res = await fetchFn(`${strip2(cloudUrl)}/.well-known/oauth-authorization-server`);
+    if (res.ok) {
+      const j = await res.json();
+      if (j.device_authorization_endpoint) return j.device_authorization_endpoint;
+    }
+  } catch {
+  }
+  return `${strip2(cloudUrl)}/device`;
+}
+async function requestDeviceAuthorization(fetchFn, deviceEndpoint, p) {
+  const res = await fetchFn(deviceEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({ client_id: p.clientId, scope: p.scope })
+  });
+  if (!res.ok) throw new Error(`device authorization failed: HTTP ${res.status}`);
+  const j = await res.json();
+  if (!j.device_code || !j.user_code || !j.verification_uri) {
+    throw new Error("device authorization response missing device_code/user_code/verification_uri");
+  }
+  return {
+    deviceCode: j.device_code,
+    userCode: j.user_code,
+    verificationUri: j.verification_uri,
+    ...j.verification_uri_complete ? { verificationUriComplete: j.verification_uri_complete } : {},
+    expiresInSeconds: j.expires_in ?? 1800,
+    intervalSeconds: j.interval ?? 5
+  };
+}
+async function pollDeviceApproval(fetchFn, deviceEndpoint, p, sleep = (ms) => new Promise((r) => setTimeout(r, ms))) {
+  const deadline = Date.now() + p.timeoutMs;
+  let intervalMs = Math.max(1, p.intervalSeconds) * 1e3;
+  for (; ; ) {
+    if (Date.now() >= deadline) throw new Error("device approval timed out \u2014 run `errata login` again");
+    await sleep(intervalMs);
+    const res = await fetchFn(`${strip2(deviceEndpoint)}/token`, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: p.deviceCode,
+        client_id: p.clientId
+      })
+    });
+    const j = await res.json().catch(() => ({}));
+    if (res.ok && j.access_token) return j.access_token;
+    if (j.error === "authorization_pending") continue;
+    if (j.error === "slow_down") {
+      intervalMs += 5e3;
+      continue;
+    }
+    throw new Error(`device approval failed: ${j.error ?? `HTTP ${res.status}`}`);
+  }
+}
+async function authorizeWithSession(fetchFn, p) {
+  const u = new URL(p.authorizationEndpoint);
+  u.searchParams.set("response_type", "code");
+  u.searchParams.set("client_id", p.clientId);
+  u.searchParams.set("redirect_uri", BRIDGE_REDIRECT_URI);
+  u.searchParams.set("scope", p.scope);
+  u.searchParams.set("state", p.state);
+  u.searchParams.set("code_challenge", p.challenge);
+  u.searchParams.set("code_challenge_method", p.method);
+  const res = await fetchFn(u.toString(), {
+    method: "GET",
+    headers: { authorization: `Bearer ${p.sessionToken}`, accept: "application/json" },
+    redirect: "manual"
+  });
+  const location = res.headers.get("location");
+  if (!location) throw new Error(`authorize did not redirect (HTTP ${res.status}) \u2014 is the session valid?`);
+  const codeFromLocation = extractCode(location, p.state);
+  if (codeFromLocation) return { code: codeFromLocation };
+  const consentUrl = new URL(location);
+  const consentCode = consentUrl.searchParams.get("consent_code");
+  if (!consentCode) throw new Error(`authorize redirected without code or consent_code: ${consentUrl.pathname}`);
+  const pagePath = "/oauth/consent";
+  const prefix = consentUrl.pathname.endsWith(pagePath) ? consentUrl.pathname.slice(0, -pagePath.length) : "";
+  const consentApi = `${consentUrl.origin}${prefix}/api/auth/oauth2/consent`;
+  const consentRes = await fetchFn(consentApi, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json",
+      authorization: `Bearer ${p.sessionToken}`
+    },
+    body: JSON.stringify({ accept: true, consent_code: consentCode })
+  });
+  if (!consentRes.ok) throw new Error(`consent approval failed: HTTP ${consentRes.status}`);
+  const consentBody = await consentRes.json();
+  const code = consentBody.redirectURI ? extractCode(consentBody.redirectURI, p.state) : null;
+  if (!code) throw new Error("consent approved but no authorization code returned");
+  return { code };
+}
+function extractCode(redirectUrl, expectedState) {
+  try {
+    const u = new URL(redirectUrl);
+    const code = u.searchParams.get("code");
+    const state = u.searchParams.get("state");
+    if (!code) return null;
+    if (state !== expectedState) throw new Error("state mismatch in authorization redirect");
+    return code;
+  } catch (err2) {
+    if (err2 instanceof Error && err2.message.includes("state mismatch")) throw err2;
+    return null;
+  }
+}
+async function loginViaDeviceBridge(opts) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const log = opts.log ?? console.log;
+  const scope = opts.scope ?? DEFAULT_SCOPE;
+  const timeoutMs = opts.timeoutMs ?? 15 * 6e4;
+  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
+  const deviceEndpoint = await discoverDeviceEndpoint(opts.cloudUrl, fetchFn);
+  if (!endpoints.registrationEndpoint) {
+    throw new Error("cloud does not advertise dynamic client registration \u2014 try `errata login --browser`");
+  }
+  const { clientId } = await registerOAuthClient(fetchFn, endpoints.registrationEndpoint, {
+    redirectUri: BRIDGE_REDIRECT_URI,
+    scope,
+    clientName: "errata daemon"
+  });
+  const grant = await requestDeviceAuthorization(fetchFn, deviceEndpoint, { clientId, scope });
+  log(`approve this login:`);
+  log(`  visit  ${grant.verificationUri}`);
+  log(`  code   ${grant.userCode}`);
+  if (grant.verificationUriComplete && opts.open) opts.open(grant.verificationUriComplete);
+  const sessionToken = await pollDeviceApproval(fetchFn, deviceEndpoint, {
+    clientId,
+    deviceCode: grant.deviceCode,
+    intervalSeconds: grant.intervalSeconds,
+    timeoutMs
+  });
+  const pkce = generatePkce();
+  const state = randomState();
+  const { code } = await authorizeWithSession(fetchFn, {
+    authorizationEndpoint: endpoints.authorizationEndpoint,
+    sessionToken,
+    clientId,
+    scope,
+    state,
+    challenge: pkce.challenge,
+    method: pkce.method
+  });
+  const tokens = await exchangeAuthorizationCode(fetchFn, endpoints.tokenEndpoint, {
+    code,
+    codeVerifier: pkce.verifier,
+    redirectUri: BRIDGE_REDIRECT_URI,
+    clientId
+  });
+  try {
+    const consoleAuthBase = deriveAuthBase(grant.verificationUri);
+    if (consoleAuthBase) {
+      await fetchFn(`${consoleAuthBase}/sign-out`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${sessionToken}`, "content-type": "application/json" },
+        body: "{}"
+      });
+    }
+  } catch {
+  }
+  return { tokens, tokenEndpoint: endpoints.tokenEndpoint, clientId };
+}
+function deriveAuthBase(verificationUri) {
+  try {
+    const origin = new URL(verificationUri).origin;
+    return `${origin}/newapp/api/auth`;
+  } catch {
+    return null;
+  }
+}
+function openInBrowser(url2) {
+  try {
+    void import("node:child_process").then(({ spawn: spawn4 }) => {
+      const [cmd2, args2] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url2]] : process.platform === "darwin" ? ["open", [url2]] : ["xdg-open", [url2]];
+      spawn4(cmd2, args2, { detached: true, stdio: "ignore" }).unref();
+    });
+  } catch {
+  }
+}
+
 // src/cli.ts
 init_paths();
 
@@ -54997,7 +55191,9 @@ Commands:
                       Flags: --port N (default 7891)
   mcp                 Run the MCP stdio server \u2014 the agent's full errata tool
                       surface (navigation, problems, claims, burst, health)
-  login               Sign in with the cloud (OAuth by default; --device for legacy device-code)
+  login               Sign in with the cloud. Default: short verification URL +
+                      typeable code (device-bridged OAuth). Flags: --browser
+                      (loopback code flow) \xB7 --token <key> \xB7 --device (legacy v1)
   logout              Clear local cloud credentials
   link                Corrective project link (ambient linking covers the happy path).
                       Flags: --project <id> adopt an existing project (fork\u2192upstream);
@@ -55353,6 +55549,7 @@ function parseFlags(args2) {
     else if (a.startsWith("--token=")) out2.token = a.slice("--token=".length);
     else if (a === "--oauth") out2.oauth = true;
     else if (a === "--device") out2.device = true;
+    else if (a === "--browser") out2.browser = true;
     else if (!a.startsWith("--")) out2._.push(a);
   }
   return out2;
@@ -55434,7 +55631,7 @@ async function warnIfApprovalUnreachable(url2) {
   } catch {
   }
 }
-async function cmdLoginOAuth(cfg) {
+async function cmdLoginOAuth(cfg, useBrowserLoopback = false) {
   const inspection = await inspectCloudEndpoint(cfg.cloudUrl);
   try {
     assertCloudEndpointAllowed(cfg.cloudUrl, inspection);
@@ -55446,10 +55643,10 @@ async function cmdLoginOAuth(cfg) {
   console.log(`signing in via OAuth at ${cfg.cloudUrl} \u2026`);
   let result;
   try {
-    result = await loginOAuthLoopback({ cloudUrl: cfg.cloudUrl, timeoutMs: 5 * 6e4 });
+    result = useBrowserLoopback ? await loginOAuthLoopback({ cloudUrl: cfg.cloudUrl, timeoutMs: 5 * 6e4 }) : await loginViaDeviceBridge({ cloudUrl: cfg.cloudUrl, timeoutMs: 15 * 6e4, open: openInBrowser });
   } catch (err2) {
     console.error(`oauth login failed: ${err2 instanceof Error ? err2.message : err2}`);
-    console.error(`  fall back to device code:  errata login --device`);
+    if (!useBrowserLoopback) console.error(`  try the browser flow:      errata login --browser`);
     console.error(`  or paste a key:            errata login --token <key>`);
     process.exitCode = 1;
     return;
@@ -55580,7 +55777,7 @@ async function cmdLogin() {
     return;
   }
   if (shouldUseOAuthLogin(flags2)) {
-    await cmdLoginOAuth(cfg);
+    await cmdLoginOAuth(cfg, flags2.browser ?? false);
     return;
   }
   const c = new CloudClient({ baseUrl: cfg.cloudUrl });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.0-dev.95",
+  "version": "2.0.0-dev.97",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {