@inerrata-corporation/errata 2.0.0-dev.96 → 2.0.0-dev.97

package/errata.mjs

@@ -51471,7 +51471,7 @@ function startLoopLagMonitor(thresholdMs = 1e3) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.0-dev.96" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.0-dev.97" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -54752,6 +54752,193 @@ async function loginOAuthLoopback(opts) {
   return { tokens, tokenEndpoint: endpoints.tokenEndpoint, clientId };
 }
 
+// src/device-login.ts
+init_src6();
+var DEFAULT_SCOPE = "openid profile graph:read graph:write mcp:tools";
+var BRIDGE_REDIRECT_URI = "http://127.0.0.1:1/device-bridge-callback";
+var strip2 = (u) => u.replace(/\/+$/, "");
+async function discoverDeviceEndpoint(cloudUrl, fetchFn = fetch) {
+  try {
+    const res = await fetchFn(`${strip2(cloudUrl)}/.well-known/oauth-authorization-server`);
+    if (res.ok) {
+      const j = await res.json();
+      if (j.device_authorization_endpoint) return j.device_authorization_endpoint;
+    }
+  } catch {
+  }
+  return `${strip2(cloudUrl)}/device`;
+}
+async function requestDeviceAuthorization(fetchFn, deviceEndpoint, p) {
+  const res = await fetchFn(deviceEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({ client_id: p.clientId, scope: p.scope })
+  });
+  if (!res.ok) throw new Error(`device authorization failed: HTTP ${res.status}`);
+  const j = await res.json();
+  if (!j.device_code || !j.user_code || !j.verification_uri) {
+    throw new Error("device authorization response missing device_code/user_code/verification_uri");
+  }
+  return {
+    deviceCode: j.device_code,
+    userCode: j.user_code,
+    verificationUri: j.verification_uri,
+    ...j.verification_uri_complete ? { verificationUriComplete: j.verification_uri_complete } : {},
+    expiresInSeconds: j.expires_in ?? 1800,
+    intervalSeconds: j.interval ?? 5
+  };
+}
+async function pollDeviceApproval(fetchFn, deviceEndpoint, p, sleep = (ms) => new Promise((r) => setTimeout(r, ms))) {
+  const deadline = Date.now() + p.timeoutMs;
+  let intervalMs = Math.max(1, p.intervalSeconds) * 1e3;
+  for (; ; ) {
+    if (Date.now() >= deadline) throw new Error("device approval timed out \u2014 run `errata login` again");
+    await sleep(intervalMs);
+    const res = await fetchFn(`${strip2(deviceEndpoint)}/token`, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: p.deviceCode,
+        client_id: p.clientId
+      })
+    });
+    const j = await res.json().catch(() => ({}));
+    if (res.ok && j.access_token) return j.access_token;
+    if (j.error === "authorization_pending") continue;
+    if (j.error === "slow_down") {
+      intervalMs += 5e3;
+      continue;
+    }
+    throw new Error(`device approval failed: ${j.error ?? `HTTP ${res.status}`}`);
+  }
+}
+async function authorizeWithSession(fetchFn, p) {
+  const u = new URL(p.authorizationEndpoint);
+  u.searchParams.set("response_type", "code");
+  u.searchParams.set("client_id", p.clientId);
+  u.searchParams.set("redirect_uri", BRIDGE_REDIRECT_URI);
+  u.searchParams.set("scope", p.scope);
+  u.searchParams.set("state", p.state);
+  u.searchParams.set("code_challenge", p.challenge);
+  u.searchParams.set("code_challenge_method", p.method);
+  const res = await fetchFn(u.toString(), {
+    method: "GET",
+    headers: { authorization: `Bearer ${p.sessionToken}`, accept: "application/json" },
+    redirect: "manual"
+  });
+  const location = res.headers.get("location");
+  if (!location) throw new Error(`authorize did not redirect (HTTP ${res.status}) \u2014 is the session valid?`);
+  const codeFromLocation = extractCode(location, p.state);
+  if (codeFromLocation) return { code: codeFromLocation };
+  const consentUrl = new URL(location);
+  const consentCode = consentUrl.searchParams.get("consent_code");
+  if (!consentCode) throw new Error(`authorize redirected without code or consent_code: ${consentUrl.pathname}`);
+  const pagePath = "/oauth/consent";
+  const prefix = consentUrl.pathname.endsWith(pagePath) ? consentUrl.pathname.slice(0, -pagePath.length) : "";
+  const consentApi = `${consentUrl.origin}${prefix}/api/auth/oauth2/consent`;
+  const consentRes = await fetchFn(consentApi, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json",
+      authorization: `Bearer ${p.sessionToken}`
+    },
+    body: JSON.stringify({ accept: true, consent_code: consentCode })
+  });
+  if (!consentRes.ok) throw new Error(`consent approval failed: HTTP ${consentRes.status}`);
+  const consentBody = await consentRes.json();
+  const code = consentBody.redirectURI ? extractCode(consentBody.redirectURI, p.state) : null;
+  if (!code) throw new Error("consent approved but no authorization code returned");
+  return { code };
+}
+function extractCode(redirectUrl, expectedState) {
+  try {
+    const u = new URL(redirectUrl);
+    const code = u.searchParams.get("code");
+    const state = u.searchParams.get("state");
+    if (!code) return null;
+    if (state !== expectedState) throw new Error("state mismatch in authorization redirect");
+    return code;
+  } catch (err2) {
+    if (err2 instanceof Error && err2.message.includes("state mismatch")) throw err2;
+    return null;
+  }
+}
+async function loginViaDeviceBridge(opts) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const log = opts.log ?? console.log;
+  const scope = opts.scope ?? DEFAULT_SCOPE;
+  const timeoutMs = opts.timeoutMs ?? 15 * 6e4;
+  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
+  const deviceEndpoint = await discoverDeviceEndpoint(opts.cloudUrl, fetchFn);
+  if (!endpoints.registrationEndpoint) {
+    throw new Error("cloud does not advertise dynamic client registration \u2014 try `errata login --browser`");
+  }
+  const { clientId } = await registerOAuthClient(fetchFn, endpoints.registrationEndpoint, {
+    redirectUri: BRIDGE_REDIRECT_URI,
+    scope,
+    clientName: "errata daemon"
+  });
+  const grant = await requestDeviceAuthorization(fetchFn, deviceEndpoint, { clientId, scope });
+  log(`approve this login:`);
+  log(`  visit  ${grant.verificationUri}`);
+  log(`  code   ${grant.userCode}`);
+  if (grant.verificationUriComplete && opts.open) opts.open(grant.verificationUriComplete);
+  const sessionToken = await pollDeviceApproval(fetchFn, deviceEndpoint, {
+    clientId,
+    deviceCode: grant.deviceCode,
+    intervalSeconds: grant.intervalSeconds,
+    timeoutMs
+  });
+  const pkce = generatePkce();
+  const state = randomState();
+  const { code } = await authorizeWithSession(fetchFn, {
+    authorizationEndpoint: endpoints.authorizationEndpoint,
+    sessionToken,
+    clientId,
+    scope,
+    state,
+    challenge: pkce.challenge,
+    method: pkce.method
+  });
+  const tokens = await exchangeAuthorizationCode(fetchFn, endpoints.tokenEndpoint, {
+    code,
+    codeVerifier: pkce.verifier,
+    redirectUri: BRIDGE_REDIRECT_URI,
+    clientId
+  });
+  try {
+    const consoleAuthBase = deriveAuthBase(grant.verificationUri);
+    if (consoleAuthBase) {
+      await fetchFn(`${consoleAuthBase}/sign-out`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${sessionToken}`, "content-type": "application/json" },
+        body: "{}"
+      });
+    }
+  } catch {
+  }
+  return { tokens, tokenEndpoint: endpoints.tokenEndpoint, clientId };
+}
+function deriveAuthBase(verificationUri) {
+  try {
+    const origin = new URL(verificationUri).origin;
+    return `${origin}/newapp/api/auth`;
+  } catch {
+    return null;
+  }
+}
+function openInBrowser(url2) {
+  try {
+    void import("node:child_process").then(({ spawn: spawn4 }) => {
+      const [cmd2, args2] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url2]] : process.platform === "darwin" ? ["open", [url2]] : ["xdg-open", [url2]];
+      spawn4(cmd2, args2, { detached: true, stdio: "ignore" }).unref();
+    });
+  } catch {
+  }
+}
+
 // src/cli.ts
 init_paths();
 
@@ -55004,7 +55191,9 @@ Commands:
                       Flags: --port N (default 7891)
   mcp                 Run the MCP stdio server \u2014 the agent's full errata tool
                       surface (navigation, problems, claims, burst, health)
-  login               Sign in with the cloud (OAuth by default; --device for legacy device-code)
+  login               Sign in with the cloud. Default: short verification URL +
+                      typeable code (device-bridged OAuth). Flags: --browser
+                      (loopback code flow) \xB7 --token <key> \xB7 --device (legacy v1)
   logout              Clear local cloud credentials
   link                Corrective project link (ambient linking covers the happy path).
                       Flags: --project <id> adopt an existing project (fork\u2192upstream);
@@ -55360,6 +55549,7 @@ function parseFlags(args2) {
     else if (a.startsWith("--token=")) out2.token = a.slice("--token=".length);
     else if (a === "--oauth") out2.oauth = true;
     else if (a === "--device") out2.device = true;
+    else if (a === "--browser") out2.browser = true;
     else if (!a.startsWith("--")) out2._.push(a);
   }
   return out2;
@@ -55441,7 +55631,7 @@ async function warnIfApprovalUnreachable(url2) {
   } catch {
   }
 }
-async function cmdLoginOAuth(cfg) {
+async function cmdLoginOAuth(cfg, useBrowserLoopback = false) {
   const inspection = await inspectCloudEndpoint(cfg.cloudUrl);
   try {
     assertCloudEndpointAllowed(cfg.cloudUrl, inspection);
@@ -55453,10 +55643,10 @@ async function cmdLoginOAuth(cfg) {
   console.log(`signing in via OAuth at ${cfg.cloudUrl} \u2026`);
   let result;
   try {
-    result = await loginOAuthLoopback({ cloudUrl: cfg.cloudUrl, timeoutMs: 5 * 6e4 });
+    result = useBrowserLoopback ? await loginOAuthLoopback({ cloudUrl: cfg.cloudUrl, timeoutMs: 5 * 6e4 }) : await loginViaDeviceBridge({ cloudUrl: cfg.cloudUrl, timeoutMs: 15 * 6e4, open: openInBrowser });
   } catch (err2) {
     console.error(`oauth login failed: ${err2 instanceof Error ? err2.message : err2}`);
-    console.error(`  fall back to device code:  errata login --device`);
+    if (!useBrowserLoopback) console.error(`  try the browser flow:      errata login --browser`);
     console.error(`  or paste a key:            errata login --token <key>`);
     process.exitCode = 1;
     return;
@@ -55587,7 +55777,7 @@ async function cmdLogin() {
     return;
   }
   if (shouldUseOAuthLogin(flags2)) {
-    await cmdLoginOAuth(cfg);
+    await cmdLoginOAuth(cfg, flags2.browser ?? false);
     return;
   }
   const c = new CloudClient({ baseUrl: cfg.cloudUrl });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.0-dev.96",
+  "version": "2.0.0-dev.97",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {